Privacy policy

Who we are

Handle, at handle.pub, is run by OpenHandles.

Contact

Email privacy@handle.pub about this policy or about personal information Handle holds. You can ask a question, ask what we hold about you, ask us to correct it, or ask us to delete your account. You can also write if you are concerned about how we handle that information.

What we collect

• Your email address, the handle you claim, and a hash of your password. We never store the password itself.
• What you add to your profile: a name, pronouns, a bio, a picture, a location, a time zone, who you follow or block, and whether your profile is public or private.
• Linked identities you add, such as another email, a domain, a GitHub, X, Mastodon, GitLab, Bandcamp, Substack, Genius, Discogs, Bluesky, Reddit or LinkedIn account, or an SSH or OpenPGP public key.
• When you link an identity, or ask to verify one: the IP address and browser user agent of that request, kept privately. When Handle checks a proof: the outcome and its time, the link to the public proof, the provider's account number for GitHub, GitLab, Genius, Discogs, Substack and Reddit, the durable Bluesky account identifier (DID), and, for a key, the signed text and signature.
• For each completed browser sign-in: the time, the IP address supplied by Cloudflare when available, and up to 512 characters of the browser User-Agent. These are private security metadata, not proof of a device, location or live activity.
• Your email preferences: whether you want product updates and new follower emails, and when you last changed each.
• Activity: a history of what you do on Handle, such as joining, following and unfollowing, changing your status, and linking and verifying identities, each with its time and whether you shared it. It keeps the status and the public name of an identity as they were, never an email address, a key or a proof. A ping records its sender, recipient and time in the recipient's Activity.
• An email address if you join the waitlist, a note if you send feedback, and a hash of a personal access token if you create one.
• Developer applications you register: the name, the redirect addresses, the type, and a hash of the client secret. When you allow an application: which one, the permissions you gave it, when, and hashes of the tokens it holds.
• When you claim a handle: your IP address, network, browser user agent, and any utm_source or utm_medium on the link you came from.
• When you change your handle: the previous name, the new name, the time, and whether the check used your authenticator app or a recovery code. We do not keep the code. The previous name is not shown on your page.
• Invitations: an address supplied by your friend, the inviting account, the invitation method and lifecycle, and the new account created through it. Staff use these records to investigate abuse. Inviting someone does not make you responsible for their behavior.
• Security records: the IP address behind each password reset and handle reminder, encrypted two-step verification secrets, hashed recovery codes, and a short-lived step-up check before a sensitive action.
• If you buy from the shop: what you bought, its price, the order's status and history, and the shipping name and address you give at checkout. Your card details go to Stripe and never reach Handle.

How we use it

• To run your account: sign you in, send you codes and notices by email, and show your profile.
• To send optional email only as you choose in Privacy settings. Product updates go only to people who opt in, and new follower emails can be turned off. Account and security email is always sent.
• To keep accounts safe: rate limits, captchas, and spotting abuse.
• We do not sell your personal information or share it for cross-context behavioral advertising. Our pages carry no ads or analytics scripts. Cloudflare Web Analytics is disabled for Handle. Do Not Track and Global Privacy Control signals do not change this behavior: we do not sell personal information or use it for cross-context behavioral advertising with or without those signals.

What is public

Your handle page shows your handle, name, pronouns, bio, picture, location and time zone when you choose to show them, joined month, and follower counts. Follower lists are public unless your profile is private. A linked identity shows on your page as soon as you link it, marked Unverified until you verify it, unless your profile is private, you hide a linked email, or you do not publish a key. A linked email can be masked. The verification status, method, public proof link and history of verification attempts, with their times, are public too. The email address you sign in with is hidden unless you choose to show it on your profile. When you do, anyone can see it on your handle page and through the API, even when your profile is private.

Your Activity is public by default, on your handle page and through the API, newest first. In Privacy settings you can share it with your followers only or keep it to yourself, and choose whether new changes start shared. Each status change, link and verification has its own Broadcast to Activity choice. An entry you do not share is kept and shown only to you. Activity about a linked identity is hidden while your profile is private, and when you unlink the identity. Pings you receive identify the sender and you, and are public by default within your Activity visibility. You can hide all past and future received pings in Privacy settings without deleting them.

