Privacy Policy
Last updated: 2026-10-14
Handnotes ("we", "us") runs Handnotes at handnotes.ai. This policy explains what we collect, why, and the choices you have. Contact: [email protected].
What we collect
| What | Why | Where it lives |
|---|---|---|
| Your email address and a scrambled (scrypt) version of your password | To run your account and send account emails (tell you about significant changes to the service) | Our server's database |
| Your handwriting samples (the letters you write on screen or upload as photos or scans) and the handwriting model fitted from them | To write your notes in your handwriting | Your own folder on our server |
| The material you attach (assignments, notes, photos, documents) and the notes generated from it | To write and later rewrite your notes | Your own folder on our server |
| Lecture material you add to a class (slides, documents): only the text is kept | So notes can draw on your course's own material | Your own folder on our server |
A sign-in cookie (hn_session) | To keep you signed in. It is the only cookie we set. We store only a hash of it. | Your browser; the hash on our server |
| Your writing-style preferences | So the editor remembers them | Your browser's local storage, not our server |
Our server also keeps your network address in memory for a short while to limit sign-in attempts and bursts of requests, and, like most web servers, in its request logs.
The "Try it" box on the front page writes the words you type in a sample handwriting on our server; they are not stored and not sent to an AI provider.
We do not use advertising or analytics trackers, we do not sell your data, and we do not use your content to train AI models.
Who else processes it
- AI provider: Google (the Gemini API). When you ask for notes or rewrite a section, the material you attached (and the matching passages of any lecture material you added) is sent to this provider to write the answer. When you upload old handwritten pages to learn your handwriting, the page images are sent to it to read the words. Their terms for API use apply (their policy). The printed handwriting sheet, the copied-lines method and writing on screen are read on our server and are not sent to an AI provider.
- Our hosting provider, where the server and its backups run.
How long we keep it
- Your notes, attachments, lecture material and handwriting are kept while your account exists. A note you delete can be restored for one day, then it is removed.
- Deleting your account (Account settings, "Delete my account") immediately removes your account, your sign-in sessions and every file you stored with us. Copies may remain in our backups for up to 30 days.
Your choices
- Download everything: Account settings, "Download all my data", gives you your notes (as data and as PDFs), the material they were written from and your handwriting samples and models.
- Correct or delete: edit or delete any note, class or handwriting profile at any time, or delete the whole account.
- Access, correction, deletion and portability: the tools above give you these directly; for anything else, or to object to how we use your data, email us. If you live somewhere with a privacy regulator, you can also complain to them. We rely on our agreement with you (these terms) to process your data to run the service, and on our legitimate interest in keeping it secure for the rate limits and logs above.
Children
Handnotes is not for children under 13. If you believe a child has given us personal data, email us and we will delete it.
Security
Passwords are stored only as salted scrypt hashes, sessions only as hashes, and the site is served over HTTPS. No system is perfectly secure; tell us at [email protected] if you find a problem.
Changes
We will post any change here and update the date above; for significant changes we will email you.