Privacy Policy

This is a pre-launch policy. Handhold is not open to the public yet. We wrote this ourselves and checked each statement against how the software actually works today. A lawyer is reviewing it, and a reviewed version will replace this one before launch. Where something is not finished or not yet decided, this page says so.

The short version

• We collect what you put into Handhold, and a small amount of technical information needed to run it.
• Your information is never sold, never used for advertising, and only ever handled by the services that run Handhold itself. There are no ads and no ad trackers.
• Much of what you write is about someone else, usually the person you are caring for. We treat all of it as sensitive.
• Handhold is not a zero-knowledge service. Our systems can read what is stored in order to show it to you.
• You can download your data and delete your account from inside the app.

1. Who we are and what this covers

Handhold is provided by Handhold LLC, an Oklahoma limited liability company. This policy covers this website (handhold.care) and the Handhold app.

Two kinds of people appear in Handhold: you, the person with an account, and the people you write about, most often the family member you are caring for, plus the contacts and family members you add. Those people did not sign up. Section 12 explains what they can ask of us.

Handhold is not a health care provider or an insurer. The U.S. health privacy law known as HIPAA generally does not cover information you choose to put into an app like this one. That is one reason this page tries to be specific.

2. What we collect

On this website

• Waitlist: your email address.
• Contact form: the category you pick, your message, your email address, and whether it concerns an account.
• Ideas form: what you wrote, the permissions you ticked, and your email address if you gave one.

These forms are delivered to us by Formspree. This website sets no cookies, stores nothing in your browser, and loads no analytics, advertising or social-media trackers.

Your account

• Your name and email address.
• Your password, stored only as a one-way hash (argon2id). We cannot see or recover it.
• That you confirmed you are 18 or older, which version of the Terms you accepted, and when.
• A record of each device session, so that you can sign out everywhere.

About the person you are caring for

• Their name and the name they like to be called, date of birth, your relationship to them, and a photo if you add one.
• Where they are in the journey, what is weighing on your family, and whether they can take part in decisions about their own care.
• If a death is recorded: the date, who recorded it, and any notice you wrote.

What you write and store

• The "who they are" profile, the care log, visit preparation notes and questions, and the handoff page, which can include medications, allergies and emergency contacts.
• Your journal, which is private to you.
• Tasks, places you are considering, tour notes and photos, and cost and funding estimates.
• Documents you upload, with their file names, and notes about where the originals are kept.
• Key Contacts: names, phone numbers, email addresses and notes for the people your family may need to reach.

Your care circle

• Who is in the circle, the role each person has, and a history of changes to it.
• Invitations are links you pass on yourself. We do not ask for or store an invited person's email address, and we never message anyone on your behalf without you.

The Companion (where it is turned on)

• Your conversations, drafts it prepared for you, and the things you asked it to remember.

The community

• The community name you choose, which is not your real name, an optional short bio, and your posts, comments and reactions.
• Reports you make about a post, and a record of moderation decisions.

Payment (when paid plans are on sale)

• Which plan you are on, its status, and the customer and subscription identifiers Stripe gives us. Card details go to Stripe; we never receive or store them.

Support and feedback

• What you wrote to us, the email address to reply to, and your app version, operating system and plan.

Technical information

• Server logs record the internet address (IP) a request came from and the page or action requested. Passwords, sign-in tokens and document contents are kept out of these logs.
• Counts of how features are used, described in section 9.

We do not collect your location, your contacts list, or anything from other apps on your device.

3. How we use it

• To run Handhold for you: to show you what you stored, and to show your care circle what you shared.
• To run the Companion, as described in section 5.
• To send the few emails the service needs: confirming your address, resetting a password, telling someone a task was assigned to them, and a notice to a circle's owner when someone asks to take over.
• To keep the service safe: limiting repeated sign-in attempts, checking community posts against safety rules, and acting on reports.
• To take payment and answer support requests.
• To understand, in aggregate, which features are used.
• To meet legal obligations.

If you joined the waitlist, we will write when it is your turn. Marketing email from inside the app is not built.

4. What we do not do

• Your information is never sold.
• It is never used for advertising, and there are no ads in Handhold.
• No facility, agency or provider pays us to appear, rank higher or be recommended.
• Handhold is designed so your conversations are never used to train AI models. See section 5 for what that rests on today.

5. The Companion and AI

The Companion is turned off during the pre-launch period while its safety design is reviewed. This section describes how it works when it is on.

The Companion is powered by AI models from Anthropic. To answer you, Handhold sends Anthropic:

• your message and the earlier messages in that conversation, or a summary of them;
• your first name;
• the name of the person you are caring for and what they like to be called, the relationship, the stage you are in, what is weighing on your family, and whether they can take part in decisions;
• up to ten short facts from the "who they are" profile;
• up to twelve things you asked the Companion to remember.

Handhold does not send Anthropic your stored documents, the medications and allergies on the handoff page, your journal, or the care log.

Each message is checked for signs of a crisis before and after the Companion answers, so that it can point to real help. The result of that check is used in the moment and is not saved to your account.

Training. Handhold is designed so your conversations are never used to train AI models. We use Anthropic's commercial service for businesses, and we are finalizing our data-processing agreement with them before launch. Until that is signed, we describe this as how Handhold is designed, not as a guarantee.

You can erase your Companion history at any time from inside the app. Drafts the Companion prepared that you never confirmed are discarded after 7 days.

6. Who can see what

• Only you: your journal and your Companion conversations.
• Your care circle: what you share with it, according to the role you gave each person. Key Contacts are visible to the whole circle by design.
• Other community members: your community name, bio, posts and comments. Not your real name, your email address or your circle.
• Community moderators: posts that were reported or held for review.
• Handhold staff: see below.

