HandWrought

Privacy Policy

Last updated: August 2026

HandWrought is operated by Manish Pamnani ("we", "us"). This page explains what data we collect, why, and who else sees it.

Account data

We use Firebase Authentication (Google) to manage sign-up and sign-in. We store your email address and an authentication record; we never see or store your password directly (Firebase handles that). We also store, against your account, your remaining AI generation credits and, if you've purchased credits, your credit tier and the associated Paddle transaction ID.

Your documents

Documents and chat history you create in HandWrought are stored in your own browser's local storage, not on our servers. Clearing your browser data will remove them.

AI features (Gemini API key and content)

By default, AI editing actions run against a shared Google Gemini API key that we provide: the relevant document text is sent to our server, forwarded to Google's Gemini API using our key, and the response is returned to your browser — this happens in transit only; we don't log or persist your document content server-side. If you supply your own Google Gemini API key in Settings instead, it's stored only in your browser and sent to our server the same way, in transit only, never stored.

Payments

Payments are handled entirely by Paddle.com Market Limited, our payment processor and merchant of record. Paddle collects and processes your payment details, billing address, and tax information directly — we never see or store your card details. See Paddle's Privacy Policy for how they handle payment data.

Analytics

We use Google Analytics to understand how visitors use HandWrought (e.g. which pages are viewed, general usage patterns). Google Analytics sets cookies in your browser and collects information such as your IP address, device/browser type, and pages visited. See Google's Privacy Policy for how Google handles this data.

What we don't do

  • No selling or sharing your data with advertisers.
  • No tracking scripts beyond Google Analytics described above.

Third parties we rely on

  • Firebase (Google) — authentication and our account database (Firestore).
  • Google Gemini API — powers AI editing features, using our shared API key by default or your own key if you add one in Settings.
  • Google Analytics — usage analytics, described above.
  • Paddle.com Market Limited — payment processing and billing, as merchant of record.
  • Resend — sends transactional email (e.g. waitlist confirmation) to the address you provide.
  • Our hosting provider — serves the application; standard request logs (e.g. IP address) may be retained briefly for security and abuse prevention.

Your rights

You can request a copy of your account data or ask us to delete your account and associated data at any time by emailing handwrought.support@gmail.com. Deleting your account does not affect billing records Paddle is required to retain for tax/legal purposes.

Children

HandWrought is not directed at children under 16, and we don't knowingly collect data from them.

Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above when we do.

Contact

Questions about this policy? Email handwrought.support@gmail.com or visit our Contact page.