Privacy Policy

This Privacy Notice for MESQUITE & THORN DIGITAL, LLC (doing business as Handsful) ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://handsful.app or any website of ours that links to this Privacy Notice
• Sign up for product updates or subscribe to our emails
• Download and use our mobile application (Handsful) or any other application of ours that links to this Privacy Notice
• Use Handsful. Handsful is a mobile app that helps parents of multiples (twins, triplets, and more) log and track care activities for each of their children — including feeding, sleep, diaper changes, and growth — simultaneously across babies, compare activity side by side, share access with up to five caregivers per family — partners, family members, or other trusted caregivers — prepare notes for pediatrician visits, and, optionally, generate AI-powered summaries of care patterns (Insights). The app is intended for use by adults; it is not directed to children and is not intended to be used by children.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@handsful.app.

A note on who this policy is about

This Privacy Notice describes both (1) how we handle information about you, the parent or caregiver who creates an account, and (2) how we handle information you provide about your child or children in the course of using the Services. Information about your children is provided by you, not collected directly from them, and is used solely to deliver the care-tracking features you've chosen to use.

Summary of key points

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. This includes information about your child or children that you choose to log. Learn more below.

Do we process any sensitive personal information? Yes. The care activity data you log about your child or children — including feeding, sleep, diaper, growth, and pediatrician visit information — is treated by us as sensitive consumer health data, and we apply heightened protections to it as described in this Notice.

Do we collect any information from third parties? We do not purchase or receive information about you from third-party data brokers. If you choose to sign in using a third-party service such as Google, we receive the basic profile information (such as your name and email address) that you authorize that service to share with us.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process sensitive consumer health data only with your affirmative consent, and only for the purposes you authorize. Learn more below.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. We do not sell or share your sensitive consumer health data, and we do not use it for advertising. Learn more below.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. Learn more below.

What are your rights? Depending on where you are located, applicable privacy law may give you certain rights regarding your personal information, including sensitive consumer health data. Learn more below.

How do you exercise your rights? The easiest way to exercise your rights is by contacting us at privacy@handsful.app. We will consider and act upon any request in accordance with applicable data protection laws.

Table of contents

1. What information do we collect?
2. Sensitive consumer health data: how we handle your child's care information
3. Insights: AI-generated summaries
4. How do we process your information?
5. When and with whom do we share your personal information?
6. Do we use cookies and other tracking technologies?
7. How do we handle your social logins?
8. How long do we keep your information?
9. How do we keep your information safe?
10. Do we collect information from minors?
11. What are your privacy rights?
12. Controls for Do-Not-Track features
13. Do United States residents have specific privacy rights?
14. Washington My Health My Data Act rights
15. Do European Union residents have specific privacy rights (GDPR)?
16. Shared caregiver access
17. Do we make updates to this notice?
18. How can you contact us about this notice?
19. How can you review, update, or delete the data we collect from you?

1. What information do we collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us, including care information you choose to log about your child or children.

We collect personal information that you voluntarily provide to us when you register on the Services, sign up for our emails, express interest in our products, or otherwise contact us.

Personal Information Provided by You. This may include:

• Name
• Email address
• Password
• Contact and marketing preferences
• Your children's first names
• Your children's dates of birth (used to calculate age-appropriate tracking)
• Account identifier (a user ID created when you register)
• Subscription status and purchase history (received from RevenueCat and the app stores; see "Payment Data" below)
• Crash and diagnostic data (see "Application Data" below)

Sensitive Consumer Health Data. When you use the app, you may log care activity data about your child or children, including: feeding times and amounts, sleep periods, diaper changes, growth measurements, free-text notes, and Visit notes recording what happened at medical appointments. We treat this data as sensitive consumer health data. See Section 2 for how we handle it specifically.

Payment Data. If you subscribe to a paid tier, payment is handled by Apple, RevenueCat, and/or Google Play. We do not store your full payment card details. We do receive and store your subscription status and purchase history (for example, which plan you purchased and whether your subscription is active), which we use to manage your access to paid features. See their privacy notices: https://www.apple.com/legal/privacy/, https://www.revenuecat.com/privacy, https://policies.google.com/privacy.

