Privacy Policy

Effective November 10, 2026

Handgrown is operated by Clueless Creations LLC ("Handgrown," "we," "us"). Consumer-product brands use Handgrown to run brand ambassador programs: inviting ambassadors, scheduling in-store demos and recording what happens at each demo. This policy explains how we handle personal information through handgrown.app, app.handgrown.app, brand workspaces such as hol.handgrown.app, the Handgrown mobile app, and our emails (together, the "Service").

California and other state residents: see State privacy rights for your rights and how to use them.

Brands and Handgrown

A brand that runs its program on Handgrown decides what program information is collected and how it's used. We process that information on the brand's behalf, as its service provider, and the brand's own privacy notice also applies. If you're an ambassador or an applicant for a brand's program, you can contact the brand or us. We'll help, or pass your request to the brand.

Personal information we collect

Information you or a brand give us

• Account and contact data: your name if you choose to add it, your email address, the brands you belong to and your role. Our authentication provider stores your password as a secure hash. We never see it in plain text.
• Applications: if you apply to a brand's program, your answers to its application questions and your email address.
• Program and work data:
  • shifts offered, claimed and accepted, including the version of the terms you accepted
  • check-in and check-out times
  • product counts you record
  • notes, event reports and survey answers
  • expense claims: the merchant, purchase date, items, amounts, and reimbursement you request
  • photos you take for an event report or expense claim, including receipt photos. We store them privately, and the brand whose program they relate to can see them. The app removes location and other metadata from each photo on your device before it uploads.
  • Recognition: if your brand turns on recognition, the number of demos you finish each month and the milestones you reach. A demo counts when you did it and your report arrived and, for a store demo, the store confirmed it. If the brand leaves a demo out, we keep the reason it gave. We also keep your choice about showing your name, one for each brand.
  • Community posts: the posts, comments, reactions and photos you add to your brand's community space, and any report or block you make.
• Communications: messages you exchange with your brand's program team in the app, and support requests you send us. Your messages with the brand are private to you and its authorized staff.
• Information about others: brands may add store and retailer contact details, and may invite teammates or ambassadors by email. Please share someone's contact details only if you're allowed to.
• Launch list: if you join our launch list on handgrown.app, your email address, your website and the consent text you saw.

Information collected automatically

• Precise location: only when you check in or out of an event, and only with your device's permission. Handgrown stores the location with that check-in or check-out to confirm attendance. The brand sees only whether a location was recorded, not the location itself. We don't track your location in the background.
• Device and network data: an identifier the app creates so your work can sync after you've been offline. We also receive your IP address and the user agent your device sends, which can name the app or browser and the operating system. We use your IP address to limit abusive traffic. Our authentication provider keeps your IP address and user agent with your sign-in session.
• Usage data: our server can record a short list of operational events, such as an offer being accepted, a count being recorded or an error. Each event carries one fixed label for our server, not an identifier for you. At most it adds a one-way code for the action or the type of error. It doesn't include your email address, account ID or location. We use these events to run and improve the Service.
• Service diagnostics: our server records the request's route, status, response time and a request identifier. We also record operational errors with the error type, limited code locations, time, release and a code for the request. These error reports exclude your name, email, account ID, request contents and precise location. We use these diagnostics to keep the Service available and resolve faults.

Sources

We collect this information from you, from the brand whose program you're part of, and from our service providers.

How we use personal information

• To provide the Service: accounts, invitations, scheduling, event capture and reports, messages with your brand, expense claims, and a record of the pay terms you accept.
• To confirm attendance and keep an accurate record of work, including corrections.
• To communicate with you: service emails, invitations and support.
• To keep the Service secure and to prevent fraud and misuse.
• To understand and improve the Service.
• To comply with law and to protect rights and safety.

We don't sell personal information, and we don't use it for targeted advertising.

Cookies and similar technologies

We use only the storage needed to keep you signed in and to make the Service work, such as session storage in your browser and on your device. handgrown.app doesn't use advertising cookies or third-party analytics cookies.

