Privacy Policy

This Privacy Notice for MESQUITE & THORN DIGITAL, LLC (doing business as Handsful) ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://handsful.app or any website of ours that links to this Privacy Notice
• Join our waitlist or subscribe to updates
• Download and use our mobile application (Handsful), once available, or any other application of ours that links to this Privacy Notice
• Use Handsful. Handsful is a mobile app that helps parents of multiples (twins, triplets, and more) log and track care activities for each of their children — including feeding, sleep, diaper changes, and growth — simultaneously across babies, compare activity side by side, share caregiver access with a partner or family member, and prepare notes for pediatrician visits. The app is intended for use by adults; it is not directed to children and is not intended to be used by children.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@handsful.app.

A note on who this policy is about

This Privacy Notice describes both (1) how we handle information about you, the parent or caregiver who creates an account, and (2) how we handle information you provide about your child or children in the course of using the Services. Information about your children is provided by you, not collected directly from them, and is used solely to deliver the care-tracking features you've chosen to use.

Summary of key points

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. This includes information about your child or children that you choose to log. Learn more below.

Do we process any sensitive personal information? Yes. The care activity data you log about your child or children — including feeding, sleep, diaper, growth, and pediatrician visit information — is treated by us as sensitive consumer health data, and we apply heightened protections to it as described in this Notice.

Do we collect any information from third parties? We do not purchase or receive information about you from third-party data brokers. If you choose to sign in using a third-party service such as Google, we receive the basic profile information (such as your name and email address) that you authorize that service to share with us.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process sensitive consumer health data only with your affirmative consent, and only for the purposes you authorize. Learn more below.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. We do not sell or share your sensitive consumer health data, and we do not use it for advertising. Learn more below.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. Learn more below.

What are your rights? Depending on where you are located, applicable privacy law may give you certain rights regarding your personal information, including sensitive consumer health data. Learn more below.

How do you exercise your rights? The easiest way to exercise your rights is by contacting us at privacy@handsful.app. We will consider and act upon any request in accordance with applicable data protection laws.

Table of contents

1. What information do we collect?
2. Sensitive consumer health data: how we handle your child's care information
3. How do we process your information?
4. When and with whom do we share your personal information?
5. Do we use cookies and other tracking technologies?
6. How do we handle your social logins?
7. How long do we keep your information?
8. How do we keep your information safe?
9. Do we collect information from minors?
10. What are your privacy rights?
11. Controls for Do-Not-Track features
12. Do United States residents have specific privacy rights?
13. Washington My Health My Data Act rights
14. Do European Union residents have specific privacy rights (GDPR)?
15. Shared caregiver access
16. Do we make updates to this notice?
17. How can you contact us about this notice?
18. How can you review, update, or delete the data we collect from you?

1. What information do we collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us, including care information you choose to log about your child or children.

We collect personal information that you voluntarily provide to us when you register on the Services, join our waitlist, express interest in our products, or otherwise contact us.

Personal Information Provided by You. This may include:

• Name
• Email address
• Password
• Contact and marketing preferences
• Your children's first names
• Your children's dates of birth (used to calculate age-appropriate tracking)

Sensitive Consumer Health Data. When you use the app (once available), you may log care activity data about your child or children, including: feeding times and amounts, sleep periods, diaper changes, growth measurements, and notes tagged for pediatrician visits. We treat this data as sensitive consumer health data. See Section 2 for how we handle it specifically.

Payment Data. If you subscribe to a paid tier, payment is handled by Apple, RevenueCat, and/or Google Play. We do not store your full payment card details. See their privacy notices: https://www.apple.com/legal/privacy/, https://www.revenuecat.com/privacy, https://policies.google.com/privacy.

Social Media Login Data. If you register using Google Sign-In, we collect the profile information provided by that service, as described in Section 6.

Application Data. If you use the app, we may collect, with your permission, information from your mobile device such as device identifiers, model, operating system and version, and information about how you use app features. This is used to maintain security, troubleshoot issues, and for internal analytics.

Information automatically collected

In Short: Some information, such as your IP address and device characteristics, is collected automatically when you visit the website.

When you visit the website, we automatically collect log and usage data (IP address, browser type, pages viewed, referring URLs) and device data. This does not, on its own, reveal your identity. See our Cookie Notice at https://handsful.app/cookies for details on tracking technologies used on the website.