What staff can see. Handhold is run by a very small team; today that is its founder. The support console shows account details (email address, status, how many circles and stored items an account has), your plan, and the support messages and feedback you sent us. It has no screen for reading your documents, Companion conversations, journal, care log or profile, and every action taken in it is recorded with a reason.

What that does not mean. Handhold is not a zero-knowledge service. Your information is stored in a database our systems can read, and a person with direct access to that database could technically read it. We do not do that as part of running Handhold, and we have deliberately not built tools for it.

7. The services that help us run Handhold

These companies process information for us so that Handhold can work. They are the only parties we give your information to.

We are completing data-processing agreements with these providers before launch.

Emails from Handhold are kept free of health detail. A task email, for example, names who assigned it and who it concerns, not what the task says.

We may also disclose information if the law requires it, such as in response to a valid court order, or if Handhold is sold or reorganized, in which case this policy continues to apply to what was collected under it and we will tell you.

8. Cookies and browser storage

• This website: no cookies and no browser storage.
• The app, one cookie: a sign-in cookie that keeps you logged in for up to 30 days. It cannot be read by scripts, is sent only over a secure connection, and is not sent to other sites.
• The app, browser storage: a short-lived sign-in token, your light or dark theme choice, an invitation you opened before signing in, and a note of which screen to open next.

There are no advertising or cross-site tracking cookies, so there is nothing to opt out of. Because we do not sell or share information for advertising, browser signals such as Global Privacy Control do not change how Handhold treats you.

9. Usage counts

We count how features are used so we know what is working. We built this ourselves and no analytics company is involved.

• An event records what kind of thing happened (for example, that a task was created), the stage and plan, and nothing you wrote.
• Instead of your account, an event carries a scrambled code made from your account number with a secret key. It lets us count distinct people without the event naming you.
• Individual events are deleted after 90 days. Only daily totals are kept.
• A total that covers fewer than ten people is not shown, even to us.

10. How we protect it

• Connections to Handhold are encrypted in transit.
• The database, including stored documents, is encrypted at rest by our hosting provider. Handhold does not add its own layer of encryption to documents.
• Passwords are stored only as argon2id hashes. Sign-in, reset and invitation links are stored only as hashes and expire: a confirmation link after 24 hours, a reset link after 1 hour.
• Sign-in tokens last 15 minutes and are renewed by the 30-day cookie, which is replaced each time it is used. Resetting your password signs out every device; changing it signs out every other device.
• Staff access to the support console requires a second sign-in step.

No service can promise perfect security. Do not treat Handhold as the only copy of anything important. If a breach affects your information, we will tell you as the law requires.

11. How long we keep it, and deleting it

We keep what you put into Handhold for as long as your account exists, unless you delete it sooner.

Deleting your account. You can delete your account from inside the app after re-entering your password. If you are the only person in your care circle, deletion is immediate and permanent: your circle and everything in it, your documents, journal, Companion history, support messages, subscription and sign-in details are removed, and any paid plan is cancelled first.

If other people share your circle. The app will not delete an account that is tied to a circle other people still use, because that would remove their work too. It tells you why, and a person helps you from there. Requests handled this way have a 7-day waiting period before they are carried out, so that one made in a hard moment can be undone.

What remains after deletion.

• If you used the community, your posts are removed and your community profile is replaced by an anonymous placeholder with no link to you, so that other members' conversations still make sense.
• The record that a deletion was requested and carried out, and the log of staff actions.
• Daily usage totals, which do not identify anyone.
• Backup copies held by our hosting provider, which age out on its schedule.

Website forms. We keep your waitlist address until you unsubscribe or ask us to remove it.

We have not yet set a fixed retention period for every category of information. The reviewed version of this policy will.

12. Your choices and rights

In the app today, you can:

• download a copy of your data as a file;
• delete your account, as described above;
• erase your Companion history without deleting your account;
• change your password and sign out of every device;
• change your community name, or delete your community profile.

By writing to us, you can:

• correct your name or change your email address, which the app does not yet let you do yourself;
• leave a care circle, if its owner has not removed you;
• ask what we hold about you, ask us to correct or delete it, or ask a question about this policy.

We answer these requests for everyone, whichever state you live in, and we will not treat you differently for making one. If we decline a request, we will say why, and you can ask us to look again.

If someone wrote about you. If you are the person being cared for, or a contact someone added, you can write to us too. These requests involve more than one person's information, so a person handles each one, and we may need to involve the owner of the circle.

State health-data laws. Some states, including Washington, have specific laws about consumer health information. We are preparing the separate notice those laws call for with counsel, and it will be published before launch.

13. When someone dies

When a death is recorded in a care circle, nothing is deleted. Billing for the circle's owner is paused, and the record can be undone for 14 days if it was made by mistake.

If an account holder dies, we do not automatically release their private notes, journal or Companion conversations to anyone. What they had already shared with their care circle stays available to that circle. Someone with legal authority over their affairs can write to us.

14. Children

Handhold is for adults 18 and older, and is not directed to children. We ask everyone to confirm their age at sign-up and cannot verify it. If we learn that an account belongs to someone under 18, we will close it. If a message to the Companion suggests the person writing is a young person in crisis, the Companion points them to crisis help; that is a safety measure, not an invitation for under-18 use.

15. Where your information is

Handhold is operated from the United States and is intended for people in the United States. Your information is stored and processed in the United States.

16. Changes to this policy

This policy will change, at the least when the reviewed version replaces this pre-launch one. Each version carries a version label and an effective date at the top of this page. When a change is material, we will tell you by email or in the app before it takes effect.

17. Contact

Handhold LLC · hello@handholdcare.com

See also our Terms of Service and public promises.

Version 2026-10-05 (pre-launch) · Published October 5, 2026 · Not yet reviewed by counsel.