HandoverhubPrivacy policy
Last updated: 23 October 2026
This policy explains what personal data the Handoverhub app and website collect, why, who we share it with, how long we keep it and what your rights are. Please read it with our Terms of use.
1. Who we are
Handoverhub is run by Wrenhaven Ltd, a company registered in England and Wales (company number 17506473). Our registered office details are available from Companies House. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Wrenhaven Ltd is the controller of the personal data described in this policy.
ICO registration number: ZC276472
Contact us about anything in this policy at support@handoverhub.co.uk.
2. The short version
- We never sell your data and there are no adverts.
- The app has no analytics, advertising IDs, tracking or location tracking.
- Your messages are never used to train AI models.
- Messages and shared records can't be edited or deleted by either parent. That is the point of the app. If you close your account, what you sent stays in your co-parent's copy of the shared record. Please read section 8 before you sign up.
- You can download your records at any time, free (the last 90 days free; the full history with Pro or a one-off export).
- You can close your account in the app (More › Your data › Close my account) or at handoverhub.co.uk/delete-account.html.
3. What we collect, why, and our lawful basis
Under UK GDPR we must have a lawful basis for each use of your data. "Contract" means we need the data to provide the service you signed up for. "Legitimate interests" means we use it for a reason that is fair to you and that you would reasonably expect, after weighing your interests. Some of the information you can record (for example health details) is "special category" data, which needs an extra condition: for this we rely on the explicit consent you give at sign-up.
| Data | Why we use it | Lawful basis |
|---|---|---|
| Your name and email address, and a user ID we create. You sign in with a one-time code sent to your email; there is no password. | Create and secure your account, sign you in, and show your name to your co-parent | Contract |
| Your confirmation that you are 18 or over, and the date you agreed to our terms | Make sure only adults use the app, and keep a record of what you agreed to | Contract; legitimate interests (keeping a record of consent) |
| Your children's first names and ages (or dates of birth), as you choose to add them | Show who arrangements are about | Contract. Keep it to what's needed. |
| The shared record: messages, calendar entries and the regular arrangement, change requests and replies, expenses, payments and receipt photos | Provide the shared, tamper-evident record between you and your co-parent | Contract |
| Health and injury notes about your children, and any photos you add | Keep a shared health log | Contract, and your explicit consent for this sensitive information. You choose what to add. |
| Your private journal: notes, records of messages from outside the app, screenshots and photos, evidence marks and notes, and documents in your document vault (with photos and expiry dates) | Keep a record only you can see until you choose to share an entry; build evidence packs; remind you before documents expire | Contract, and your explicit consent for any sensitive information you add |
| When you last read your messages (a time only), if read receipts are on | Show your co-parent that a message has been read. You can turn this off in Settings › Read receipts. | Contract |
| Read-only access you give to a professional (solicitor, mediator or Cafcass officer): the name and role you enter, the expiry date, a one-way fingerprint of the access code, and the times the record was viewed | Let a professional you choose read your shared record for a limited time, and show both parents when it was opened | Contract |
| Purchase and subscription status: which product, whether it is active or in a trial, renewal or expiry dates, the store transaction ID, and whether you have shared Pro with your co-parent | Unlock Pro or a one-off export, remind you before renewals, and handle refunds | Contract |
| Your 14-day Pro trial: when it started and ends, and a one-way fingerprint (SHA-256) of your email address | Give each person one free Pro trial. See section 9 for what happens to the fingerprint if you close your account. | Legitimate interests (preventing misuse of free trials) |
| How many AI calmer-wording suggestions you have used each day (a number only, never the text) | Apply the fair-use limit | Legitimate interests (keeping the service affordable and preventing misuse) |
| Draft message text, only when you use AI calmer wording (see section 5) | Suggest a calmer version of your draft | Contract |
| Device push token, platform (Android or iPhone), time zone and your notification settings (such as quiet hours) | Send the notifications you have allowed, and not during quiet hours | Contract |
| New sign-ins to your account: the time, the device or browser it came from, and its IP address. We keep these for 30 days. | Email you when there's a new sign-in to your account, so you can act if it wasn't you. The email shows the time and device, never the IP address. | Legitimate interests (keeping your account secure) |
| Technical data our hosting provider records when your phone connects (such as IP address, time and the request made) | Keep the service secure and working, and investigate faults or misuse | Legitimate interests (security and reliability) |
| Emails you send us (for example support, safety reports, hardship requests or data requests), and reports you send from the app with Report a concern (what you write, the type of concern, the entry it's about if you choose one, your user ID and the time) | Reply to you and keep a record of what we did | Legitimate interests (helping you and handling complaints); legal obligation where the law requires us to keep records |
The app has no analytics or usage tracking, no crash-reporting service, no advertising IDs and no location tracking. Firebase is used only to deliver push notifications; Firebase Analytics is switched off. Android's automatic backup of app data is switched off, so your app data isn't copied into your Google account backup.
