Privacy Policy

Last updated: September 3, 2026

The short version

Your private signing key never leaves your device. On the web it is generated in your browser; in the Android app it stays on your phone. It is never sent to, seen by, logged by, or stored on our servers, even encrypted.
We collect very little and never sell it, run ads, or use third-party tracking. We do count how often your public page and badge are served, as plain daily totals with nothing stored about who visited.
Your public profile is public on purpose. The accounts you verify and choose to show are meant to be seen and machine-read. Accounts you hide are never published.

Who we are

RealHandles ("we", "us") is operated by David V. Kimball LLC. This policy explains what we collect when you use realhandles.com, the RealHandles Android app, the browser extension, and the rest of the service, why, and your choices. Questions or requests: davidvkimball.com/contact.

What we collect

Login identity. When you sign in through our login provider (Auth0), we receive an account identifier and your email address. We use this only to know which identity you are allowed to edit. It is never used to sign your proof.
Verification data. The account handles, domains, organization or server names, and public profile URLs you choose to verify or claim; the method used, the time it was verified, the time we last tried to re-check it, and the time a platform last confirmed it; and, for organizations and servers, their public logo/icon. Where a platform issues a permanent account identifier, we keep that too, because a username can change hands and the identifier cannot.
Your public key and signed manifest. The Ed25519 public key you generate and the signed proof file it produces. Public keys are, by nature, public.
Anchor details. If you set one, the domain or gist location where you host your anchor file, and whether it currently verifies.
Technical data. Standard request information (such as IP address and browser type) processed by our hosting and login providers for security, abuse prevention, and reliability.
How often your public surfaces were served. A running count of badge loads, visits to your public profile, visits that arrived from a page outside realhandles.com, and answers we gave when a third-party site asked whether one of your accounts is verified. These are plain totals per day, described in full below.
Cookies. We use only functional cookies and local storage needed to run the service: a signed, short-lived cookie during account linking, and login-session storage set by our login provider. No advertising or cross-site tracking cookies. Because these are essential to the service, no consent banner is required, but you can clear them anytime in your browser.

What we deliberately do not collect or keep

Your private key. On the web it stays in your browser; in the Android app it stays on your phone. Your Identity Backup is stored in local storage and/or a file you download; the passphrase is yours alone. We cannot recover it, which is the point: no one but you can sign as you.
OAuth access tokens. When you link an account, we exchange the code on our server, read your account once to confirm it, and discard the token. We do not store platform access tokens.
Gravatar email. If you use the Gravatar option, your email is used in your browser to compute the avatar address and is then discarded, not stored.

Counting, and what a count is not allowed to be

Your profile page and your badge are public, and a badge you paste into a footer or a README is meant to be seen. Whether anybody actually looks is the one thing you could not previously find out, so we count four things: how often your badge image was served, how often your public profile page was served, how many of those visits arrived from a page that is not realhandles.com, and how often a third-party site asked our API whether one of your accounts is verified.

What is stored is a number, and only a number. One integer per identity, per kind of request, per day. There is no visitor identifier of any sort in it: no IP address, no cookie, no fingerprint, no session, no device or browser record, and no account. Two requests from the same reader and two requests from strangers are indistinguishable once counted, because they increment the same number and nothing else is written down.

The referring page is never stored. To tell an arrival from another site apart from a direct visit, we look at whether the browser named an origin other than ours, keep that single yes or no, and discard the address. We never record which page someone came from, which means these counts can never be assembled into a picture of who reads whom, or of anybody's browsing.

No timestamp finer than a calendar day, because per-minute counts on a profile with one reader would be that reader's activity written in a different notation.

Only you can see your numbers. They appear on your own dashboard and nowhere else. There is no public view counter, no leaderboard, and no API that reports them for anybody else's identity. Requests we refuse are not counted at all, so a hidden profile accumulates nothing. Deleting your identity deletes these counts with it.

This is first-party counting on our own servers. There is no analytics provider, no tracking script, no pixel, and no third party involved at any point. The numbers are also incomplete by design and will under-report: caches and the image proxies used by sites like GitHub serve your badge without ever telling us.

The Android app

RealHandles for Android offers the same identity on your phone: verify accounts, sign your manifest, rotate keys, recover, and hide your profile. Your signing key stays on the device and is never sent to us. The app is in closed testing on Google Play today; a public listing will use the same Play Store URL when it opens.

If you are a tester, you install through Google Play under the package name com.realhandles. The app uses the same login as the website, talks to the same APIs, and stores your key only in the app's private storage on your phone. We do not run advertising or analytics inside the app.

The app may ask for the camera when you scan an Identity Backup QR code. Frames are decoded on-device and are not stored or uploaded. Your profile photo is a URL you choose, not an image file we host.

The browser extension

The RealHandles extension for Chrome and Firefox tells you whether the profile or site you are looking at belongs to a verified RealHandles identity. It collects nothing. There is no account, no sign-in, no analytics, no telemetry, no advertising, and no tracking. You do not need a RealHandles identity to use it.

