Privacy policy

In effect from 2026-11-02.

This policy says what HandyBits does with personal data: what is stored, where, for how long, who else receives it, and what you can do about it. It covers the app at https://my.handybits.app, the pages opened through a share link, the assistant access the app offers, the HandyBits extension for Google Chrome, and this website.

1. Who is responsible

VASILCHEV LTD is the controller of the personal data described here. Write to hifive@handybits.app about anything in this policy, including a request to use one of your rights.

2. What is stored, where, and for how long

A Bit is anything you save: text, a link, code, an image, a file, audio or video. Bits and files are kept in Google Cloud's region europe-west4, in the Netherlands.

The logs we keep do not hold the words of a search, the token of a share link, a title, a file name or the content of any Bit.

3. What the service does with your Bits

• Classifying and filing. Each Bit is classified by kind and filed into a folder by rules that run inside the service. No content is sent to an AI model to classify or file it.
• Looking for secrets. The service checks a Bit for things that look like a password or a key, and marks such a Bit Confidential, to ask you before you share it and to keep those values from an assistant you have connected.
• Finding related Bits. To show you which of your Bits are about the same thing, the service sends part of each Bit you save or edit to Google Cloud's Vertex AI, in the European Union, and keeps the list of numbers it returns (an "embedding") with the Bit. What is sent is the title, the note, the website's name, the file name, the tags and the first 8 000 characters of the text. Never the full web address, and never a file's contents. Nothing is sent for a Bit you marked Private or Hidden, for a Bit marked Confidential, or while you use HandyBits without an account. Making a Bit Private later removes its embedding, but what was sent was sent. Google does not use it to train its models; we have switched off Vertex AI's caching for our project. Google may keep what is sent for a limited time to detect abuse of its service.
• Checking shared links. When you share a Bit that has a web address, that address — and nothing else of the Bit — is sent to Google Cloud Web Risk to see whether it is listed as malware or phishing. It is checked when the link is made and again from time to time when the link is opened. Web Risk is a global service: the lookup is not kept in europe-west4.
• Checking shared files. When you share a file, the service reads its first 64 bytes to tell a program from a picture, because programs cannot be shared.

Beyond that, we do not look inside a Bit that you have not shared. We act on a shared Bit when someone reports its link or one of the checks above refuses it.

Your Bits are encrypted in transit and at rest. They are not end-to-end encrypted: the service can read them in order to store, show and share them.

The Chrome extension

• It reads a page only when you capture. When you press a capture shortcut or choose HandyBits from the right-click menu, it reads that tab's address and title, the text you selected or the link or image you clicked, and the page's own canonical address. It sends that to HandyBits, where it becomes a Bit like any other and is stored as described above. It collects nothing in the background and reads no page you do not capture from.
• It talks only to HandyBits and to Google's sign-in. To sign you in, it asks Chrome for a token for the Google account Chrome is signed in to, and exchanges it with Google's Firebase Authentication for a HandyBits session. It sends nothing to anyone else.
• It keeps your session in memory, not on disk. The session is held in Chrome's session storage and is gone when Chrome closes. On disk it keeps only whether you signed out, so that it does not sign you back in, until you sign in again or remove the extension. A capture waiting in its window is held in memory the same way.
• It never creates an account. If the Google account has no HandyBits account, it removes the sign-in record its attempt created at once, stores nothing, and sends you to the app to sign up.

4. Why we use personal data

• To provide the service you asked for — keeping your account, storing and showing your Bits, making and serving share links, and giving access to an assistant you connect. This is the performance of our contract with you.
• To keep the service secure and to stop abuse — the logs, the limits on how fast a request may be repeated, the checks on shared links, and the handling of reports. This is our legitimate interest in running a safe service.
• To comply with the law — when a law requires us to keep, remove or disclose something.

We do not sell personal data, show advertising, or build a profile of you. No decision that has a legal effect on you is taken by automated means alone.

5. Who receives personal data

• Google runs the infrastructure on our behalf, as our processor: Google Cloud (the servers, the database, file storage, logs, monitoring, Web Risk and Vertex AI), Firebase (sign-in and hosting), Google Workspace (the email you send to us) and, on this website only, Google Tag Manager. Sign-in records are held in the United States, and Web Risk, Google's audit logs and our email are not tied to a region; these transfers are made under the safeguards in our agreements with Google, including the European Commission's standard contractual clauses.
• People you share with. Anyone who has a share link can open what you shared, without an account, until you revoke the link or it expires. A share page never shows your email address.
• An assistant you connect. An access token you create lets that assistant search and read your Bits, and add or edit them if you allow it. A Bit you have marked Private or Hidden is never given to a token, and cannot be shared. What an assistant does with what it reads is governed by its provider, not by us.
• Authorities. We disclose personal data to a court, the police or another public authority where the law requires it, and may do so where the law permits it, for example when we become aware of content that appears to be a serious crime.

6. Cookies, this website and Google Tag Manager

The app does not use cookies: your session is kept in your browser's own storage for the app's address and sent with each request as a token. The app does not load Google Tag Manager or anything else from another party.

This website — the pages at https://www.handybits.app — has no form and asks you for nothing, and its own pages set no cookie. Opening it is recorded in the hosting provider's own logs, as described above.

This website loads Google Tag Manager, a service of Google that lets us add measurement to these pages without changing them. When a page opens, your browser asks Google's servers for our Tag Manager container, and in doing so sends Google your network address and the usual details of a web request, such as your browser and the page you are on. We do this on the basis of our legitimate interest in understanding how this website is used. Tag Manager itself sets no cookie. We run no tag through it that stores or reads anything on your device unless you have agreed to it first; today no such tag is installed.

7. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• have it corrected;
• have it erased — you can delete your account in the app at any time, which removes your Bits, files, share links and access tokens at once and cannot be undone;
• receive your data in a portable form — the app does not offer an export yet, so write to us;
• object to, or ask us to restrict, what we do on the basis of our legitimate interest.

Write to hifive@handybits.app. We answer within one month. You also have the right to complain to the data protection authority of the country where you live, or to ours: the Commission for Personal Data Protection of Bulgaria (www.cpdp.bg).

8. Age

HandyBits is for people who are 16 or older. We do not knowingly keep the personal data of anyone younger; if you believe we do, write to us and we will delete it.

9. Changes to this policy

When what the service does with personal data changes, this policy changes in the same release and the date at its top with it.