If you'd rather not give explicit consent for sensitive information, don't record it. If you later withdraw consent, you can stop adding it at any time. Information already sent into the shared record can't be removed from your co-parent's copy (see section 8), but we will stop any other use of it that relies on your consent.
4. Information about other people
Handoverhub is used by two parents, so it holds information about people who didn't give it to us directly: your co-parent, your children, and anyone named in a message or note. If you are a co-parent and the other parent set up the family, we received your email address when they invited you or when you joined, and your information in the shared record comes from you and from them. We use this information only to provide the service described here. Children don't use the app (see section 13).
Please only record what's needed about other people, and don't upload images or documents you don't have the right to share.
5. Calmer wording and AI
When you press Send, the app checks your draft for wording that may come across as hostile. That check runs on your phone. If it flags your draft, the app can suggest a calmer version.
- Free plan: calmer versions (up to 5 a day) are made on your phone by built-in rules. Nothing is sent to us or to any AI provider.
- Pro and the Pro trial: when the check flags a draft, the text of that draft only is sent from our server to our AI provider, Anthropic, which uses its Claude Haiku 5.5 model to suggest a calmer version. We don't send your name, your co-parent's name (unless it's in the draft), your account details or the rest of your record.
- Anthropic processes the draft for us as our processor. Under its commercial terms it does not use the text to train its models. It may keep it for a limited period for trust and safety purposes before deleting it, as set out in its terms.
- We don't store the draft or the suggestion on our servers. We only count how many AI suggestions you've used each day for the fair-use limit (30 a day and 900 a month).
- You decide whether to use, edit or ignore a suggestion. You can turn the tone check off in Settings.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
6. Who we share data with
People you choose
- Your co-parent: everything in your shared record, your name, and your read time if read receipts are on. They're told you've shared Pro with them only if you choose a plan for both of you. Your private journal, document vault, evidence marks, trial and "just me" Pro are not shown to them.
- Professionals you give read-only access to (solicitor, mediator, Cafcass officer), for the period you set (up to 180 days). Either parent can do this, and both parents can see when the record was opened.
- Anyone you send an export to. Exports are made on your phone. Once you share one, it's outside Handoverhub and we can't control what happens to it.
Our service providers (processors)
These companies process personal data on our behalf, under written contracts, and only on our instructions:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, file storage, sign-in and server functions for the app; also stores the website launch list | London, UK (AWS eu-west-2) |
| Resend | Sends the sign-in code emails and new sign-in alerts (your email address, the code, and the time and device of the sign-in) | Sent from the EU (Ireland); US company |
| RevenueCat | Manages subscriptions and one-off purchases with Apple and Google (your user ID and purchase details, not your name or messages) | United States |
| Google Firebase Cloud Messaging | Delivers push notifications to Android phones, and passes notifications for iPhones to Apple | United States and other countries |
| Apple Push Notification service | Delivers push notifications to iPhones | United States and other countries |
| Anthropic | AI calmer wording for Pro users (the draft text only, see section 5) | United States |
| Vercel | Hosts the website, including the read-only record viewer professionals use, and provides cookie-free website analytics (section 7) | Global network; US company |
| Microsoft (Microsoft 365) | Hosts our support mailbox (support@handoverhub.co.uk): the emails you send us, including safety reports, hardship requests and data requests, and our replies | Microsoft data centres; US company |
Push notifications never include message text. They say who sent what kind of update (for example "Sam sent you a message"), so nothing sensitive appears on a lock screen.