Social Media Login Data. If you register using Google Sign-In, we collect the profile information provided by that service, as described in Section 7.

Application Data. If you use the app, we may collect, with your permission, information from your mobile device such as device identifiers, model, operating system and version, and information about how you use app features. This is used to maintain security, troubleshoot issues, and for internal analytics. If the app crashes, we collect crash and diagnostic data through Firebase Crashlytics, associated with your account, to identify and fix the problem.

Information automatically collected

In Short: Some information, such as your IP address and device characteristics, is collected automatically when you visit the website.

When you visit the website, we automatically collect log and usage data (IP address, browser type, pages viewed, referring URLs) and device data. This does not, on its own, reveal your identity. See our Cookie Notice at https://handsful.app/cookies for details on tracking technologies used on the website.

Google API

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. Sensitive consumer health data: how we handle your child's care information

In Short: Feeding, sleep, diaper, growth, and pediatrician visit data you log about your child is sensitive consumer health data. We collect it only with your consent, use it only to provide the Services you request, and do not sell it or use it for advertising.

Because Handsful is built around logging care activities for infants and young children, much of the data you enter is, or is closely related to, health information about a minor. We apply the following commitments to this category of data specifically:

• We collect this data only when you affirmatively choose to log it.
• We do not sell this data.
• We do not share this data for the purposes of targeted advertising.
• We do not use geofencing around health care facilities in connection with this data.
• Access to this data within our systems is limited to what is necessary to provide the Services (for example, syncing your entries across your devices and to caregivers you've invited).
• Where we use third-party infrastructure providers to store or process this data (see Section 5), those providers are contractually restricted from using it for any purpose other than providing services to us.
• You may delete individual entries or your full account's data at any time from within the app. See Section 19.

We have introduced one such feature — Insights, described in Section 3. Any future feature that processes this data with AI tools will likewise be described here, with the provider named, before it is enabled for your account.

3. Insights: AI-generated summaries

In Short: Insights is an optional feature that uses Anthropic's Claude to generate short summaries of your child's care patterns. It is off by default, requires both a family-level opt-in and each caregiver's individual consent, never processes Visit notes, and summaries are automatically deleted after 8 weeks.

Insights generates plain-language summaries of your child's care patterns using Claude, an AI service provided by Anthropic, PBC ("Anthropic"). When Insights runs, we send the relevant care activity data to Anthropic's API to produce the summary, and the summary is stored in your family's account.

What is sent to Anthropic. Feeding, sleep, diaper change, and growth entries, and free-text notes, for the child or children being summarized.

What is never sent to Anthropic. Visit notes — the log type for recording what happened at a pediatrician or other appointment — are never sent to Anthropic, regardless of your Insights settings. Pumping entries are also never included in summaries.

Consent — two layers, both required. Insights is off by default. It runs only if (1) your family has turned on the Insights setting, and (2) the individual caregiver has given their own consent. Everything logged by a caregiver who has not individually consented — care entries and notes alike — is excluded from the data we send to Anthropic, even when the family setting is on.

Withdrawing consent. You can turn Insights off for your family, and each caregiver can withdraw their individual consent, at any time in the app's settings. Withdrawal stops all future sending of that data to Anthropic.

Retention. Insights summaries are automatically deleted 8 weeks after they are generated. The underlying care entries are not affected and remain subject to Section 8 (How long do we keep your information?).

Anthropic's use of this data. Anthropic processes this data only to provide the summarization service to us and is contractually restricted from using it for any other purpose. Anthropic retains this data only temporarily — inputs and outputs are automatically deleted from Anthropic's systems within 30 days, except where content is flagged by Anthropic's automated safety systems or retention is required by law. Anthropic does not use this data to train its AI models.

As with all sensitive consumer health data, we do not sell data sent to or generated by Insights, and we do not use it for advertising.

4. How do we process your information?

In Short: We process your information to provide, improve, and administer the Services, communicate with you, for security and fraud prevention, and to comply with law.

