Legal

Privacy Policy

Last updated: January 2026

1. Information We Collect

When you use Handout, we collect:

•Account info: name, email, phone number, password (encrypted), university, major, role

•Profile info: bio, photos, lifestyle preferences, budget, move-in date, gender preferences

•Service info (Providers only): service title, rates, availability, certifications, ID for verification

•Usage info: pages you visit, features you use, messages you send, bookings you make

•Device info: IP address, browser type, operating system, device identifier

•Payment info (when launched): processed by Stripe — we do not store your card number

2. How We Use Your Data

•To create and manage your account

•To match you with roommates, providers, or services

•To enable messaging between users

•To process payments and subscriptions

•To send service-related emails (booking confirmations, password resets)

•To improve the Platform via aggregated, anonymous analytics

•To prevent fraud and enforce our Terms

•To comply with legal obligations

We do not sell your personal data. Ever.

3. Who We Share With

•Other users: only the profile info you make visible (name, photo, university, etc.)

•Providers you book: name, contact info, booking details

•Service vendors: Supabase (database), Vercel (hosting), Resend (email), Stripe (payments) — all bound by data agreements

•Law enforcement: only when legally required (subpoena, warrant, or imminent safety threat)

We do not share your data with advertisers, data brokers, or any third party for marketing.

4. Cookies & Tracking

We use cookies for:

•Keeping you logged in (essential)

•Remembering your preferences

•Anonymous analytics (Vercel Analytics, PostHog)

We do not use ad-tracking cookies. You can disable cookies in your browser, but the Platform may not work properly.

5. Your Rights

•Access: view all data we have on you (Settings → Privacy)

•Correct: update any personal info anytime from Settings

•Delete: delete your account from Settings — most data deleted within 30 days

•Export: download your data in JSON format (email handout.corp@gmail.com)

•Opt out: unsubscribe from marketing emails via the link in any email

Residents of California (CCPA) and EU (GDPR) have additional rights — email handout.corp@gmail.com to exercise them.

6. Data Security

•Passwords are hashed using bcrypt — we never see your actual password

•All data is transmitted over HTTPS

•Database access is restricted via Row-Level Security policies

•We use 2-factor authentication on all admin accounts

No system is 100% secure. If a breach occurs, we will notify affected users within 72 hours.

7. Data Retention

•Active accounts: kept while you use the Platform

•Deleted accounts: personal info removed within 30 days

•Some data retained up to 2 years for fraud prevention and legal compliance

•Anonymous, aggregated analytics may be retained indefinitely

8. Children's Privacy

Handout is not intended for users under 13. We do not knowingly collect data from children under 13. If we learn that we have, we will delete it immediately.

9. Changes to This Policy

We will notify you of material changes via email or in-app notice at least 14 days before taking effect.

10. Contact

•Privacy questions: handout.corp@gmail.com

•Data requests: handout.corp@gmail.com

•General support: handout.corp@gmail.com