Apple and Google sell and bill subscriptions and one-off purchases. They act as independent controllers of your payment details under their own privacy policies. We never see your card details.
Other disclosures
- Courts, police and other authorities, only when the law requires it (for example a court order) or to protect someone from serious harm. Where we're allowed to, we'll tell you.
- Professional advisers (such as lawyers and accountants) under a duty of confidentiality, where needed to run the business or deal with a legal claim.
- A buyer of our business, if Handoverhub is sold or reorganised. They'd have to keep to this policy, and we'd tell you first.
We never sell your personal data or share it for advertising.
7. The website
Website analytics. Our website (handoverhub.co.uk) uses Vercel Web Analytics to count visits. It doesn't use cookies or collect personal identifiers. Visitors are counted using a hash created from the incoming request, which is discarded after 24 hours, and we see only totals such as pages viewed, the referring website, country or region, browser, operating system and device type. We use it, on the basis of our legitimate interests, to understand which pages are useful. Pages that carry private information in the address (invite links and the read-only record viewer) don't use analytics. The app itself has no analytics.
Counting totals. To understand how Handoverhub is used and plan improvements, we count totals from the records the service already holds: for example how many accounts and families there are, and how many people added something or read their messages this week. These are counts only, worked out inside our own database. Nothing is sent to an analytics or advertising company, and the counts never include what anyone wrote.
Campaign labels. If you arrive from one of our campaigns or a partner's link, the address can include a short campaign label (for example "utm_campaign=school-holidays" or a partner's name). We keep that label on links to other pages of our website and add it to our Google Play link, so Google Play can tell us how many installs came from each campaign; and if you join the launch list, we store it with your email as the page you signed up from. The label never includes anything about you, and we don't use cookies or store anything on your device for it. Your invite code is never added.
Launch list. If you joined the launch list, we keep your email address only to tell you when the app is available, on Android and later on iPhone (lawful basis: your consent). We'll email you about the launch and nothing else, and delete the list within 3 months of launch (by 6 February 2027). To be removed sooner, email support@handoverhub.co.uk.
8. Shared records and closing your account
Your family's record is shared between you and your co-parent, and each of you has an interest in keeping your copy. So neither parent can edit or delete messages or other shared entries, and neither can we, except as described in section 9.
If you close your account:
- Your account and sign-in details, private journal (including its photos, evidence marks and document vault), device push tokens, read time, AI usage counts, purchase records and settings are deleted.
- If your co-parent ever joined your family, the shared record stays in their copy, including the entries you sent. An entry is added saying you closed your account. You can choose to have your name replaced with "Former member", but the content of your entries stays as it was.
- If nobody else ever joined your family, the whole shared record and its photos are deleted.
We keep shared records this way so that neither parent can remove evidence, and because your co-parent has their own interest in the record. Our lawful basis is our legitimate interests, and those of your co-parent, in keeping an accurate and complete record of arrangements for the children. Because of this, your right to have shared entries deleted is limited (see section 12). Read-only professional access ends when it expires or is revoked.
