Privacy Policy

Handlus connects AI agents to your Chrome so they can operate it. This page explains what information the Handlus website (handlus.com), the relay server (api.handlus.com) and the Handlus Chrome extension collect, and what it is used for.

Effective October 26, 2026

Who runs Handlus

Handlus is run by 이화 STRING (representative MISEON PYO, Korean business registration 226-04-37766). Send privacy questions and deletion requests to support@handlus.com.

What we collect

When you sign in with Google: Your Google account email, name and unique Google account ID. They are updated to the latest values each time you sign in. Your profile photo is not stored on the server.
When you connect a Chrome: The name you give that Chrome, the extension version, the Google email signed in to that Chrome profile, how it was connected (Sign in with Google, Verify your account email or a connection key), a device ID created by the extension, and when it was connected and last online. When a new Chrome connects to your account, we email you its name, profile email, connection method and time.
When you connect by verifying your account email: Available from extension 0.3.1. If the email you enter is the one you signed up to Handlus with, we send a 6-digit code to it. The server keeps only the email address and a hash of the code, for 10 minutes, and deletes them once the code is used or expires. If the email is not signed up, we send nothing and store nothing. To limit how often codes are sent, the email address stays in server memory for up to 1 hour. It is not written to disk or to the access logs.
Install source: Whether the extension was installed from the Chrome Web Store or from a file. It is sent when you connect a Chrome and used to show update instructions that match how you installed it.
When you connect an agent: The name the agent app registered for itself, the address it returns to, and when it was connected and last used.
When you contact support: What you write in the dashboard Contact form, the images you attach, your account email, the page you were on, your browser name and how many Chromes you have connected go by email to support@handlus.com (sent through Resend). Handlus servers do not keep them; the support mailbox keeps them so we can reply.
When you pay for a paid plan (Pro or Enterprise): You pay on the Polar checkout page. Polar receives your card and billing address, and they do not pass through Handlus servers. Our server stores only the Polar subscription and customer IDs, the product you paid for (which plan), the subscription status, the next renewal date, whether the subscription is set to cancel, the free trial end date and whether you have used a free trial. It also stores which browsers you picked to receive tools within the limit of your plan.
Keys: Agent tokens, device tokens and authorization codes are stored only as hashes, never in their original form. The connection key is stored encrypted so the dashboard can show it to you again, and the key that decrypts it is kept in the server settings, separate from the database. Issuing a new key overwrites it.
Access logs: For every request, the relay server logs the IP address, the requested address including any query string, the time, the response status, size and duration, and the request and response headers, such as User-Agent, Referer and Accept-Language. The values of the Authorization header and cookies are not logged. When a Chrome connects or disconnects, it logs the account ID and device ID. When an agent calls a tool, it logs the tool name, whether the call succeeded, how long it took, and the account ID and device ID.
Usage count: To show “In the last 7 days, agents worked in your Chrome N times” in the dashboard, we count successful tool calls per account per day. Only the number is kept, not the tool name, its arguments, its result or the addresses visited. Counts for days older than 14 days are deleted.
Handlus Updater: The updater sends nothing. It only downloads a version file and install files. On a computer with auto-update turned on, it downloads the version file from handlus.com every 6 hours and, when there is a new version, the files from cdn.handlus.com. Each download leaves the IP address and User-Agent in the access logs of Vercel and Cloudflare.

When an agent calls a tool

The results an agent asks for travel from your Chrome through the Handlus relay server to the agent you connected. They include page text and addresses, screenshots and the preview card (page title, address, site icon and a small thumbnail). When the agent asks for them, they also include the titles and addresses of your open tabs, your browsing history, bookmarks, network requests and their contents, console messages, the results of scripts the agent runs on a page, performance trace summaries, and the names, source addresses and locations on your computer of downloaded files, including the GIF recordings and performance traces the extension saves.

The relay server only passes this content along. It does not store or log it. The only things logged are the items listed under “Access logs” above.
You can turn off the preview card with “Send previews to the agent” under Settings → Privacy in the dashboard. It is an account setting, so it applies to every connected Chrome, and once it is off the server does not pass previews to your agent. It is on by default.
“Recent activity” in the popup stays inside your Chrome and is cleared when you close Chrome.
When an agent lists your Chromes, it receives each Chrome's name, profile email, extension version and when it was last online. If the agent adds a hint, it also receives the number of open tabs in each connected Chrome and up to five of the most common site domains among them.