Google API

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. Sensitive consumer health data: how we handle your child's care information

In Short: Feeding, sleep, diaper, growth, and pediatrician visit data you log about your child is sensitive consumer health data. We collect it only with your consent, use it only to provide the Services you request, and do not sell it or use it for advertising.

Because Handsful is built around logging care activities for infants and young children, much of the data you enter is, or is closely related to, health information about a minor. We apply the following commitments to this category of data specifically:

• We collect this data only when you affirmatively choose to log it.
• We do not sell this data.
• We do not share this data for the purposes of targeted advertising.
• We do not use geofencing around health care facilities in connection with this data.
• Access to this data within our systems is limited to what is necessary to provide the Services (for example, syncing your entries across your devices and to caregivers you've invited).
• Where we use third-party infrastructure providers to store or process this data (see Section 4), those providers are contractually restricted from using it for any purpose other than providing services to us.
• You may delete individual entries or your full account's data at any time from within the app. See Section 18.

If we ever introduce features that process this data using artificial intelligence or machine learning tools (for example, AI-generated visit-prep summaries), we will update this Privacy Notice to describe that processing, name the provider involved, and obtain any additional consent required by law before that feature is enabled for your account.

3. How do we process your information?

In Short: We process your information to provide, improve, and administer the Services, communicate with you, for security and fraud prevention, and to comply with law.

We process personal information to:

• Create and maintain your account and authenticate you
• Deliver the care-tracking, comparison, and caregiver-sharing features you use
• Respond to support inquiries
• Send administrative information about the Services
• Send marketing communications, where you've opted in (see Section 10)
• Protect the Services, including fraud monitoring
• Understand usage trends and improve the Services
• Comply with legal obligations

We do not use your child's care data to make automated decisions that produce legal or similarly significant effects, and we do not use it to train third-party AI models.

4. When and with whom do we share your personal information?

In Short: We share information only with service providers who need it to operate the Services, under contract, and never for advertising purposes involving sensitive consumer health data.

Currently live (website):

Planned for app launch:

We will update this table as additional providers are added, and will note here if any future provider will have access to sensitive consumer health data.

We also may need to share your personal information in connection with a merger, sale of company assets, financing, or acquisition of all or part of our business — sensitive consumer health data will remain subject to the protections in this Notice through any such transfer.

5. Do we use cookies and other tracking technologies?

In Short: We use cookies and similar technologies on the website for functionality and, with your consent, for analytics.

We use essential cookies to operate the website. With your consent, given through our cookie banner, we also use Google Analytics to understand website usage. GA4 does not collect or process any information from within the app itself, and never processes your child's care data.

You can withdraw consent to analytics cookies at any time through the cookie preferences link in the website footer. See our Cookie Notice at https://handsful.app/cookies for full details.

6. How do we handle your social logins?

If you register using Google Sign-In, we receive certain profile information (such as name and email address) from Google, used only for the purposes described in this Notice. We recommend reviewing Google's privacy notice to understand their own data practices.

7. How long do we keep your information?

In Short: We keep your information for as long as you have an account, unless a longer period is required by law.

We retain personal information, including care activity data, for as long as your account is active. When you delete your account, we delete or anonymize your data, except where retention is required for legal, tax, or fraud-prevention purposes, or where data exists in backup archives, in which case we isolate it from further processing until deletion is possible.

8. How do we keep your information safe?

We implement reasonable technical and organizational security measures designed to protect personal information, including sensitive consumer health data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Do we collect information from minors?

In Short: Handsful is designed for use by parents and caregivers 18 years of age or older. We do not knowingly collect personal information directly from children.

We do not direct the Services to children and do not knowingly collect personal information directly from a child. Parents and caregivers may log information about their children — including first name, date of birth, and care activity data — but this is provided by the parent or caregiver, not the child, and is used solely to deliver the tracking features within the parent's account. If you believe we have inadvertently collected information directly from a child, contact us at privacy@handsful.app and we will promptly address it.

10. What are your privacy rights?

You may withdraw consent, opt out of marketing communications, and review, update, or delete your account information at any time. See Section 18 for how to exercise these rights. Sensitive consumer health data can be deleted at the individual entry level or in bulk via account deletion within the app.

11. Controls for Do-Not-Track features

There is currently no uniform standard for DNT signals, so we do not respond to them at this time. If a legal standard is adopted, we will update this Notice accordingly.