9. How long we keep data
| Data | How long |
|---|---|
| Account details, private journal, document vault, push tokens, read time, purchase records | While your account is open. Deleted when you close your account in the app. If you ask us by email instead, we complete it within 30 days. |
| Shared record (messages, calendar, expenses, health log and photos) | While either parent still has an account in the family. After both parents have closed their accounts or left, up to 6 years, then deleted, unless the law requires us to keep it longer (for example a court order). |
| A family nobody else ever joined | Deleted when you close your account. |
| Daily count of AI suggestions | About 2 months, and deleted when you close your account. |
| Trial fingerprint (one-way SHA-256 of your email) | When you close your account, we remove the link to your user ID and keep only the fingerprint, for as long as we offer the free trial, so the same email can't start a second trial. It can't be turned back into your email address. |
| Technical logs held by our hosting provider | A short period (normally no more than 90 days), for security and fault-finding. |
| Emails with us, and reports sent from the app | Up to 2 years after the matter is closed, or longer if needed for a legal claim or to protect someone's safety. |
| Website launch list | Deleted within 3 months of launch. |
| Backups | Deleted data can remain in our hosting provider's encrypted backups for a short time (normally no more than 30 days) until they are overwritten. |
Apple, Google and RevenueCat keep their own records of purchases under their own policies and legal duties (for example tax).
10. International transfers
The app's database and files are stored in London, UK. Some of our providers are based in the United States or work worldwide (see section 6), so some data may be transferred outside the UK. When that happens we make sure it is protected, using one of the safeguards UK law allows:
- the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), for US providers certified under it; or
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing terms.
Transfers to the EU and EEA are covered by UK adequacy regulations. Ask us if you'd like more detail about the safeguard used for a particular provider.
11. Security
- Data is encrypted in transit (TLS) and at rest.
- Access rules in the database mean you can only read your own family's shared record and your own private journal. Your co-parent can't read your private journal.
- Every entry carries a cryptographic fingerprint linked to the one before it, so any change to the record can be detected. Exports include an integrity certificate.
- Professional access codes are stored only as one-way fingerprints, and professional access expires automatically.
- Only authorised people at Wrenhaven Ltd can access our systems, using two-factor authentication, and only to keep the service running, to help when you ask us, or where the law requires.
No system is perfectly secure. If a personal data breach is likely to put you at risk, we'll tell you and the ICO as the law requires. Please keep your phone and email account secure, because the sign-in code is sent to your email.
12. Your rights
Under UK data protection law you have the right to:
- access your personal data and get a copy (you can also export your records in the app);
- correct inaccurate data. Shared entries can't be edited, but you can add a new entry correcting an earlier one, and we can add a note to the record where needed;
- erasure (to have data deleted). You can close your account at any time. Shared entries stay in your co-parent's copy as explained in section 8, where we have overriding legitimate grounds or need them for legal claims;
- restrict how we use your data, or object to uses based on legitimate interests;
- data portability: receive the data you gave us in a usable format;
- withdraw consent at any time, where we rely on consent. This doesn't affect what we did before.
To use any of these rights, email support@handoverhub.co.uk from the address you use for Handoverhub. It's free. We reply within one month (we may extend this by up to two more months for complex requests, and will tell you if so). We may need to confirm your identity, and we may need to protect other people's information, such as your co-parent's or your children's.
Complaints. If you're unhappy with how we use your data, please tell us first by emailing support@handoverhub.co.uk, so we can try to put it right. As the Data (Use and Access) Act 2025 requires, we acknowledge every data protection complaint within 30 days, look into it without undue delay, and tell you the outcome. You also have the right to complain to the Information Commissioner's Office (ICO) at any time: online at ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113.
13. Children
Handoverhub is for adults aged 18 and over. Children don't use the app and we don't knowingly collect data from children. We hold only the details about children that parents choose to add. Please keep these to what's needed. If you think a child has created an account, contact us and we'll close it.
14. Changes to this policy
We'll update this policy when the app or the law changes. We'll tell you in the app before a material change takes effect, and the date at the top will always show the latest version.
15. Contact
Wrenhaven Ltd, a company registered in England and Wales, company number 17506473. Registered office details are available from Companies House.
ICO registration number: ZC276472
Email: support@handoverhub.co.uk