Privacy at Ownhand

Who operates Ownhand

Ownhand is operated by Marina Shtaynberg. For a privacy request, arishtay2010+ownhand@gmail.com. If you cannot sign in during the pilot, contact the person who invited you.

What the app receives and stores

• Account identity. ChatGPT sign-in supplies an account identifier, email, and, when available, name. Ownhand uses the identifier to keep users’ work separate; name or email may appear in the interface.
• Age group. Before your workspace first opens, or before you claim a friends pass, Ownhand asks for your birth month and year once. It keeps only your age group (under 13, 13 to 17, or 18 and older) and the date you answered, never the month or year. The group is as of that date and is not updated later. An answer given when claiming a pass is kept even if you never open a workspace. Your age group is included in your workspace backup and removed when you delete your workspace.
• Saved work. Saved PDFs, handwriting profiles and document-specific profile snapshots, answer text, placement settings, subject names, and completed rendering files are stored to let you reopen and export your work.
• Usage and service records. The app keeps export counts, version receipts, the date Ownhand first recorded your account (to decide whether a new account’s first 30 days apply), request-limit records, and deletion/cleanup records to apply your allowance and operate the service.
• Invitations and rewards. Ownhand stores a personal referral code, the account identifiers connected by an accepted invitation, pass dates, and bonus-export balances and expiry dates. The sender sees counts of joined friends and earned rewards, not the friend’s email or documents. You choose how to share a link; Ownhand does not collect a recipient’s email or send invitations for you. These records are included in your workspace backup where they concern your own account.
• Support reports. Your category and description are sent when you submit a report. Optional technical details can include browser and operating-system versions, viewport, feature availability, workflow, and a recent error reference. The form shows what will be included. PDFs, filenames, answer text, samples, and screenshots are not automatically attached.
• Owner-only AI Helper. Only the operator’s own account can use the AI Helper in the editor. For that account, Ownhand stores each Helper chat (the messages, the answer text and printed page text sent with them, and the replies), one-way hashes of the Helper’s wording and of the answers its suggested edits were for, or that words from those answers were later copied into (also by way of other answers or a copy of the page), so exports can list answers that match its words, cost records without text, and each document’s chosen AI level. Chats are kept up to 7 days after their last message and hashes up to 30 days after the Helper last wrote the words; older ones are removed on the operator’s next workspace or dashboard visit.
• Billing records. Ownhand stores checkout and subscription references, subscription state, whether a plan was bought through a payment link, and billing event records. It does not keep the email or name of the person who paid. Stripe Managed Payments handles payment details; Ownhand does not receive full card details.
• Payment links. When you make a payment link, Ownhand stores a one-way fingerprint of the link (never the link itself), its short link code, when it was made and ends, and when it was first opened by someone not signed in as you. Ownhand doesn’t store the name, email or payment details of the person who opens it or pays. Link details, without the fingerprint, are included in your workspace backup; unused links that ended more than 30 days ago are removed the next time you make a link, and all links are removed when you delete your workspace.

Product activity metrics

We collect limited first-party activity records for signed-in workspace users so the owner can understand whether setup works and find reliability problems. Records contain your account identifier, daily action counts, dates of first measured setup and export steps, broad device categories (such as iPad or desktop), and processing times. Browser-reported actions may be incomplete. We do not put PDF contents, filenames, answer text, handwriting samples, raw browser strings, or IP addresses into these analytics records.

The owner-only dashboard shows aggregate activity and separates the owner’s testing from customer activity. It also summarizes existing invitation, support, and subscription records. We do not track anonymous visitors, record sessions, use advertising pixels, or set analytics cookies. Daily activity and duplicate-signal records cover the latest 90 calendar days; older rows are removed on subsequent activity or dashboard access. Setup milestone records remain while your workspace exists. Your own activity records are included in your workspace backup and removed when you delete your workspace.

What stays on your device

PDF compatibility checks and text recognition run in your browser. Recognition downloads its reading models when first needed; the recognition step does not send the page to an external AI service. The handwriting renderer itself does not call an AI model.

Temporary documents remain in the open editor until you save them. Rendering an export sends the necessary PDF and answer data to the server for processing, but the temporary original and completed PDF are not retained as saved document files. Usage records still apply. To avoid charging a retry twice, a one-way fingerprint of each exported temporary document is kept for the current month; older fingerprints are removed on a later temporary export or when you delete your workspace. Closing or reloading a temporary document can lose its contents.

