Privacy Policy – Handful
Last updated: August 28, 2026
1. Privacy at a Glance
General Information
The following notes give a simple overview of what happens to your personal data when you use the Handful app. Personal data is any data that can be used to personally identify you.
Who is responsible for data collection in this app?
Data processing in this app is carried out by the app operator. Their contact details can be found in the "Controller" section of this privacy policy.
How do we collect your data?
Some data is collected when you provide it to us — for example, when you register an account or create habits, routines, and tasks. Other data is collected automatically by our IT systems while the app is running, in particular technical data required to authenticate and sync your account across devices.
What do we use your data for?
Part of the data is collected to ensure the app is provided without errors — in particular, syncing your habits, routines, and tasks across devices, and managing your user account and Plus status. Other data is used to process in-app purchases through the Apple App Store.
What rights do you have regarding your data?
You have the right, at any time, to obtain information free of charge about the origin, recipients, and purpose of your stored personal data, and a right to request the correction, restriction, or deletion of this data. You can also delete your entire user account, including all content, directly in the app at any time (see Section 8). You can contact us at any time using the address given in the legal notice for this or any other questions about data protection. You also have the right to lodge a complaint with the competent supervisory authority.
2. Hosting
This app is technically operated via Google Firebase, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (on behalf of Google LLC, USA). Firebase provides, in particular, user authentication (Firebase Authentication) and the cloud database (Cloud Firestore) in which your account data as well as your habits, routines, and tasks are stored.
This processing is based on Art. 6(1)(b) GDPR (performance of a contract) and our legitimate interest in a reliable, secure, and cross-device provision of the app (Art. 6(1)(f) GDPR). We have entered into a data processing agreement with Google. To the extent data is transferred to the USA as part of this, the transfer relies on Google's certification under the EU-US Data Privacy Framework or on EU standard contractual clauses.
3. General Information and Mandatory Disclosures
Data protection
We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.
Controller
The controller responsible for data processing in this app is:
seal Media GmbH
Fraunhoferstr. 13
24118 Kiel
Germany
Represented by: Boris Zander, Timo Lembcke
Phone: +49 (0) 431 55 60 88 19
Email: info@sealmedia.de
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
Storage period
Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies — in particular until you delete your user account. If you delete your account, all associated data is removed immediately (see Section 12). Statutory retention obligations remain unaffected.
Legal bases for processing
Where we obtain consent for processing operations, Art. 6(1)(a) GDPR serves as the legal basis. Where processing is necessary for the performance of a contract with you (e.g., providing your user account, syncing your content, processing in-app purchases), we rely on Art. 6(1)(b) GDPR. Where processing is necessary to safeguard our legitimate interests (e.g., technical stability and security of the app), Art. 6(1)(f) GDPR is the legal basis.
Withdrawal of your consent to data processing
Where processing is based on your consent, you may withdraw that consent at any time. The lawfulness of any processing carried out prior to your withdrawal remains unaffected.
Right to object to data collection (Art. 21 GDPR)
Where data processing is based on Art. 6(1)(f) GDPR, you have the right to object at any time to the processing, for reasons arising from your particular situation.
Right to lodge a complaint with the competent supervisory authority
In the event of data protection violations, you have the right to lodge a complaint with the competent supervisory authority, in particular in the member state of your habitual residence. The authority responsible for us is the Independent State Center for Data Protection Schleswig-Holstein (ULD), Germany.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format.
Right to access, rectification, erasure, and restriction
Within the scope of applicable statutory provisions, you have the right, at any time, to obtain free information about your stored personal data, its origin and recipients, and the purpose of the data processing, and, where applicable, a right to have this data corrected, blocked, or deleted.
SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, this app uses SSL or TLS encryption for all communication with our servers.
4. Registration and User Account
Using Handful requires a user account. You can either register with an email address and a password of your choice, or use "Sign in with Apple."