We process personal information to:

• Create and maintain your account and authenticate you
• Deliver the care-tracking, comparison, and caregiver-sharing features you use
• Respond to support inquiries
• Send administrative information about the Services
• Send marketing communications, where you've opted in (see Section 11)
• Protect the Services, including fraud monitoring
• Understand usage trends and improve the Services
• Comply with legal obligations

We do not use your child's care data to make automated decisions that produce legal or similarly significant effects, and we do not use it to train third-party AI models.

5. When and with whom do we share your personal information?

In Short: We share information only with service providers who need it to operate the Services, under contract, and never for advertising purposes involving sensitive consumer health data.

Website:

App:

Of the providers above, Firebase/Google Cloud (which stores and syncs your data) and Anthropic (which processes care activity data solely to generate Insights summaries, and only when you have enabled Insights) have access to sensitive consumer health data. Each is contractually restricted from using your data for any purpose other than providing services to us. We will update this table as providers change.

We also may need to share your personal information in connection with a merger, sale of company assets, financing, or acquisition of all or part of our business — sensitive consumer health data will remain subject to the protections in this Notice through any such transfer.

6. Do we use cookies and other tracking technologies?

In Short: We use cookies and similar technologies on the website for functionality and, with your consent, for analytics.

We use essential cookies to operate the website. With your consent, given through our cookie banner, we also use Google Analytics to understand website usage. GA4 does not collect or process any information from within the app itself, and never processes your child's care data.

You can withdraw consent to analytics cookies at any time through the cookie preferences link in the website footer. See our Cookie Notice at https://handsful.app/cookies for full details.

7. How do we handle your social logins?

If you register using Google Sign-In, we receive certain profile information (such as name and email address) from Google, used only for the purposes described in this Notice. We recommend reviewing Google's privacy notice to understand their own data practices.

8. How long do we keep your information?

In Short: We keep your information for as long as you have an account, unless a longer period is required by law.

We retain personal information, including care activity data, for as long as your account is active. When you delete your account, we delete or anonymize your data, except where retention is required for legal, tax, or fraud-prevention purposes, or where data exists in backup archives, in which case we isolate it from further processing until deletion is possible. Insights summaries are an exception with a shorter life: they are automatically deleted 8 weeks after they are generated, as described in Section 3.

9. How do we keep your information safe?

We implement reasonable technical and organizational security measures designed to protect personal information, including sensitive consumer health data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Do we collect information from minors?

In Short: Handsful is designed for use by parents and caregivers 18 years of age or older. We do not knowingly collect personal information directly from children.

We do not direct the Services to children and do not knowingly collect personal information directly from a child. In particular, the Services are not directed to children under 13, and we do not knowingly collect personal information directly from anyone under 13. If we learn that we have, we will delete it promptly. Parents and caregivers may log information about their children — including first name, date of birth, and care activity data — but this is provided by the parent or caregiver, not the child, and is used solely to deliver the tracking features within the parent's account. If you believe we have inadvertently collected information directly from a child, contact us at privacy@handsful.app and we will promptly address it.

11. What are your privacy rights?

You may withdraw consent, opt out of marketing communications, and review, update, or delete your account information at any time. See Section 19 for how to exercise these rights. Sensitive consumer health data can be deleted at the individual entry level or in bulk via account deletion within the app.

12. Controls for Do-Not-Track features

There is currently no uniform standard for DNT signals, so we do not respond to them at this time. If a legal standard is adopted, we will update this Notice accordingly.

13. Do United States residents have specific privacy rights?

In Short: Residents of California, Colorado, Connecticut, and other states with comprehensive privacy laws have rights to know, access, correct, delete, and opt out of certain processing of their personal information, including sensitive personal information.

Categories of Personal Information We Collect (past 12 months):

We have not sold your personal information, including sensitive personal information, in the preceding twelve months. We do not use sensitive consumer health data for cross-context behavioral advertising.

Your rights include the right to know, access, correct, delete, obtain a copy of, and opt out of certain processing of your personal information, including the right to limit use of sensitive personal information under California law. To exercise these rights, contact us at privacy@handsful.app.

