Privacy on GoodHand
This page lists what the system stores about people, read from its database and settings. It makes no promise the code does not keep.
The short version
- We never sell your data, and we never share your phone number or address, except your address with the pro you pick.
- We do not ask for your phone number. You sign in with an email address, or with nothing if you only ask for a pro from your phone.
- Your street address goes only to the pro you pick. It is deleted when the request closes, and at the latest 30 days after the job is confirmed.
- We keep your location only as a small map cell, about a neighbourhood (0.7 km2), never as a point.
- A few other companies handle data for us, such as hosting and the AI that reads your problem. They are listed under "Who else handles data" below.
What is stored
| Data | What exactly | How long |
|---|---|---|
| Account | Email address (for people who sign in by email), display name, interface language, whether it is a person or an agent, an agent's description, when it was made. There is no password. | Until you delete the account. Deleting clears the email, name and description. |
| Sign-in sessions | A hash of the session token (not the token), the first 300 characters of your browser's user agent, when it was made and when it ends. | 90 days, then deleted. |
| Sign-in links | Your email address and a hash of the one-time link. | The link works for 24 hours. The record is deleted 7 days after it ends. |
| API keys and grants | A hash of each key (never the key itself), its scopes, label and last-used time, and what a person granted an agent. | Until revoked or the account is deleted. |
| Phones | The public key of a phone that did a door scan, signed a photo or confirmed a job, and when it was first and last seen. | Until the account is deleted, unless a job or photo still refers to that phone. |
| Anonymous accounts | A phone account with no email, made when you ask for a pro without signing in. | Deleted after 180 days if it has no session, request or job. |
| Places | A pro's home as a map cell (a hexagon of about 5.2 km2, H3 resolution 7); search measures from the middle of that cell, never from a street address. A request's place as a smaller cell (about 0.7 km2, resolution 8) and its city. | As long as the profile or request exists. |
| Street address | The address a customer types on a request. It is stored encrypted (AES-256-GCM) with a key kept outside the database. | Erased when the request expires or closes, when the job is cancelled or reported as a no-show, and at the latest 30 days after the customer confirms. |
| Door scan position | The customer’s phone coordinates while the door code is shown. | The customer's coordinates are wiped after the scan or after 120 seconds. Only the distance in metres between the phones is kept. |
| Requests | What you wrote, the problem photo, the job type and the times. The photo and words may be read by an AI model (see who else handles data). | The text stays with the request record. Problem photos are deleted from storage after 90 days. A request lasts 72 hours. |
| Job photos | The before and after photos a pro takes, with the time and the phone that signed them. | Kept as part of the proof record. No automatic deletion rule exists today. |
| Jobs | The pro and the customer (by account), job type, area cell, the price each side stated, the customer's signature drawing if given, distances between phones, and a time-stamped log of what happened. | Kept so that a pro's proof record stays whole. Deleting your account removes your name from a job, not the job. |
| Imported past clients | The client's email address until they confirm the job, and a one-way hash of it that lets the ranking count one client once. The client's name is used in the email and is not stored. | The address is cleared when the client confirms. The hash stays. |
| Reports about a pro | The reason, what you wrote, and your email only if you chose to leave it. The pro is never told who reported. | Until the pro's account is deleted. Your email is removed when you delete your account. |
| Connected Google or Microsoft account (pros) | The mailbox address, which features you allowed (contacts, reading mail, sending mail) and the access tokens, encrypted. Contacts and mail are read only when you ask for an import or a scan. | Until you disconnect. That revokes access at the provider and clears the tokens. |
| Forwarded mail | Mail sent to a pro's GoodHand forwarding address, as received, in private storage, and used to make a request. | Deleted from storage after 30 days. |
| Notifications | Messages in the app (the same events an agent gets by webhook or by waiting on its events feed), whether email is on, your browser's push subscription, and the webhook addresses and signing secrets an agent registers. | Messages and events: 30 days, then deleted. The rest until you delete the account. |
| Networks you sign in from | A keyed hash of the network you use (the IPv4 address or the first half of an IPv6 address), never the address itself. Used only to spot a pro confirming their own jobs. | 30 days after last use, then deleted. Deleted with the account. |
| Logs and counters | One log line per page request: path, crawler type or human, status. No IP address and no full user agent. Rate-limit counters keyed by a hash of the IP address. An audit log of account actions (who, what, when). | Server logs 30 days. Counters 2 hours. Database backups 7 days. The audit log has no deletion rule today. |
What the public sees
A pro's public page shows their display name, trades, city, languages, counts of jobs by rung, price ranges, and the month and area cell of recent jobs. It never shows an address, a customer, or one job's price.
Who sees what
- You, as a customer: your own requests, offers and jobs.
- The pros you ask (up to 3): the problem you described, its photo and the area. Not your name and not your address.
- The pro you pick: the job, your display name if you set one, and the street address.
- An agent: only what a person granted it, within the limits they set.
- People who run GoodHand can read the database to operate it. In it the street address is encrypted.
How to delete your data
In the app: Account, then Delete my account. For an agent or a script: DELETE /api/v1/me with the body confirm = delete; add ?dry_run=true first to see what would happen. A person can delete an agent they claimed from their side.
Removed at once: your email, name and description, sessions, API keys, push subscriptions, notifications, webhooks, grants you gave, and phones no job or photo refers to.
Not removed today: a pro's page is hidden, not erased (its name, trades and area stay in the record); requests, jobs and job photos stay without your name; the audit log stays. Removed with the account: the emails of clients still waiting for a confirm link (their links stop working), and the tokens of a connected Google or Microsoft account, so GoodHand can no longer read or send with it. That account still lists GoodHand as an app until you remove it there, or disconnect in GoodHand first.
Who else handles data
- Amazon Web Services: hosting, database, file storage, content delivery, and sending and receiving email.
- Anthropic: when a problem is read, the photo (if any), your words, your language and the list of job types are sent to Anthropic's API. Nothing else is. The app's own text is also translated with it while it is being built, with no personal data.
- Google or Microsoft: only if a pro connects an account; they are called to read contacts or mail when asked.
- Your browser's push service (Apple, Google, Mozilla or Microsoft): only if you turn on push; it carries the notification.
- Any address a person or agent registers as a webhook receives that account's event payloads.
- No analytics, advertising or tracking service is used.
The numbers on this page are generated from the code at commit 49574b3fc41b. Machine-readable version of this page (JSON)
Other languages: español · português · français · Deutsch · italiano · polski · українська · Türkçe · हिन्दी · Indonesia · 日本語 · 中文 · العربية · català · فارسی · shqip · հայերեն · Nederlands · svenska · azərbaycan · bosanski · বাংলা · български · Melayu · རྫོང་ཁ · беларуская · Ελληνικά · čeština · dansk · አማርኛ · eesti · suomi · føroyskt · ქართული · hrvatski · Haitian Creole · magyar · עברית · íslenska · кыргызча · ខ្មែរ · 한국어 · қазақ тілі · ລາວ · සිංහල · lietuvių · Lëtzebuergesch · latviešu · română · српски · македонски · မြန်မာ · монгол · Filipino · Malti · Divehi · Nyanja · norsk · नेपाली · اردو · русский · Ikinyarwanda · slovenščina · slovenčina · Soomaali · ไทย · тоҷикӣ · türkmen dili · lea fakatonga · Kiswahili · o‘zbek · Tiếng Việt · Bislama · Samoan · isiZulu