Privacy Policy
Last updated 5 November 2026
What we collect
Account: your email address and an authentication record. Passwords are stored hashed by our authentication provider; we never see them.
Letter banks: the outlines of the characters you capture, but only the ones you explicitly save to your account.
Billing: a customer and subscription identifier, your plan status, and renewal date. Card numbers go directly to the payment processor and never reach us.
Usage and diagnostics: events such as opening an assignment, generation duration, page counts, downloads, and fixed error categories. These records can be linked to your account and a random visitor identifier. They do not contain assignment text, file names, handwriting, or document contents.
We do not use advertising identifiers, we do not track you across other apps or websites, and we do not sell personal data.
What stays on your device
When you choose a Studio Plus font download, your letter outlines and font name are sent to Handform to package the OpenType file. They are processed in memory, not saved or sent to an AI provider. Your downloaded font remains yours after cancellation.
Documents you upload, the pages rendered from them, and your working draft stay in local app or browser storage unless you ask for something that needs a server. In the iOS app, exports also save a copy in the Handform folder in Files. You choose whether to share that copy with another app.
The On this device inbox stores separate originals and drafts locally. Remove a file there to delete its local original and draft. Downloaded copies remain where you saved them. Local batches run while Handform stays open.
Background processing and Canvas connections are separate, optional services described below.
Sharing with Anthropic (Claude)
When you ask us to draft or regenerate answers, we send a picture of the page you asked us to complete; up to two neighbouring pages, so a question split across pages still makes sense; any directions you typed and up to two pages of a rubric you chose to attach; your writing sample, only when you enable voice matching to Anthropic (Claude) to draft answers.
We do not send your sign-in credentials or payment information; your handwriting samples or letter bank; files you did not choose to attach.
Handform temporarily stores the pages and directions sent for processing so a dropped connection does not lose your request. Those inputs are removed when processing finishes or fails; interrupted jobs are cleared by scheduled cleanup. Answers are privately recoverable for 24 hours, then deleted by cleanup, normally within five minutes. Deleting a local file does not immediately delete this temporary server copy; deleting your account does. Database backups may retain deleted records under the provider’s backup policy. Optional background files have a separate seven-day retention. Anthropic processes page images under its API retention policy, normally up to 30 days, with longer retention possible for safety or legal reasons.
We ask for your explicit permission before this happens. Account lets you reset the permission for on-device drafting and separately pause all background AI. A page already sent may finish. Existing answers remain available; restarting a background file or re-enabling automatic Canvas drafting authorizes it again.
Background homework and Canvas
When you explicitly start background processing, we privately store your original file, directions, a copy of your handwriting bank, intermediate answers and output PDF in Supabase. Cloudflare runs the same document renderer in an isolated browser. Page images and directions go to Anthropic; your letter shapes do not. These files expire after seven days and are removed by our scheduled cleanup, normally within 20 minutes after expiry.
A full Canvas connection uses school-approved OAuth. We encrypt access and refresh tokens and read only courses, assignments and their attached files. You choose courses and separately enable automatic drafting with a daily file limit. Existing AI page limits apply. We never ask for your school password and do not submit assignments.
Calendar-only sync stores an encrypted private feed link and a private snapshot of assignment titles, descriptions and due dates. It does not provide attachment access, submission status or a complete record of missing work. It does not send calendar contents to AI. Disconnecting removes the link and its snapshot.
Disconnecting Canvas stops future imports and removes its tokens and course snapshot. Its saved connection bank is deleted after a 20-minute safety delay and the next scheduled cleanup, normally within 25 minutes. Existing background files remain until you delete them or they expire. Deleting a cloud file stops processing and removes its original, draft, letter-bank copy and output. A file already running is removed after it finishes stopping, normally within 20 minutes. Copies opened into the local inbox or downloaded elsewhere remain separately under your control.
Account deletion disconnects integrations and stops background jobs. Temporary content is removed by the same cleanup after any active lease ends. Database backups may retain deleted records for the provider’s backup retention period; they are not accessible in the product.
Other processors
Authentication and database: Supabase. Payments: Stripe. Hosting and request routing: Cloudflare.
Each is contractually required to protect your data to at least the standard described here, and to use it only to provide the service.
Keeping and deleting data
We keep your account data while your account exists. Delete your account from Account → Delete account and we remove your letter banks, membership record, and sign-in.
Billing records we are required to keep for tax and accounting are retained for as long as the law requires, and are not used for anything else.
Usage events are unlinked from your account during deletion rather than erased. Downloaded files, local device copies, and copies you chose to share elsewhere are not removed by account deletion.
To ask what we hold, to correct it, or to withdraw consent, write to support@handform.app.
Children
Handform is not directed at children under 13 and we do not knowingly collect their data. If you believe a child under 13 has created an account, write to us and we will delete it.