Handover is a self control tool. It works better the less it knows about you, so it is built to hold as little as possible.
| Data | Why | Where it lives |
|---|---|---|
| Email address, and a display name if you give one | Your account and sign in codes | Cloudflare Workers and D1, our servers |
| A sign in identifier from Apple or Google, if you use those | Recognising you on your next sign in | Our servers |
| Your rules, streak and credits | So they survive a reinstall or a new phone | Your device, and our servers once you create an account |
| Referral codes and who redeemed them | Awarding credits and preventing abuse | Our servers |
| Your app state backup, once you are signed in: your rules with their names, windows and settings, recent history, statistics, preferences, theme, display name and avatar | So a reinstall or a new phone restores everything as you left it | Our servers |
| A support message you send us: its text, your email address, your account id, your platform and app build | To answer you | Our servers, then our helpdesk |
| Your IP address, held briefly | Rate limiting and abuse prevention on sign in and referrals | Our servers |
Which apps you block is never part of the backup. On iPhone those are Apple's opaque tokens, which we cannot read and which cannot travel between devices, so after a reinstall your rules come back and you pick their apps again.
There is no third party analytics in the Handover app. No Google Analytics, no Facebook SDK, no attribution networks.
This website is a separate thing and it does use Google Analytics, to count visits and to see which pages and which links people arrive from. That is website traffic only. It is never joined to anything you do in the app, and the app sends nothing to it.
Performance of a contract for your account, the syncing of your own data and the backup that restores it. Legitimate interest for preventing abuse of referral credits, for the rate limiting that is why an IP address is held briefly, and for answering a support message you send us. Consent for notifications, Screen Time, Motion and Fitness and location, each granted in your system settings and revocable there at any time.
Data is kept while your account exists. Deleting your account, in the app under Account or by emailing us, removes your personal data from our systems within thirty days. Backups roll off within ninety days. You can use Handover without an account at all, in which case nothing leaves your phone.
Access, correction, deletion, export, restriction and objection, and a complaint to your data protection authority. In Australia that is the OAIC. Email handover@tinkerlane.app and we respond within thirty days.
Cloudflare, for hosting, the database and sending sign in emails. Enchant, the helpdesk that receives support messages you send us. Apple and Google, for sign in and for payments, under their own terms. The place picker also contacts ipapi.co and OpenStreetMap, as described above, which see your IP address but receive no account data. Nobody else receives personal data.
Handover is not intended for under sixteens. We delete accounts we find to be underage.
Material changes will be shown in the app before they take effect.