Privacy policy — Offhand MCP and apps

On your device

§1

What Offhand keeps. Your recordings, the transcripts Offhand made of them, the tasks it made from those, and your settings. On the iPhone they live in storage that Offhand shares only with its widget; on the Mac, in the app’s own store.

How long. Until you delete them. In Settings you can choose to have recordings deleted once they reach an age you pick; the transcript stays either way.

How your voice becomes tasks. Speech recognition and the language model that turns a note into tasks both run on the device. There is no remote model to fall back on: when the local model cannot run, Offhand saves the note and says it found no tasks.

Offline by construction. Every feature except Offhand Cloud works in airplane mode. You can check this: watch the device through a proxy and you will see no request you did not switch on.

Without Offhand Cloud, nobody at Offhand can read any of this, because none of it reaches us.

Offhand Cloud: what we hold

§2

Offhand Cloud is an account at offhandapp.com. It lets agents on the internet work with your list. It is off until you sign in, and nothing in this section happens before that.

What	What exactly
Who you are	Your name and email address as Apple or Google gives them, which of the two you used, and the id it keeps for you. Never your password, and no access to anything in those accounts. With Apple’s Hide My Email, we get Apple’s relay address. With Apple, also the token Apple issues, kept only to have Apple revoke the sign-in when you delete the account. Signing in with Apple and with Google under the same verified email makes one account.
Your list	While Upload my list is on: your tasks, notes and groups as your devices hold them, with what agents have said about each task, and each device’s name and time zone. Signing in turns upload on; you can turn it off in the same place.
What agents add	Tasks your agents add or hand each other, a goal’s plan, what they share on a goal’s board with the target and rules you set there, and the files they leave with a task.
Agents you connect	Each agent’s name, what you allowed it to do, and when. Where it is woken, if you set that up: the address, and its key, encrypted; for Instinct, its email address, and the key in the address its replies go to, encrypted. A recent record of each time an agent was woken.
Cloud transcription	How much audio you sent each day, and how many free try-out recordings you used. Never the audio.
Offhand Pro	Which plan, until when, the purchase’s id from Apple or Stripe, and whether the account has had its free week. Never a card number.

Recordings are never kept. If you turn on Cloud transcription, each recording you finish goes through our server to Microsoft’s speech service on Azure, in a United States region, and the words come back to your device. Our server does not keep the audio. Settings names the provider before you turn it on.

Where it is kept. On our server, which runs on Cloudflare; we have not tied it to one country. Each account has a storage unit of its own. All traffic is encrypted in transit. Sign-in sessions and agents’ tokens are stored only as one-way hashes. Your list is not end-to-end encrypted: the server must read it to give it to your agents.

Who can read it

§3

01You, on your account page in the app and at offhandapp.com/account.
02The agents you connect, and only those. An agent reaches your list only after you approve it at offhandapp.com, and does only what you tick there; that page lists what each box allows. When a task is handed to an agent, the server tells that agent at the address you gave for it, or that its app asked for, with at most the task’s title, details and day, who handed it over, and the note they handed it over with. Instinct, which works by email, gets this in an email from tasks@agents.offhandapp.com, and one more when you connect it, with the address its own emails go to. The first lines of its reply become what it said about the task, and may hand the task to another of your agents; an email it sends to that reply address may add a task, for you or for another of your agents. A file an agent leaves can be downloaded only by agents you allowed to read your list, by a short-lived link that stops working when the task leaves your list. What an agent reads goes to the company that runs it, and that company’s privacy policy says what it keeps.
03The services that run it for us. Cloudflare hosts the server and stores the account. It keeps a record of each request for 7 days: the IP address and the city and network it points to, the time, the page asked for, and the headers, with sign-in tokens and cookies removed. It also carries the emails to and from Instinct, and keeps a record of each: the two addresses, the subject and the time. The subjects Offhand writes name who handed the task over and the task’s number but none of its words; Instinct is asked to keep them, and to write only “New task” on an email that adds one. Our server writes no task, note or email address into its logs. Apple or Google learns that you signed in to Offhand. Microsoft hears the recordings you send for Cloud transcription. Stripe takes payment for Pro bought on the Mac, as merchant of record. We tell it the plan, your account’s random id and, until it has an id of its own for you, your email address. Your card goes to Stripe, never to us, and Stripe keeps its own record under its own policy.