What the extension connects to directly

The Handlus relay server (api.handlus.com). Tool calls travel over an encrypted WebSocket (wss://api.handlus.com/ws), “Sign in with Google” trades a one-time code for a connection token there, and “Verify your account email” sends the email and code you enter to it.
Sign-in pages. “Sign in with Google” opens a window that goes from api.handlus.com to handlus.com and, if you are not signed in yet, to Google sign-in. Once you are connected, the setup page opens handlus.com/start with this Chrome's name in the address.
Site icons (favicons) for previews. They are fetched from each site without cookies.
Addresses the agent tells it to use (http and https only). For example, the file upload and network request tools connect to wherever the agent specifies. From extension 0.3.9, it never opens or reads files on your computer (file://) or browser and extension pages, and file upload uses only content the agent sends or a web address.
Your own computer (127.0.0.1), only in extension 0.3.0 and earlier and only if you open the quick panel (Ctrl/Cmd+Shift+U) or the web editor (Ctrl/Cmd+Shift+O or the right-click menu). These leftover features look for a local program that Handlus does not install, so nothing leaves your computer.

Other than these, there is no feature that sends usage statistics. If you installed the extension from the Chrome Web Store, Chrome itself checks the store for updates, as it does for every extension.

Cookies

We use an encrypted cookie that keeps you signed in for 30 days (the 30 days start over when you open the home page while signed in), a cookie that remembers whether you finished onboarding (1 year) and a cookie that remembers the language you pick with the language switcher (1 year). When you open the home page or sign in, the sign-in system also sets security cookies. Two of them are deleted when you close your browser, and the ones used during Google sign-in expire after 15 minutes. There are no advertising or tracking cookies.

Retention and deletion

In the dashboard you can unlink a Chrome, issue a new connection key and disconnect an agent. Unlinking and disconnecting block access, but records such as the Chrome name and profile email remain.
You can delete your account and all its records (connected Chromes, agent approvals and tokens, connection key, subscription records, usage counts) yourself under Settings → Account → Delete account in the dashboard. Cancel any paid subscription first. You can also ask at support@handlus.com and we will delete them.
The server is backed up every day and backups are kept for 7 days. One copy of each backup is also kept at Backblaze (United States) and deleted within 7 days. Deleted information can remain in backups for up to 7 days. Backups are encrypted, and the key that opens them is not kept on the server or at Backblaze. Email connection codes are left out of backups.
Access logs are deleted within 30 days, and usage counts after 14 days.
Subscription records (the fields listed above) are kept while your account exists. Polar keeps payment and refund records for as long as the law requires.

Security

We completed a security review on October 21, 2026. This is how we protect your data.

All connections between the website, the relay server and the extension are encrypted with HTTPS and WSS.
Agent tokens, device tokens and authorization codes are stored only as hashes, so the database does not reveal them.
Connection keys are stored encrypted with AES-256-GCM. The decryption key is kept in the server configuration, separate from the database, and each ciphertext is bound to its account so it cannot be opened from another account’s row.
Daily backups are locked with a public key. The key that opens them is not kept on the server, the backup folder is readable only by an administrator, and email connection codes are left out of backups.
A copy of each locked backup is also kept off-site at Backblaze. The server holds only an upload-only key, so even a compromised server cannot read or delete earlier copies. Copies cannot be deleted for 5 days and are removed within 7 days.
When a new Chrome connects to your account, we email you right away. If you don’t recognize it, disconnect it in the dashboard and reissue your connection key.
The dashboard shows your connection key masked, and fetches the full key only when you press Show or Copy.
Deleted information is overwritten so it does not remain in the database’s free space.
Tool calls only reach the Chromes connected to that account. The relay passes page content, screenshots and the values you type straight through and never stores or logs them.
Access logs never keep Authorization header or cookie values, the internal service secret, or payment webhook signatures.
Card details go only to the Polar checkout and never pass through Handlus servers. Payment notifications are accepted only with a valid signature.
cdn.handlus.com serves only extension files uploaded to the Handlus bucket.
The extension does not change site settings in bulk (from 0.3.9). Camera, microphone and location are asked once per site, and you can remove allowed sites under Site permissions in the extension popup.
Before a Chrome connects with a connection key, it shows the account that key belongs to (with the email partly hidden), so a key someone else gives you cannot quietly attach your Chrome to their account.

Limited Use

Handlus's use and transfer of information received through its Chrome extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Changes to this policy

If this policy changes, we will announce it on this page and in the extension.