Handspan privacy notice

Last updated: October 4, 2026 · Operator: SL22 Studios

This notice covers the Handspan website and Android app. Handspan tries a direct connection first and uses temporary encrypted Cloudflare storage as its backup. Both devices need an updated app or browser page for the storage backup. If you use another operator's service, ask that operator about its hosting practices.

Your files and the receiving device

You choose files and the receiving device approves the file list before file content is sent. Handspan tries a direct encrypted connection first. Direct transfers carry file content between the devices. The paired devices can learn network information needed to connect, including IP addresses. Once a recipient saves a file, Handspan cannot retrieve or erase their copy.

If a direct route is unavailable, temporary encrypted Cloudflare R2 storage carries the transfer. File names, types and contents are encrypted on the devices before upload. Handspan's server and the storage provider do not receive the file decryption keys. Encryption does not hide all metadata: providers can observe IP addresses, timing, encrypted sizes and traffic volume. We cannot recover files if their device-held keys are lost. Encryption and integrity checks do not establish that a file is safe to open.

Temporary encrypted storage

The sending device uploads encrypted objects directly to a private Cloudflare R2 bucket; the receiving device downloads and decrypts them locally. File payloads do not pass through the Handspan web server on this route. The service authorizes short-lived object access and keeps a private database of session and object identifiers, authorization records, sequence numbers, encrypted byte lengths and checksums, expiry times and deletion status. These records include hashed authorization tokens, not file decryption keys. They support delivery, capacity limits, retries and cleanup; they are not an advertising profile.

A storage session lasts up to two hours from creation and supports one batch. Successful delivery confirmation requests deletion of the encrypted file objects. On supported save paths, confirmation follows verification and a successful local save. For browser download links, clicking Save only tells us that a download was requested; the browser cannot confirm that the operating system saved it. Check Downloads and keep your original files. Cancellation and session expiry also request cleanup. A final encrypted receipt may be retained briefly, normally until acknowledged or for up to 30 seconds, so the sender can learn that delivery finished.

Deletion is retried when necessary. Cleanup records are retained until at least 24 hours after the last signed upload URL expires, and longer if deletion continues to fail. This allows another deletion attempt if an upload finishes late. Expired session records are removed after their associated cleanup records are cleared. Cleanup records do not mean an already-deleted file remains available. Service outages and provider failures can delay both object and record removal. A separately configured bucket lifecycle expiration provides additional cleanup; it is asynchronous and does not guarantee deletion at an exact instant. See Cloudflare's lifecycle information.

Persistent server records survive ordinary restarts. Hosting disk snapshots or backups, if enabled, can retain older records under the provider's retention settings. Those records contain no file decryption keys. Temporary storage does not provide a permanent cloud inbox or a way to recover a closed browser session.

Retired live relay

The live file relay through Render has been retired. Updated devices use direct transfer or temporary encrypted Cloudflare storage.

Connection setup and hosting metadata

The service handles temporary room identifiers, hashed authorization tokens, authentication exchanges, encrypted connection descriptions and expiry times. It receives IP addresses to answer requests and derives salted identifiers for abuse limits. Pairing invitation secrets stay on the devices. Receiving invitations expire after 10 minutes; expired in-memory setup records are removed on a later request or cleanup cycle, normally within 30 seconds. Restarting the service clears these in-memory records, but not the separate persistent storage cleanup database.

Render hosts the website, connection-setup API, and storage authorization and cleanup service. It sees network/request metadata; file payloads do not pass through it. On the R2 route, Cloudflare stores ciphertext and handles direct uploads and downloads. Google and Cloudflare STUN services see address-discovery traffic used to find direct routes, not file contents. Handspan does not enable application HTTP access logging, but hosting infrastructure may keep operational or network logs under its own policies. Providers may process data in other countries.

Administrator-only usage totals

Handspan counts receiving codes created. Updated receivers report completed batches with file count, approximate total size rounded to MiB, duration rounded to seconds, receiving platform and transfer method: direct or temporary storage. Historical totals may include the retired live relay, and older reports can show an unknown method. A browser batch can be counted before the user finishes saving its ZIP. Reports are estimates; failed or missing reports may not be counted. They contain no file names, contents, MIME types, paths, device identifiers or recipient identities.

Reports are combined into daily and overall totals visible through authenticated administrator access. Daily totals cover today and the previous 29 UTC days; older totals are removed on the next request or cleanup cycle. Overall counters remain until the analytics database is reset. A one-use reporting ticket expires after 24 hours; its hash and expiry prevent duplicate counting, with no retained link to the room or report totals. There is no individual-transfer analytics history. Separate storage delivery and cleanup records are described above. In-memory totals reset on service restart; persistent totals follow the database's retention and backup settings.

No analytics SDK, tracking cookie, advertising identifier or cross-site profile is used. The administrator dashboard holds its access key in the current tab only and clears it on sign-out, navigation or after 30 minutes.

On your device

Browsers keep pairing and encryption state in memory. Multiple files are assembled and verified as a ZIP locally. Small batches use bounded memory; larger batches require suitable private browser storage or a supported save destination. If a chosen destination cannot be written, the verified ZIP can remain available for a browser download. Save it before closing the page. Temporary local storage is cleaned up when another transfer starts or the app closes normally; a crash can leave temporary files until you clear this site's storage.

The Android app saves completed files in Downloads/Handspan. Sources without a known length may be copied into the app's private cache. Uninstalling or clearing app storage removes that cache, not completed downloads or recipients' copies. Clipboard history may retain copied invitations or codes.

Permissions and your choices

You can reject or cancel a transfer, revoke optional permissions and delete saved local files. There is no Handspan account to delete. Cancellation requests cloud cleanup but cannot withdraw copies already obtained by the recipient.

Contact and privacy requests

We use the described information to provide transfers, prevent abuse, operate the service and understand aggregate usage. Handspan does not sell personal information or use it for advertising. If you contact us, we use the information you provide to handle your request. Depending on your location, you may have rights to access, correction, deletion, restriction or objection. Contact handspanbusiness@gmail.com; do not send files, pairing codes, access tokens or encryption keys. We may need limited information to locate and verify a request, and we cannot reconstruct past files or transfers from aggregate totals.

Changes to these practices will be reflected in the date and text of this notice. See also our terms of use and accessibility information.