Privacy policy

Your account. Your email address, an optional display name, and, if you sign in with Google, the name and profile picture they provide. OAuth sign-in shares only that basic profile (name, email, picture); we request nothing else from those accounts.

Your content. The Memory Packs you create, the items and documents you add to them, and the results of Memory Scans your AI assistant sends to us. All of it is content you or your AI chose to put here.

Invitations. When you invite someone, we store their email address to deliver and track that invitation.

Usage events. While you are signed in, we record what you do in Warmhand: the pages you open (the kind of page, not which pack), actions such as creating a pack or sending an invite, the tools your AI calls through the Warmhand connector (the tool name, not what it read or sent), and errors you run into. We use this to see where the product fails people and improve it. Events never contain your pack contents. Nothing is recorded before you sign in. Usage events are kept for as long as your account exists, and deleted when you delete your account.

Cookies. Only the essential cookies that keep you signed in. No advertising cookies, and no third-party analytics.

To run the product: storing your packs, showing them to the people and AI assistants you have shared them with, and sending the emails the product needs to work, such as sign-in links and invitations.

Some content in Warmhand is processed by Google’s Gemini API on our behalf: the conversation you type when defining a Memory Scan; the scan results your AI sends back; the contents of your packs when a scan’s quality is assessed; the entire contents of the enabled Memory Pack selected on the Memory Packs page, to produce its contents summary; the text of the pages, documents and memories in your packs, to index them for search; and the searches you and your AI run, to find the passages that answer them. We send only what each feature needs, on the paid tier of the API, where Google’s terms state that submitted content is not used to improve its products or train its models, and is logged for a limited period only to detect abuse and for any legally required disclosures.

We do not sell or rent your data. There are no ads.

You control sharing. A pack is visible only to you and the people, or the shared domains, you have explicitly given access. An invitation link grants access to whoever completes it, so treat invite links like the keys they are.

Your data is stored on DigitalOcean in the European Union (Frankfurt), including uploaded documents. What leaves that boundary: sign-in and invitation emails go through our email provider; signing in with Google runs their sign-in handshake; and the Gemini processing described above sends that content to Google. Separately, your browser loads the illustration images on our blog and marketing pages from Unsplash, the only address outside our own systems that any page here is allowed to fetch from. If this list ever grows, this page changes first.

Delete your account from the settings page at any time. Deletion removes your account data and personal information from our systems; it is not a soft hide. Content you shared into a pack someone else owns follows that pack’s ownership.

European data-protection law also gives you rights beyond deletion: to see the data we hold about you, correct it, receive a copy of it, and complain to a supervisory authority. Email us to exercise any of them.

Warmhand is operated by Warmhand AB, a Swedish company, which is the controller of the data this page describes. Email [email protected] and a human answers. If this policy changes, the new version is posted here with a new date at the top.