14. Washington My Health My Data Act rights

In Short: If you are a Washington resident, or your consumer health data was collected in Washington, you have specific rights under the My Health My Data Act.

We treat the care activity data logged in Handsful (feeding, sleep, diaper, growth, and pediatrician visit notes) as "consumer health data" under the Washington My Health My Data Act. In addition to the rights described elsewhere in this Notice, Washington residents have the right to:

• Confirm whether we are collecting, sharing, or selling their consumer health data, and to access that data
• Withdraw consent to our collection or sharing of their consumer health data
• Have their consumer health data deleted

We obtain your consent before collecting consumer health data, do not sell it, and do not share it for advertising purposes. To exercise these rights, contact privacy@handsful.app. You may also submit complaints to the Washington State Attorney General.

15. Do European Union residents have specific privacy rights (GDPR)?

In Short: If you are located in the EU/EEA or UK, you have rights under the GDPR, including for special category data such as your child's health-related information.

Where GDPR applies, our legal basis for processing your account information is performance of a contract with you (providing the Services) and, for marketing, your consent. Our legal basis for processing your child's care activity data is your explicit consent, given at the point you enable tracking features.

Legal Basis for Processing

Where the General Data Protection Regulation (GDPR) applies, we process your personal data on the following legal bases:

• Automatically collected data (such as IP address and server logs): our legitimate interest in operating, securing, and maintaining the Service.
• Analytics data (such as Google Analytics events): your consent, which you may withdraw at any time via our cookie preferences.
• Account and app data: performance of our contract with you (providing the Service you signed up for).

International Data Transfers

We and our service providers (including Google, Kit, and — if you enable Insights — Anthropic) are based in the United States. Where we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards, including Standard Contractual Clauses.

You have the right to access, rectify, erase, restrict, or port your data, and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. To exercise these rights, contact privacy@handsful.app. You may also lodge a complaint with your local data protection authority.

16. Shared caregiver access

In Short: If you invite other caregivers to your account, they will be able to view and add to your child's care data. If a caregiver's access is later removed, the entries they logged remain in your child's record, but you can choose to anonymize the label showing who logged them.

Handsful allows you to share access to your child's tracking data with caregivers you invite — up to five caregivers per family, included with your subscription. Once invited and accepted, a caregiver can view and log entries for your child, including sensitive consumer health data, subject to the permissions you grant. You are responsible for deciding who to invite.

When a caregiver's access is removed:

• Entries they logged remain part of your child's record — we do not delete a removed caregiver's past entries, since they form part of your child's ongoing care history.
• By default, entries stay attributed to the caregiver who logged them. You may choose to anonymize the visible label (for example, showing "Caregiver 2" instead of a name) without deleting the underlying entries.
• We retain an internal record of the true attribution (which caregiver logged which entry) for up to 12 months after a caregiver's access is removed, restricted to internal use for security, dispute resolution, and legal compliance purposes. This internal record is not visible to you, other caregivers, or the removed caregiver through the app.
• A removed caregiver may request deletion of their personal information, including this internal attribution record, as described in Section 11 (or Section 14 for Washington residents, or Section 15 for EU/EEA and UK residents). Deletion of the internal attribution record does not delete the underlying care entries themselves, which remain part of your child's record.

To revoke a caregiver's access, use the caregiver settings in the app, or contact us at privacy@handsful.app.

17. Do we make updates to this notice?

We may update this Notice from time to time, indicated by the "Last updated" date above. Material changes will be communicated by prominent notice or direct notification before they take effect.

18. How can you contact us about this notice?

MESQUITE & THORN DIGITAL, LLC
Data Protection Officer
1018 E Washington St, Suite A
Brownsville, TX 78520
United States
Email: privacy@handsful.app

19. How can you review, update, or delete the data we collect from you?

You may delete your account and all associated data directly in the app's settings. You may also request access to, correction of, or deletion of your personal information, including your child's care activity data, by contacting privacy@handsful.app.

We complete verified deletion requests promptly, and in any event within 30 days: your data is removed from our production systems when your account is deleted, and from our service providers' systems and backups within the 30-day window, except where a specific retention exception described in Section 8 applies.