Last updated: July 23, 2026
HandleWallet splits what it stores into two kinds. Your vault content (the posts, media, and captions you back up) is encrypted in your browser before it ever reaches our servers. We store ciphertext and cannot read it, not because of a policy, but because we never have the key. Everything else needed to run the service, your account email, your wallet page, your verified handles, and your subscriber list, is plain data we can read, because the service depends on reading it. This page states that boundary exactly, so you can check any specific piece of data against it.
Platform exports you back up, including posts, media files, captions, and follower snapshots. We see the encrypted bytes, their sizes, an item identifier, and a type tag (so the dashboard can show counts and freshness without decrypting anything). We do not see the content.
Recovery material. In both recovery modes, every recovery secret we store is encrypted with a key we never receive. Standard mode encrypts your recovery key with a secret computed inside your passkey (the WebAuthn PRF extension); we store the passkey's public key, which we use only to check signatures, and the ciphertext. Sovereign mode encrypts it with the kit you download, which is never sent to us. During recovery our servers verify your email link and your passkey signature, then hand back ciphertext; decryption happens in your browser. The consequence is stated in the product and repeated here: if you lose your password and your passkey or kit, no one can decrypt your vault, including us.
One exception exists for accounts created before passkey recovery: their older standard mode keeps an encrypted copy of the recovery key that our servers can decrypt during recovery, using a key held outside the database. Settings marks these accounts as legacy and offers an upgrade that moves the key into a passkey and deletes the server-decryptable copy.
We use AWS SES to send email, Google Cloud Storage to store encrypted vault blobs, and Stripe to process payments. Each only receives what it needs to do its job: SES gets the email itself, GCS gets ciphertext it cannot decrypt, Stripe gets billing and payment information directly, not routed through us.
Everything above, both the ciphertext and the plain data, is exportable in one click at any time, in an openly documented format you can decrypt and verify without HandleWallet. See what you own.
Deleting your account is permanent. It removes the ciphertext, the encryption keys, your verification attestations, and all service data (wallet page, subscriber list, billing records we control). There is no recovery afterward, which is why account deletion prompts you to export first.
We use a single session cookie to keep you logged in. We do not use third-party tracking or advertising cookies.
Contact details to be added before launch.