HANND pilot privacy notice
Last updated: October 18, 2026. This notice describes the private pilot, not a public launch.
What this app stores
The app uses your Site-specific authenticated account identifier and display name. It stores receipts you add or receive, item descriptions and amounts, purchase dates, folders, labels, notes, merchant profiles, hashed API keys and device connection keys, device names and connection timestamps, temporary receipt destination hashes, rate limits and billing-event identifiers. Your account email is available through the sign-in provider and is sent to Stripe only if an integrated billing Customer is created. Full card numbers are not stored by HANND.
How your information is used
Information supports receipt delivery, organization, exports, account access, abuse prevention and merchant billing. Your receipt code is a temporary random destination; it does not expose your email or provide read access to your inbox. The app does not include advertising trackers or sell receipt data.
Service providers
Authentication and hosting use ChatGPT Sites and its infrastructure, including Cloudflare storage and execution. Stripe processes billing if enabled. The current checkout preview runs in a sandbox. No live billing is active in this pilot. These providers have their own data handling and retention terms.
Your choices
Delete receipts, manage folders and labels, export CSV or JSON, or delete your HANND data from Settings. Deleting a folder keeps its receipts. Account deletion removes active application records and requires cancellation of any continuing subscription first. Your hosting sign-in account is separate and is not deleted by this app.
Retention and deletion
Receipts remain until you delete them or your HANND data. Temporary receipt codes expire after five minutes; expired rows are removed when that account requests a new code. Security and billing infrastructure, backups and payment records may persist according to provider retention policies. Application deletion does not promise erasure from all infrastructure backups.
iPhone app
The native project can keep receipts only on the iPhone, without an account. On-device records use iOS file protection and are excluded from automatic backup. Export a copy before deleting the app or replacing the phone. Sample records are separate and temporary. Connected account receipts are fetched from HANND and kept in app memory; the device token is stored in the iOS Keychain and is not included in device backups. No advertising, analytics SDK, camera, contacts, or location access is included. Device connections expire after 90 days and can be revoked from web settings.
Public launch
Before inviting external customers, the operator must publish its legal identity, support and privacy request contact, jurisdiction-specific notices and final retention policy. Those operator details are not yet configured. This private pilot notice makes no certification or regulatory-compliance claim.