How long it is kept, and deleting it

§4

What	Kept until
Your list	Each device’s copy is replaced at its next upload, so what you delete on the device is deleted there too. Signing out on a device removes its copy. A device that has not uploaded for 30 days loses its copy.
What agents add	One of your devices syncs it into its own list; then the server deletes its copy. A goal’s board stays with the account.
Files	A week after the task leaves your list, or 30 days after it is done. An upload that never finished, within an hour.
Connections and sign-ins	An agent’s connection ends after 30 days unused. A web sign-in lasts 30 days, an app’s up to a year.
The account	You delete it, or nobody has used it for a year. Then it is deleted with everything in it, and a subscription bought on the Mac is cancelled first.
Backups	Cloudflare keeps 30 days of each account’s storage history. What you delete is gone from it after 30 days, and our server cannot restore it.

Download my data. On your account page, it gives you everything the server holds about you in one file. No password, token or key is in it.

Delete Account. On your account page or in the app’s Offhand Cloud settings, it deletes the account and everything uploaded to it at once, disconnects every agent, and asks Apple to revoke a sign-in with Apple. The tasks, notes and recordings on your devices are not touched. A subscription bought on the Mac is cancelled first; if Stripe cannot confirm that, nothing is deleted and you can try again. After deletion nothing of the account is kept, except the id of an iPhone purchase that Apple refunded, with no account attached, so it cannot be used again.

Disconnect. Beside an agent on your account page, it removes one agent and keeps the rest.

Deleting the app does not delete the account. Delete the account first.

Other ways anything can leave your device

§5

Each of these is off until you turn it on.

01iCloud sync. Your tasks and notes go to your own iCloud, never to us. Recordings are a second, separate switch; turning it off removes them from iCloud and keeps them on the device.
02Show in Calendar. Puts your scheduled tasks in an “Offhand” calendar; turning it off removes the calendar. If your Calendar syncs with iCloud, those events sync too, like any other event.
03The Mac’s update check. The Mac app asks you before it first checks. It sends only its version and the updater’s version.
04Agents on your Mac, Handoff and Shortcuts. The Mac app can serve your list to an agent on your Mac, as far as you allow in Settings; it runs nothing until you set it up. When you hand text to another app or agent, its rules apply from then on.
05What you share yourself. A copied transcript, an export, a task you send someone.
06The Mac beta list. If you leave your email address for the Mac beta, we keep it only to tell you when the Mac app is out, and then delete the list.

Permissions

§6

Permission	What it is for
Microphone	Required, to record a note.
Notifications	Optional, for alerts at a time you named and the badge.
Calendar	Optional, only for Show in Calendar.

Offhand does not ask for speech-recognition permission, because recognition runs inside its own recording. You can withdraw any permission in Settings → Offhand at any time. An agent’s connection to Offhand Cloud you withdraw with Disconnect on your account page.

Children, and changes

§7

Offhand is rated 4+, and without Offhand Cloud it collects nothing from anyone. Offhand Cloud is for people 13 and older.

This page carries the date it last changed. A correction or a clearer wording that changes nothing Offhand does gets a new date only. A change to what Offhand does with what you say, or to what Offhand Cloud holds or who receives it, is made here on the day it applies, and the release notes say it. If a change would use what Offhand Cloud already holds in a new way, or give it to someone new without you turning anything on, the app tells you before it applies, and nothing already held is put to a new use without your yes.

Who we are, and your rights

§8

Offhand and Offhand Cloud are made and run by Offhand AI, LLC, c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA. Questions: support@offhandapp.com.

Laws such as the GDPR and the CCPA give you the right to see, correct, export and delete your personal data. Without Offhand Cloud we hold none: everything is in the app on your device. With Offhand Cloud you can do each of these yourself: see it on your account page, correct it on your device (the next upload replaces the copy), export it with Download my data, and delete it with Delete Account. For anything else, write to us. We never share your data for advertising or use it to train an AI model.

In the EEA, the UK or Switzerland. Offhand AI, LLC is the controller of what Offhand Cloud holds. We process it to provide the service you signed in for, and keep request records and limits under our legitimate interest in keeping the service safe. It is processed in the United States and wherever Cloudflare’s network serves it, under the standard contractual clauses in our providers’ data protection terms. You can complain to your data protection authority.

The terms cover the rest of the agreement.