When registering by email, we collect and store your email address and a hash of your password. With "Sign in with Apple," we receive an identity token from Apple, and — to the extent you allow it in Apple's sign-in flow — your name and email address (which may be an anonymized relay address provided by Apple). Both methods are processed via Firebase Authentication, which assigns a unique, random user identifier to each account. In addition, we internally assign a sequential, support-friendly user ID (format "HF0001," etc.), which does not allow any conclusions about your identity and is used solely to simplify matching support requests.
This data is used to give you access to your account and to sync your content across multiple devices. The legal basis is Art. 6(1)(b) GDPR (performance of the usage agreement).
5. Your Habits, Routines, and Tasks
The core function of Handful is creating and tracking your own habits, routines, and tasks. In doing so, the following content you enter is stored in our cloud database (Cloud Firestore): the names and emojis you assign, completion status and completion counters, reminder times you set, and creation and cycle dates. This data is used exclusively to provide the app's functionality and to sync your content across devices. The legal basis is Art. 6(1)(b) GDPR.
The content of your habits, routines, and tasks is determined entirely by you. If you choose to enter information that falls under special categories of personal data within the meaning of Art. 9 GDPR (e.g., health-related habits), the processing of that information occurs solely because you actively enter it yourself (Art. 9(2)(a) GDPR). You can change or delete such entries at any time.
6. Local Storage on Your Device
In addition to cloud syncing, the app stores certain data — such as settings and cached content for offline use — locally on your device. This local data is not transmitted to us or to any third party and remains exclusively on your device.
7. Reminder Notifications
If you enable reminders for individual habits, routines, or tasks, the app schedules the corresponding notifications exclusively on your device. No data is transmitted to a push notification server or to any third party.
8. In-App Purchases and Subscriptions
Handful offers paid in-app purchases and subscriptions, which are processed exclusively through the Apple App Store (StoreKit). Your payment data (e.g., credit card information or Apple ID payment method) is collected and processed solely by Apple; we ourselves never have access to this data. From Apple, we only receive confirmation of a successful purchase and the corresponding product ID.
We store the resulting subscription or purchase status (e.g., the plan chosen, validity period) in Cloud Firestore, associated with your user account, in order to unlock the corresponding features for you. The legal basis is Art. 6(1)(b) GDPR. For more information on processing by Apple, please refer to Apple's privacy policy.
9. Analytics, Tracking, and Advertising
Handful does not use any third-party analytics or tracking tools, and no advertising SDKs. In particular, we do not use Firebase Analytics, Crashlytics, or any advertising networks. No usage profiles are created and no cookies are set for advertising or tracking purposes. The only data processing takes place via Firebase Authentication and Cloud Firestore to provide the app's core functionality, and via Apple to process in-app purchases (see above).
10. Recipients of Your Data
Recipients of your data under data processing agreements are Google (Google Ireland Limited / Google LLC) as the operator of Firebase, and Apple (Apple Inc. / Apple Distribution International Ltd.) in connection with account sign-in via "Sign in with Apple" and the processing of in-app purchases. Corresponding data processing or joint-controllership agreements are in place with both providers. Your data is not shared with any other third parties.
11. Your Rights at a Glance
You have the following rights with respect to personal data concerning you:
- Right to access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
To exercise these rights, you can contact us at any time using the contact details given under "Controller" above.
12. Deleting Your Account
You can delete your user account directly in the app at any time (profile settings). Doing so immediately and permanently deletes all data associated with your account — your profile, all habits, routines, tasks, and settings, as well as your authentication account. This action cannot be undone.
13. Minors
Handful is not specifically directed at children. Individuals under the age of 16 may only submit personal data to us or create a user account with the consent of a parent or legal guardian.
14. Changes to This Privacy Policy
We reserve the right to update this privacy policy so that it always complies with current legal requirements, or to reflect changes to our services in the privacy policy. Your continued use of the app is then governed by the new privacy policy.
15. Contact
If you have questions about data protection, you can reach us at:
seal Media GmbH
Fraunhoferstr. 13
24118 Kiel
Germany
Email: info@sealmedia.de
Phone: +49 (0) 431 55 60 88 19