Handoff ("we", "us", "our", or "Company") operates the https://handoff.one website and related services (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.
We collect information you provide directly, including:
openid, profile, and email scopes.gmail.readonly scope — and nothing else. Handoff cannot send mail as you; it holds no send or compose scope and contains no code that sends mail. We read your mailbox only as the tail of an action you took: when Handoff submits or requests something on your behalf it records what it is waiting for, and reads only within that narrow window, from that sender. If there is no such record, no read happens. We do not use your Gmail content to train AI or machine learning models.We use the collected data for various purposes:
We integrate with third-party services including:
These services have their own privacy policies, and we encourage you to review them.
Handoff’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Handoff does not use Gmail data for serving advertisements, does not allow humans to read your Gmail data unless we have your explicit consent for specific messages, and does not transfer or sell Gmail data. We use Gmail data solely to power the features you explicitly enable in your settings (confirming that an application you sent was actually received, and reading a verification code a site emailed you at the moment you asked for one).
Your data is encrypted in transit (TLS) and at rest, held in a Postgres database where row-level security scopes every row to its owner. It is not end-to-end encrypted, and we will not claim otherwise: Handoff has to be able to read your answers in order to type them into an employer’s form for you, and it holds the OAuth token for any mailbox you connect. Treat anything you store here as readable by Handoff.
One category is different by construction. Handoff cannot type a password. The browser extension has no password action in its vocabulary, any credential you enter during a sign-up is kept isolated on your own device and never synced to us, and a runtime check rejects any payload that looks like secret material before it can leave the browser. That is a property of the code, not a policy we could quietly relax.
We are not SOC 2 certified and have not undergone an independent security audit. No method of transmission over the Internet or electronic storage is completely secure.
You have the right to:
We use cookies and similar tracking technologies to enhance your experience. You can manage cookie preferences through your browser settings. Some cookies are essential for the Service to function properly.
If you have questions about this Privacy Policy or our privacy practices, please contact us at:
Email: privacy@handoff.one