Privacy Policy

Last updated: May 15, 2026

1. Introduction

DadHandled ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our Service.

2. Information We Collect

Account Information

When you create an account, we collect:

  • Email address
  • Password (stored as a one-way hash using a modern key-derivation function — never stored in plain text and not reversible)
  • Name (optional)

Usage Data

We automatically collect:

  • Task completion data and timestamps
  • Notes you add to tasks
  • Phase progress information
  • Device and browser information
  • IP address (used for security, fraud prevention, and abuse mitigation; not used for advertising or profiling)

Payment Information

Payment processing is handled by Stripe. We do not store your full credit card information. Stripe's privacy policy governs their handling of payment data.

3. How We Use Your Information

We use collected information to:

  • Provide and maintain the Service
  • Process your subscription payments
  • Generate Partner View pages and PDF exports
  • Send important Service-related communications
  • Improve and optimize the Service
  • Respond to your inquiries and support requests

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area or United Kingdom, we process your personal data under the following legal bases:

  • Contract: to provide the Service you have subscribed to, including account management, task data, Partner View, PDF export, and payment processing.
  • Legitimate interest: to keep the Service secure, prevent fraud and abuse, and improve the product.
  • Consent: for optional communications such as marketing emails, which you can withdraw at any time.
  • Legal obligation: where we are required by law to retain or disclose information (for example, tax records or lawful requests from authorities).

5. Partner View and Data Sharing

The Partner View feature creates a private, read-only link so a person you choose (typically your partner) can see your task progress without creating an account. To protect this link, we apply the following safeguards:

  • High-entropy tokens. Each Partner View URL contains a cryptographically random token with at least 128 bits of entropy, generated using a secure random number generator. The link cannot be guessed.
  • Excluded from search engines. Partner View pages are excluded from indexing through the X-Robots-Tag HTTP header, a noindex meta tag, and a robots.txt disallow rule.
  • No referrer leakage. Partner View pages send a strict no-referrer policy, so the token is not leaked through the Referer header if the viewer clicks an outbound link.
  • One-click rotation and immediate revocation. You can rotate or revoke the link at any time from your account. Revocation takes effect immediately; the old link will stop working at the next request.
  • Inactivity expiry. By default, Partner View links expire after 90 days of inactivity. You can adjust or disable this from your account settings.
  • Per-link audit log. You can view a log of when each Partner View link was opened.

What is visible in Partner View:

  • Completed tasks and timestamps
  • Tasks marked as "partner-visible"
  • Notes you choose to include

You control what is visible in Partner View and can deactivate, rotate, or revoke the link at any time.

6. Sub-processors

We rely on the following service providers ("sub-processors") to operate DadHandled. Each is bound by their own privacy policy and, where applicable, data-processing agreements:

  • Stripe — payment processing
  • DigitalOcean — application hosting and database infrastructure (United States)

We do not sell your personal data to third parties. If we add or change sub-processors, we will update this list and, where required, notify subscribers.

7. Affiliate Links and Third Parties

The Service and our marketing site may include affiliate links to third-party products. We disclose this relationship in our Terms of Service and on relevant pages. When you click these links:

  • The third-party site may collect data according to their privacy policy
  • We may receive commission tracking information
  • No personally identifiable information is shared with affiliate partners

8. Cookies and Tracking

We use cookies and similar technologies for:

  • Authentication and session management
  • Remembering your settings and preferences
  • Analytics (aggregated usage patterns)
  • Affiliate link tracking

You can control cookies through your browser settings, but disabling them may affect Service functionality.

9. Data Security

We protect your data through the following measures:

  • Data is encrypted in transit using HTTPS
  • Passwords are stored only as one-way hashes generated by a modern key-derivation function; they are not reversible and not retrievable
  • Application and database infrastructure is hosted on DigitalOcean
  • Dependencies are continuously monitored for known vulnerabilities using Dependabot
  • We perform manual and AI-assisted audits of our code and systems

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work to follow current industry practice and to address issues quickly when they are found.

10. Data Retention and Backups

We retain your data for as long as your account is active or as needed to provide the Service. Upon account deletion, we will remove your data from production systems within 30 days, except where retention is required by law.

Encrypted backups are rotated on a regular schedule. Data deleted from production may persist in backups for up to 90 days before being overwritten, after which it is no longer recoverable.

11. International Data Transfers

Our infrastructure is located in the United States. If you access the Service from outside the United States — including from the European Economic Area or the United Kingdom — your personal data will be transferred to and processed in the United States. Where required, we and our sub-processors rely on Standard Contractual Clauses or other lawful transfer mechanisms to protect international transfers.

12. Your Rights

You have the right to:

  • Access your personal data
  • Correct inaccurate or incomplete data
  • Request deletion of your data
  • Receive a copy of your personal data in a machine-readable format on request (the Handled Summary PDF is a human-readable summary, not a portability export — contact us for a full machine-readable export)
  • Restrict or object to certain processing
  • Withdraw consent at any time where processing is based on consent
  • Opt out of marketing communications
  • Lodge a complaint with a supervisory authority in your jurisdiction (for users in the EU/UK, this is typically your national data protection authority)

To exercise these rights, contact us at support@dadhandled.com. We will respond within the timeframes required by applicable law.

13. Children's Privacy

DadHandled is designed for adult users — typically expectant or new fathers — to organize their own preparation, tasks, and notes. The Service is not directed at children, is not intended for use by anyone under 18, and we do not knowingly allow children to create accounts.

If you choose to record information about a child (for example, milestones, sleep, or feeding) within your own account, that information is treated with the same protections as your other account data and is only shared through Partner View at your direction. If you believe a child has created an account, please contact us at support@dadhandled.com and we will remove the account.

14. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or through the Service. The "Last updated" date at the top indicates when the policy was last revised.

15. Contact Us

For questions about this Privacy Policy or our data practices, contact us at support@dadhandled.com.