Cookies

We set six cookies for signing in, confirming a sensitive action, buying from the shop, or using an invitation: h.sid keeps you signed in for up to 12 hours, or 30 days if you choose Remember me, h.mfa holds a sign-in for up to 5 minutes while it waits for a two-step code, and h.stepup holds a step-up check for up to 15 minutes. h.oauth.return holds the address of an application's request for up to 10 minutes while you sign in, so you come back to it. h.shop.return holds the shop product you pressed Buy on for up to 10 minutes while you sign in, so you come back to it. h.invite carries a beta invitation for up to 30 days and is cleared after a successful claim. You can remove these cookies through your browser or sign out to end your session. These are first-party cookies provided by Handle to run the feature you request, not tracking cookies. They are Secure and HttpOnly. Blocking them can stop sign-in, invitations or returning to a checkout or application request.

Cloudflare may also set security cookies when it challenges a request, such as cf_clearance to remember a passed check, with a configured challenge passage of 30 minutes. These are separate from Web Analytics and are used to protect the site.

Browser storage

The optional emoji picker in Settings saves emoji data, frequently used emoji and your skin tone in this browser, only after you turn on Allow emoji picker storage on this browser. That choice is remembered for 180 days on this browser. You can turn it off in the Status card in Settings to erase the picker data, including data saved by earlier versions. If another settings tab is open, you may need to close it to finish erasing. Picker data has no automatic expiry while you stay away; an expired choice is cleared with that data the next time you open these settings. You can also clear it using your browser's site data controls. It is not sent to Handle. You can type or paste an emoji without enabling the picker.

We do not otherwise use localStorage or sessionStorage. The CLI theme lasts only for the current page. The self-hosted Cap security check uses temporary page memory and makes requests to Handle, without storing a browser identifier. Your browser can cache site assets and fonts under its own cache rules.

Where it is stored, and who else sees it

• Cloudflare stores the data, serves the site, sends account email, and receives mail sent to Handle addresses.
• Mail sent to those addresses is forwarded to the OpenHandles inbox at Proton Mail.
• Pages load fonts from Google Fonts, so Google sees your IP address when a page loads.
• Stripe takes payment for shop orders. It receives your email address and what you are buying from us, and the card details, name and shipping address you enter on its checkout page, under its own privacy policy. Checkout opens on Stripe, which may use its own cookies and storage; its cookie policy describes their purposes and choices. Stripe scripts do not load on Handle pages.
• An application you allow gets what its permissions cover through the API, such as your profile or your blocks, until you revoke it or it is deleted. What it does with that data is up to its developer, whose handle the consent page shows.
• When you ask to verify a linked identity, Handle asks its provider for the public proof, such as GitHub, GitLab, X, the Mastodon server you name, Substack, Bandcamp, Genius, Discogs, Bluesky, Reddit, or your domain. The provider sees Handle's request for that account, not your IP address.
• We share data with anyone else only when the law requires it.

How long we keep it

The login IP and association with a User-Agent are deleted with the browser session on sign-out, Logout from Account Settings, password reset or other session revocation. We keep each distinct User-Agent string indefinitely in a shared dictionary, including after its last session is deleted. The dictionary itself contains no account identifiers or session history. Sessions expire after 12 hours, or 30 days with Remember me. Scheduled cleanup targets deletion within 24 hours of expiry while it succeeds; outages can delay deletion. Recoverable database backups may retain older copies under Cloudflare backup retention. Login metadata is not published or included in the API, emails or Activity. Authorized staff can view session login IP addresses and coarse browser and device descriptions to investigate security issues, and owners and administrators can revoke individual sessions. Raw login User-Agent strings are not displayed. Revocations log the staff and account identifiers without login metadata or credentials.

We keep account data while your account exists. For now we also keep unconfirmed claims, invitation attribution, security records, and shop orders with their shipping address. Invitation recipient addresses are cleared when an account is created, delivery fails, or the invitation is revoked. Expired addresses are cleared on the next invitation activity. Invitation codes expire after 30 days. Sign-in codes and password reset links stop working within an hour. Some proof codes last longer, and the page that sends one says how long. The IP address and user agent of a link or verification request are cleared 90 days after the identity is unlinked or the request ends. An unlinked identity and its verification history are kept privately, and never shown. A personal access token you delete is hidden from Settings, and its record is kept as a security record. An application you disconnect is removed with its tokens. A developer application you delete stops working at once, with every connection to it, and the last copies of those connections are erased within 30 days. A connection ends by itself 30 days after you allow it. There is no way to delete an account from the site yet: email privacy@handle.pub and we will delete it for you.

Changes

We will update this page and its effective date when this policy changes.