Privacy notice
How we handle family recipe data
Last updated August 17, 2026.
Handed To Us is operated by Javier Sanz. This notice explains how the service handles information when you visit, purchase, upload, or join a family cookbook. Privacy questions can be sent to care@handedtous.com.
What we collect
Handed To Us processes the account details you provide, purchase records, family vault membership, recipe photos, recipe text, family stories, people attribution, review notes, and limited security and reliability logs. For purchases and gifts, we also process purchaser and recipient email addresses, delivery timing, optional gift notes, and checkout attribution such as UTM parameters or TikTok click IDs.
Why we process it
We use this information to provide the private family cookbook, transcribe and organize recipe images, let invited people use the collection, provide exports, prevent abuse, support customers, and meet payment and legal obligations.
Recipe images and AI processing
Original images are stored in private buckets. We create a smaller private derivative for transcription and send only short-lived access to the configured AI provider. Transcription requests disable provider storage where supported. Handed To Us does not routinely have a person review recipe contents. Authorized support access is limited to a family request or a reasonable security, abuse-prevention, legal, or service-recovery need; sensitive actions are audited.
One-recipe preview
The optional free preview uses the email and recipe image you provide to return one private transcription. The uploaded preview image is deleted after transcription. The result and private access token expire after approximately 24 hours and are removed by scheduled cleanup. We retain rate-limit hashes for that period to prevent abuse.
Emails
We send transactional messages needed to deliver purchases, gifts, sign-in links, invitations, trial results, and support. An abandoned checkout reminder may be sent when a purchaser starts but does not complete checkout. We disclose this before checkout, provide an immediate opt-out, and limit it to one reminder for that checkout.
Cookies and ad measurement
Essential cookies keep accounts secure and preserve checkout attribution. If TikTok measurement is configured, its script loads only after a visitor chooses to allow optional marketing measurement. Visitors can decline and continue using the product. We use first-party funnel events to understand aggregate product performance and prevent abuse.
Sharing and service providers
Data is shared only with providers needed to run the service. These currently include Vercel for web hosting, Supabase for authentication, database, and private storage, OpenAI for transcription, Stripe for payments, and Resend for transactional email. TikTok receives measurement data only after optional marketing consent. We do not sell family recipe data or use it to train a public recipe model.
Retention and deletion
Recipe data remains until the vault owner deletes it or the service ends under the package terms. A vault owner can export and permanently delete the vault, including stored images. Payment records and minimal security logs may be retained when legally required. Account deletion is available after owned vaults are deleted or transferred.
Your controls and rights
Vault owners control invitations, roles, exports, and deletion. Members can correct account information and leave a vault. Contact care@handedtous.com for access or correction requests that cannot be completed in the product.
Depending on where you live, you may also have legal rights to access, correct, delete, or obtain a copy of personal information. We will verify requests before acting and will respond as required by applicable law.
Security
Access is enforced by authenticated, role-based database and storage rules. Files are not public, administrative actions are audited, and service credentials stay on the server. One-way sign-in rate-limit hashes may be retained for up to 30 days to prevent email abuse; they do not contain the email address itself. No system can promise absolute security.
Children and sensitive family stories
The service is not directed to children under 13. Customers should avoid uploading highly sensitive personal details that are not needed to preserve a recipe or family story.