How we share personal information

• With the brand whose program you're part of. The brand sees the name you add, your work records, reports, messages with its team, expense claims, receipt photos and pay information for its own program. A brand can't see your information from another brand's program.
• With a brand's own systems, at the brand's direction. If you apply to a brand's program, the brand can have Handgrown send your application, including your answers and email address, to a system the brand chooses. The brand's own privacy notice covers that copy.
• With other ambassadors in your brand, only through features your brand turns on.
  • Recognition: other ambassadors see the team's total of finished demos. They see your first name and city next to a milestone you reached, or in a monthly list of the five people with the most finished demos, only if you turned on "Show my first name and city when I reach a milestone or a top place". It is off until you choose. The number that goes with a milestone or a place, such as "10 demos" or "8 demos", shows beside your name. Other ambassadors never see your pay or where you checked in, and they see no count of yours at any other time. Your brand's staff can post a monthly recap as a Team update. It names only people who had turned on showing their name when it was written, and it stays posted until the brand withdraws it. The brand's staff can see each person's counts, milestones and whether they chose to show their name, because they run the program.
  • Community space: your posts, comments, reactions and photos show to the brand's ambassadors and staff with your first name and city. The brand's staff can hold or remove a post. A report you make goes to the brand's staff.
  • When you leave a brand's program, your name and city stop showing on its lists, posts and comments right away. The demos you finished stay in the team's totals.
• With service providers that help us run the Service, under contract:
  • hosting and databases: Supabase, Google Cloud and Cloudflare
  • server error reporting: Sentry receives the limited operational error reports described under Service diagnostics.
  • email delivery: Postmark
  • AI assistance: Vercel AI Gateway and Baseten process requests to generate summaries and drafts.
  • operational events from our server: PostHog, when enabled. It receives only the events described under Usage data.
  • web analytics on app.handgrown.app and hol.handgrown.app: Cloudflare Web Analytics. It receives the page address, the referring page, your browser, operating system and device type, your approximate country, and how fast the page loaded. It uses no cookies.
  • maps in the brand console: OpenFreeMap. It receives your IP address and the map area you view.
  • email you send to privacy@, support@ or legal@handgrown.app: Cloudflare Email Routing forwards it to an inbox hosted by Google.
  • app distribution: Apple (App Store and TestFlight) and Google (Google Play)
• With professional advisers, such as lawyers and accountants.
• With authorities or others when the law requires it, or when needed to protect rights and safety.
• In a business transfer, such as a merger, financing or sale of assets, subject to this policy.

Retention

We keep personal information while your account is active and for as long as the brand's program needs it. That includes finishing shifts, reports and corrections after someone leaves a program. We haven't set a retention period yet, and we don't yet delete or de-identify program information automatically. You can ask us to delete your information at any time (see Your choices). We act on deletion requests within 30 days. Records that must stay open, such as unresolved pay or report corrections, are kept until they are resolved. We delete launch-list entries after 180 days.

Recognition records follow the same retention as the work records they come from.

When we delete your account, we redact our own copy of your application. A copy a brand already received in its own systems is the brand's to delete, so ask the brand as well.

Your choices

• Account information: you can review and update some of it in the app or console.
• Location: you can turn off location access in your device settings. Check-ins will then be recorded without a location.
• Showing your name: open This month in the app and turn "Show my first name and city when I reach a milestone or a top place" on or off. Turning it off removes your name from those lists right away. A Team update your brand already posted or saved as a draft stays until the brand changes or withdraws it.
• Emails: service emails, such as invitations and security notices, are part of the Service. We don't send marketing email to ambassadors.
• Requests: email privacy@handgrown.app to access, correct or get a copy of your information, or to ask us to delete it. Our team handles each request. The app and console can't delete an account on their own yet.

Security

We use technical and organizational safeguards designed to protect personal information. They include encryption in transit, access controls that keep each brand's data separate, and restricted production access. No system is perfectly secure, so we can't guarantee security.

Children

The Service is for people 18 and older. If you believe someone under 18 has given us personal information, email privacy@handgrown.app. We'll close the account and handle it as a deletion request (see Retention).

Where we process information

We're based in the United States and process information in the United States.

Changes to this policy

If we make material changes, we'll update the effective date and let you know through the Service or by email.

State privacy rights

Depending on where you live, including California, Colorado, Connecticut, Virginia, Texas and other states with privacy laws, you may have the right to:

• know what personal information we collect, use and disclose
• access it
• correct it
• delete it
• get a portable copy
• appeal our decision on your request

We don't sell or share personal information for cross-context behavioral advertising. We don't process it for targeted advertising, and we don't use it for profiling that produces legal or similarly significant effects.

Precise location counts as sensitive personal information under some state laws. We use it only to confirm attendance, and not to infer characteristics about you. We don't knowingly collect personal information from anyone under 16.

To make a request, email privacy@handgrown.app from the address on your account. We'll verify the request by confirming you control that email address. An authorized agent can make a request for you with your written permission. We may need to confirm that permission with you. If we deny your request, reply to our response to appeal. We won't discriminate against you for using these rights.

If your information is part of a brand's program, we may pass your request to the brand, because the brand controls that information.

California "Shine the Light": we don't disclose personal information to third parties for their own direct marketing.

Contact us

Privacy questions and requests: privacy@handgrown.app. Help with the app: support@handgrown.app.