The address of the page you are on is never transmitted. The obvious way to build this would be to ask a server "do you know this profile?" on every page, which would be a browsing-history collector in a privacy product's clothing. Instead the extension downloads a copy of the public directory and matches on your device. On the overwhelming majority of pages there is no match and nothing leaves your computer at all.

The extension can reach exactly one origin, realhandles.com, and only for data that is already public and that anybody can fetch without it:

The directory index, once every 24 hours on a timer, and whenever you press "Refresh now" in the popup. The file is byte-identical for every user, so it reveals nothing about you. The timer runs on a clock rather than on a page visit deliberately: a download timed to a page visit would leak when you looked at something worth looking up, even though the bytes are the same for everyone. The button is the only request in the extension you can cause directly; everything else is either that daily timer or a fetch that follows a local match.
One identity's published signed manifest, only after a local match, so the extension can check the signature itself rather than take our word for it. This reveals to our server that somebody asked for a public profile, the same as loading that profile page does.
That identity's signed history, in the rarer case where its signing key has changed since the local copy was built. Same public data, same disclosure as the line above.

Those requests carry no page URL, no page title, no page contents, and no user identifier. Nothing about your browsing is written to disk: verified manifests are cached in memory for the session and are gone when the browser closes. Your browsing history, bookmarks, and saved passwords are never read.

The extension asks for three permissions and nothing else: the active tab's address, so it knows what you are looking at; local storage, to keep the downloaded directory copy; and alarms, to run that download on a timer instead of on a page visit.

There is no content script, so nothing is ever written into any website you visit. That is a security decision as much as a privacy one: a badge drawn inside a stranger's page is a badge that stranger could imitate with their own styling, so the verdict lives in the toolbar icon and the popup, which the browser draws from the extension's own package and no page can touch, read, or fake.

What is public

Your public profile page and its signed manifest are intentionally public and machine-readable (both as HTML and as JSON, plus structured data for search engines and AI agents). This includes your username, display name, avatar, key identifier, decentralized identifier, anchor, and the accounts you have chosen to show. Accounts you mark hidden are excluded from the published manifest and do not appear anywhere public.

Display names, avatar URLs, notes, and account links are submitted by you. We do not host uploaded image files for avatars; if you point an avatar at an external URL, that image is fetched from wherever you pointed it. Content rules for what may appear on a profile are in the Terms of Service.

Who we share data with

We do not sell your data. We use a small set of service providers to run RealHandles:

Auth0 (login/authentication).
Netlify (hosting and serverless functions).
Turso (database / directory cache).

When you verify or import an account, we make a request to that platform (for example GitHub, Instagram, X, or your own domain) on your behalf to read the public proof. Those platforms handle that request under their own privacy policies. We may also disclose information if required by law.

We also re-check some verifications on a schedule, without you asking, and it is worth saying exactly what that is. For accounts where the platform issued a permanent identifier and answers a public lookup by it (today GitHub, Bluesky and Twitch), a daily job asks that platform what the account is called now, so a username that has changed hands stops being shown as verified. Nothing about you is sent: the request contains the account identifier the platform itself gave us, no token of yours, and no information about your RealHandles identity. One of those platforms requires us to identify our own application, so that request carries a credential belonging to RealHandles. It is never yours, and it is minted for the run rather than stored. We also re-check any anchor file you host, because an anchor is meant to stay published.

Your rights and choices

Access and portability. Export everything we hold about you as JSON from your dashboard at any time.
Correction. Edit your profile, remove accounts, or hide them from your dashboard.
Deletion. Delete your identity yourself from your dashboard or the Android app (including closed-testing builds), or, if you have lost your signing key and so cannot sign the deletion, request it. Both routes, and exactly what each one removes, are on Delete your account. Note that your signed manifest is portable by design: any copy you or others have hosted elsewhere, or that third parties have cached, is outside our control and cannot be recalled by us.
Depending on where you live (for example the EU/UK under GDPR, or California under CCPA/CPRA), you may have additional rights to access, delete, correct, or port your data, and to object to certain processing. We do not sell personal information. To exercise any right, contact us.

Retention

We keep your data while your identity is active and for as long as needed to operate the service and meet legal obligations. When you delete your identity, we remove it from our database and directory, and we delete the login account itself at our authentication provider, which is what holds your email address. Copies of your signed manifest hosted outside RealHandles remain wherever they were placed. See Delete your account for how to start one.

Security

The design keeps the one thing that matters most, your signing key, out of our hands entirely. We use reputable providers and standard safeguards for the rest. No online service is perfectly secure, so we cannot guarantee absolute security. To report a vulnerability, see our security.txt.

Children

RealHandles is not directed to children under 13 (or under 16 where a higher age applies), and we do not knowingly collect their data.

International users

Our providers may process and store data in the United States and other countries. By using RealHandles you understand your data may be handled in locations with different data-protection laws than your own.

Changes

We may update this policy. Material changes will be reflected by the date above. Continued use after an update means you accept the revised policy.