HandlerThe short version
- Handler doesn't sell your data, show ads, or use analytics or tracking.
- Your receipts, documents, transactions, budgets and conversations are stored encrypted on your iPhone. If you turn on backup, they also go to your own iCloud, encrypted by Handler first.
- Handler's servers never store your content. The bank relay passes your requests to Plaid and back without keeping or logging them.
- When you connect a bank, Plaid retrieves your account data under its own privacy policy.
- If your iPhone can't finish reading a receipt, Apple's Private Cloud Compute may help. It's on by default, and you can turn it off.
What Handler stores
Handler keeps what you choose to give it, so it can organize it for you:
- Receipts and documents you scan, photograph, import or share into the app, and the text read from them.
- Merchants, dates, line items, amounts, categories and tags, whether you entered them or Handler read them.
- Bank accounts and transactions from the banks you connect, and transactions from statement files (CSV, OFX or QFX) you import.
- Envelopes and budgets you set up.
- Deadlines such as return windows, warranties, policy dates and renewals.
- Questions you ask the assistant and its answers, kept only while the conversation is open.
- Your settings.
None of this is sent to Handler's developer. We don't collect, receive, sell or share it.
Where it's stored
On your iPhone
Your records are kept in a database encrypted with a 256-bit key. The key is held in your iPhone's Keychain, is tied to this device and is never synced or included in device backups. Scanned documents are stored with Data Protection, so they can't be read while your iPhone is locked.
The keys for each bank you connect are also kept in your iPhone's Keychain, tied to this device. They are never written to the database, a file, a log or a notification.
In your iCloud, if you turn on backup
Handler's iCloud backup is off until you turn it on. Before anything leaves your iPhone, Handler encrypts it with a backup key that only your Apple devices hold, through iCloud Keychain, and that we never see. Handler shows you a Recovery Key once, so you can restore if you don't have another Apple device. Health-related documents, such as insurance statements for medical care, are never included in the backup.
What leaves your iPhone
Reading, sorting and answering happen on your iPhone with Apple Intelligence, and every feature works offline. Only these leave your iPhone:
| Where | When | What is sent |
|---|---|---|
| Apple Private Cloud Compute | Only when your iPhone can't finish a reading or sorting task itself, and only while the setting is on (on by default) | Only what that one request needs: a receipt's photo, or text such as a merchant name and item descriptions. Never bank data, other documents or your database. The assistant never uses it. |
| Handler's bank relay, then Plaid | Only after you connect a bank, to link it and to fetch new transactions | The request to Plaid and your bank connection's keys. Transactions return to your iPhone; the relay keeps nothing. |
| Plaid and your bank's sign-in pages | While you connect a bank | What you enter on those pages goes to Plaid and your bank, not to Handler. |
| Your iCloud | Only if you turn on backup | Your Handler data, encrypted by Handler before it's sent. |
| Store return-policy updates | From time to time | A download of public return-policy information. It carries nothing about you. |
Apple designed Private Cloud Compute so that requests aren't stored or made accessible to Apple. Learn more at security.apple.com. You can see Handler's recent Private Cloud Compute requests, without their content, in Handler's Settings.
Bank connections and Plaid
Handler connects to banks through Plaid Inc. When you connect a bank, you sign in on Plaid's and your bank's own pages, so Handler never receives your banking username or password. Plaid then retrieves your account and transaction data and passes it to your iPhone through Handler's bank relay.
Plaid keeps data it retrieves under its own End User Privacy Policy. You can review and remove the apps connected to your bank through Plaid at my.plaid.com. Disconnecting a bank in Handler stops new transactions; those already on your iPhone stay until you delete them.
Handler's servers
Handler runs a small number of servers for things that can't happen on your iPhone. They follow one rule: they hold keys, never your content.
- The bank relay passes requests between the Handler app and Plaid. It holds Handler's Plaid API keys. It doesn't store requests or responses, and request logging is turned off.
- To make sure only the genuine Handler app can use the relay, it stores, for each installation, a security key the app generates with Apple's App Attest, and a counter. These say nothing about you or your finances.
- The relay runs on Cloudflare. Cloudflare processes your device's IP address to deliver each request, and briefly counts requests per address to stop abuse.
Handler's servers never store your receipts, documents, line items, transactions, balances, budgets, categories, orders, or your questions and answers, encrypted or not.
Permissions
| Permission | Why Handler asks |
|---|---|
| Camera | To scan receipts and documents. |
| Photos | Only the photos you pick are shared with Handler. |
| Notifications | To remind you of deadlines. Reminders are scheduled on your iPhone. |
| Microphone and Speech Recognition | Asked the first time you hold to talk. Speech is recognized on your iPhone and the audio is never saved. |
You can change these at any time in the Settings app.
Apple features
- Siri and Spotlight are off until you turn them on. When on, document and deadline titles become findable on your iPhone. Turning it off removes them from the index.
- Widgets, Live Activities and notifications show document kinds, titles and dates. A receipt's amounts and photo appear only on the ones you choose in Handler's Settings. Accounts, balances, transactions, budgets and envelopes never appear outside the app.
- Your use of Apple's features is covered by Apple's Privacy Policy.
Your choices
- Delete: deleting an item removes it from Handler. Deleting the app removes all of Handler's data from your iPhone.
- Private Cloud Compute: turn it off in Handler's Settings and nothing is sent to it.
- Backup: turn iCloud backup off in Handler's Settings, and manage stored data in your iPhone's iCloud settings.
- Banks: disconnect a bank in Handler, and review connections with Plaid at my.plaid.com.
- Access and correction: your data is on your device, so you can see and edit it in the app. We hold no copy of it.
Accounts
Handler doesn't have accounts today. Accounts are planned so you can restore on a new iPhone, use more than one device and share with your household. This policy will be updated before any version with accounts is released, and you'll be able to delete your account from within the app.
Children
Handler isn't directed at children under 13 and doesn't knowingly collect information from them.
This website
myhandler.app is a set of static pages. It uses no cookies, analytics, fonts from other sites or third-party scripts. It's hosted on Cloudflare, which processes your IP address to deliver the pages.
Changes
If a future version of Handler sends any data off your iPhone in a new way, this policy will be updated before that version is released, and the date at the top will change.
Contact
Questions about privacy? See Support. A contact email address will be published there before Handler is released.