Handwriting you write in My handwriting stays in this browser until you save it, so you can finish later on the same device; the browser may clear it sooner. Signing out does not remove it. Saving or uploading samples removes the matching copy, with one exception: when you save a short first set, a copy stays in this browser, even after you sign out, so you can add the rest of your samples later. It is removed when you save the full set, upload a packet of your normal handwriting, or delete your samples in this browser. Deleting your workspace in this browser removes all of them. Saving sends the finished pen shapes and the profile name to your account. Apple Pencil pressure only changes how wide the saved lines are; the pressure readings and timing of your writing are not sent.

Your browser stores interface preferences such as dark mode. Sign-in also relies on the hosting provider’s session mechanisms. Ownhand has no third-party advertising or product-analytics scripts.

Service providers and actions you choose

ChatGPT sign-in and the Site platform provide authentication and hosting. The app uses Cloudflare R2 for private files and D1 for account-linked records. The operator and these service providers may access data when needed to run, secure, or support the service; the files are not end-to-end encrypted. These providers may process service information under their own terms and privacy policies.

When the operator’s own account uses the AI Helper, its chat messages and, unless No AI is chosen, the document’s answer text and the current page’s printed text (which can include names on the page) are sent to Anthropic’s API to write replies. PDF files, handwriting samples, document names, and account names or emails are not sent. Anthropic processes it under its own terms and privacy policy.

The operator can also let Claude, Anthropic’s AI assistant, read support reports through a private key, to help find and fix problems. Claude receives each report’s category, description, technical details, status, date and reference, never the account identifier, name or email linked to the report. It does read whatever the description says, so leave out names and other personal details. Anthropic processes them under its own terms, its privacy policy and the operator’s Claude account settings. Report text Claude has already read can remain in the operator’s Claude conversations after the report is deleted.

When you choose Save to Drive, Google’s button handles the transfer to your selected Google account. Send to Notability uses your device’s share menu or a downloaded PDF. Those copies are governed by the destination service and remain there if you later delete the Ownhand copy.

Public payments are disabled; only the configured owner can use Stripe sandbox checkout with test payment details. When someone continues to checkout from your payment link, a checkout reference and the chosen plan are sent to Stripe to create a checkout linked to your account. Your email and name are not sent. The person paying enters their own email and payment details with Stripe Managed Payments and Link, which process billing and tax information under Stripe’s privacy policy.

Access, export, and deletion

In Account & usage you can download a workspace backup or delete your Ownhand workspace. My reports lets you view and delete submitted reports. The pilot operator can review reports in a private inbox and can let Claude read them, as described under Service providers.

Deleting a document removes its records, including its Helper chats, and queues its original, handwriting snapshot, and derived files for removal. For the operator’s account, the Helper’s hashes stay until they expire, so matching words in other documents are still listed, and its cost records, which hold no text, are kept. Deleting the workspace removes the Helper’s chats and hashes and detaches its cost records from the account. If storage is temporarily unavailable, file cleanup is retried. Deleting your current handwriting profile leaves snapshots held by saved documents; delete those documents or the whole workspace to remove those too.

Ownhand retains saved work and reports until you delete them or your workspace. Usage, security, deletion, and billing records may remain where needed to enforce limits, complete cleanup, prevent misuse, or meet legal obligations. Provider logs and backups follow provider practices; there is no promise that every infrastructure copy disappears immediately.

Deleting Ownhand data does not delete your ChatGPT account or copies you exported. Deleting your workspace also removes your age group and payment links. Subscription cancellation and workspace deletion are separate actions. Before you delete a workspace with a running plan, the person who paid cancels it from their receipt email or through support.

Before you upload

Only upload documents and handwriting you are permitted to use. Avoid unnecessary sensitive information in uploads or support reports. Ownhand is for users aged 13 and older. Users under 18 need a parent or guardian’s permission and must meet the sign-in provider’s age requirements. If an account answers the age question under 13, Ownhand is locked for it straight away: it can only see its account, download a backup or delete its workspace, no further activity records are made, and any payment link stops working. The account appears in an owner-only list so the operator can follow up and arrange appropriate removal. If the answer was a mistake, a parent or guardian can contact support. Contact support if you believe a child under 13 has supplied personal information so the operator can investigate and arrange appropriate removal.

Questions or corrections

Use arishtay2010+ownhand@gmail.com to ask about your data or report an error in this description. Material changes to these practices will be reflected here before the related feature is enabled.