12. Do United States residents have specific privacy rights?

In Short: Residents of California, Colorado, Connecticut, and other states with comprehensive privacy laws have rights to know, access, correct, delete, and opt out of certain processing of their personal information, including sensitive personal information.

Categories of Personal Information We Collect (past 12 months):

We have not sold your personal information, including sensitive personal information, in the preceding twelve months. We do not use sensitive consumer health data for cross-context behavioral advertising.

Your rights include the right to know, access, correct, delete, obtain a copy of, and opt out of certain processing of your personal information, including the right to limit use of sensitive personal information under California law. To exercise these rights, contact us at privacy@handsful.app.

13. Washington My Health My Data Act rights

In Short: If you are a Washington resident, or your consumer health data was collected in Washington, you have specific rights under the My Health My Data Act.

We treat the care activity data logged in Handsful (feeding, sleep, diaper, growth, and pediatrician visit notes) as "consumer health data" under the Washington My Health My Data Act. In addition to the rights described elsewhere in this Notice, Washington residents have the right to:

• Confirm whether we are collecting, sharing, or selling their consumer health data, and to access that data
• Withdraw consent to our collection or sharing of their consumer health data
• Have their consumer health data deleted

We obtain your consent before collecting consumer health data, do not sell it, and do not share it for advertising purposes. To exercise these rights, contact privacy@handsful.app. You may also submit complaints to the Washington State Attorney General.

14. Do European Union residents have specific privacy rights (GDPR)?

In Short: If you are located in the EU/EEA or UK, you have rights under the GDPR, including for special category data such as your child's health-related information.

Where GDPR applies, our legal basis for processing your account information is performance of a contract with you (providing the Services) and, for marketing, your consent. Our legal basis for processing your child's care activity data is your explicit consent, given at the point you enable tracking features.

Legal Basis for Processing

Where the General Data Protection Regulation (GDPR) applies, we process your personal data on the following legal bases:

• Automatically collected data (such as IP address and server logs): our legitimate interest in operating, securing, and maintaining the Service.
• Analytics data (such as Google Analytics events): your consent, which you may withdraw at any time via our cookie preferences.
• Account and app data: performance of our contract with you (providing the Service you signed up for).

International Data Transfers

We and our service providers (including Google and Kit) are based in the United States. Where we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards, including Standard Contractual Clauses.

You have the right to access, rectify, erase, restrict, or port your data, and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. To exercise these rights, contact privacy@handsful.app. You may also lodge a complaint with your local data protection authority.

15. Shared caregiver access

In Short: If you invite another caregiver to your account, they will be able to view and add to your child's care data. If that caregiver's access is later removed, the entries they logged remain in your child's record, but you can choose to anonymize the label showing who logged them.

Handsful allows you to share access to your child's tracking data with another caregiver (such as a co-parent or family member) that you invite. Once invited and accepted, that caregiver can view and log entries for your child, including sensitive consumer health data, subject to the permissions you grant. You are responsible for deciding who to invite.

When a caregiver's access is removed:

• Entries they logged remain part of your child's record — we do not delete a removed caregiver's past entries, since they form part of your child's ongoing care history.
• By default, entries stay attributed to the caregiver who logged them. You may choose to anonymize the visible label (for example, showing "Caregiver 2" instead of a name) without deleting the underlying entries.
• We retain an internal record of the true attribution (which caregiver logged which entry) for up to 12 months after a caregiver's access is removed, restricted to internal use for security, dispute resolution, and legal compliance purposes. This internal record is not visible to you, other caregivers, or the removed caregiver through the app.
• A removed caregiver may request deletion of their personal information, including this internal attribution record, as described in Section 10 (or Section 13 for Washington residents, or Section 14 for EU/EEA and UK residents). Deletion of the internal attribution record does not delete the underlying care entries themselves, which remain part of your child's record.

To revoke a caregiver's access, use in-app account management once available, or contact us at privacy@handsful.app.

16. Do we make updates to this notice?

We may update this Notice from time to time, indicated by the "Last updated" date above. Material changes will be communicated by prominent notice or direct notification before they take effect.

17. How can you contact us about this notice?

MESQUITE & THORN DIGITAL, LLC
Data Protection Officer
1018 E Washington St, Suite A
Brownsville, TX 78520
United States
Email: privacy@handsful.app

18. How can you review, update, or delete the data we collect from you?

You may request access to, correction of, or deletion of your personal information, including your child's care activity data, by contacting privacy@handsful.app or, once available, through account settings within the app.