Privacy notice

Last updated 18 October 2026

This notice explains what we do with the details you give us when you join the HandShake waitlist at handshake.fit. HandShake is operated by Morpheus Capital LLC, a company registered in Delaware, USA ("we" and "us").

It also explains, further down, what the HandShake app at app.handshake.fit does with the information of the people who use it, and of the people they work with.

The short version: we use your details to keep your place on the waitlist, to contact you about HandShake, and for nothing else. We never sell them.

What we collect

• What you type in: your name, email address and organisation.
• Your answers: what caught your interest, what you'd use HandShake for, and how you heard about us.
• Your place on the list: when you joined and your waitlist number.
• To keep out junk sign-ups: a scrambled (hashed) form of your IP address, never the address itself, your browser type, which page you joined from, and how many times you've signed up.
• Basic visit information: our hosting provider automatically records things like your IP address and browser type when you visit, to keep the site secure and running.

This website sets no cookies, and we don't use analytics or advertising tools on it. Its fonts come from Google Fonts, so your browser contacts Google when a page loads. [CONFIRM: true as built on 18 October 2026. If analytics or tracking are ever added, name them here.]

How we use it

• To keep your place on the waitlist and get in touch when it's your turn, including inviting you to a presentation of HandShake.
• To send you occasional updates about HandShake. Every update includes a way to stop receiving them.
• To understand who is interested and why. We may share overall figures, such as how many people have joined, with our investors. We never share anything that identifies you.
• To tell our team when someone joins: each sign-up sends our team a Slack message with your name, email, organisation and answers.

We don't sell your details, and we don't use them for advertising. Joining doesn't send you an email.

We may contact you using HandShake itself

HandShake is a tool for personal outreach, and we use it ourselves. So when we write to you, we may use HandShake to do it. That can include looking at publicly available information about you and your organisation, such as your company's website or your public professional profile, so that what we send is relevant to you. If you'd rather we didn't, tell us and we'll stop.

Who else handles your details

We use a small number of service providers. They handle your details only on our instructions, and only to provide their service to us:

• Google Cloud, which stores the waitlist in HandShake's own database (Cloud SQL), in the United States. [CONFIRM: changed from "Supabase". The deploy settings point at a Cloud SQL instance in us-east1 (South Carolina), while the app itself runs in us-central1 (Iowa). Confirm the region before naming it.]
• Google Cloud Run, which hosts this website. [CONFIRM: changed from "Vercel". The site is served by the same Google Cloud Run service as the app, in us-central1.]
• Google, for our email and cloud services, and for the fonts this site uses.
• Slack, which carries the message our team gets when you join.
• The AI services HandShake uses to research and write messages, if we contact you through HandShake.

Where your details are stored

In the United States. If you live elsewhere, your details are transferred to the United States when you join. [CONFIRM: the legal basis for transfers from the UK and EU, for example Standard Contractual Clauses.]

How long we keep them

Until you ask us to remove them, or 24 months after we were last in touch with you, whichever comes first. [CONFIRM: nothing deletes waitlist entries automatically yet. Entries are removed by hand in Admin → Waitlist.]

The HandShake app

HandShake is invite-only while it's in early access. This part is for the people who use the app at app.handshake.fit (our "users") and the companies they work for (a "workspace"). It explains what the app does with users' information and with the information about the people users work with (their "contacts").

A workspace decides which contacts it keeps in HandShake and what it does with them. For that information we act on the workspace's behalf. [CONFIRM: that the customer is the controller and we are the processor for contact data, and whether a data processing agreement will be offered.]

Signing in

You sign in with your Google account. HandShake receives your name, email address and profile picture, and nothing else from that step. A cookie keeps you signed in for up to 30 days.

Your email (Gmail)

When you connect your email, you give HandShake permission to read your Gmail and to create drafts in it.

• HandShake never sends email. It only creates drafts in your Gmail, and you press Send yourself. The permission Google calls "compose" would technically allow sending, but HandShake's code only ever creates drafts.
• To find your conversations with contacts, HandShake looks at who sent and received each message in your mailbox. It keeps the content only of emails with contacts in your active contact groups, going back up to 12 months the first time. Everything else is skipped and not kept, apart from a message ID so it isn't looked at twice.
• Attachments are read only when they carry the email's own text, and files are never kept.

Your calendar

The same connection lets HandShake read, but never change, your Google Calendar. It looks at your main calendar from a week ago to two weeks ahead, and keeps only meetings that include one of your contacts: the time, title, place or meeting link, who from your contacts is invited, and whether it's going ahead.

Google Drive

Connecting Google Drive is optional and separate. It lets HandShake list your files so you can pick one, and read the file you pick, to add it to your sales materials or to a research upload. HandShake keeps the file's link and its text. Disconnecting Drive deletes HandShake's access and withdraws it with Google.

Google API data

HandShake's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. [CONFIRM: wording Google expects for its OAuth verification. Check it is accurate for every Google permission before publishing.]

Texts, iMessage and LinkedIn

• The HandShake Chrome extension reads Google Messages texts and LinkedIn messages, only in one-to-one conversations with your contacts. It skips group chats and attachments. It reads LinkedIn through your own signed-in LinkedIn session in your browser and never stores your LinkedIn password or cookies. When you click "Add to HandShake", it reads what's on that screen: a person's name, title, company, profile link, and the email or phone number they share.
• The HandShake Mac helper, with your permission, reads the Messages app on your Mac, read-only, for one-to-one iMessage and text conversations with your contacts, going back up to 12 months. It skips attachments.
• Neither of them ever sends a message.

Contacts, deals and research

HandShake keeps the contacts, organisations, deals, notes, updates, actions and documents that your team adds or imports. It also researches contacts and their organisations from public sources, such as web searches, company websites and public professional profiles, and keeps what it finds with links to the sources.

AI processing

To read replies, research contacts, plan accounts and write drafts, HandShake sends the information each job needs to AI models. That can include message text, contact and research details, your notes and your company's documents. Requests go through OpenRouter, a service that passes them to the company that runs the model. The models HandShake offers come from OpenAI, Anthropic, Google, DeepSeek, Meta and Xiaomi. Which one handles a request depends on the job and your workspace's settings, and OpenRouter may pass a request to another host of the same model if the first one is busy.

Voice notes are turned into text by a speech model through OpenRouter. HandShake keeps the text, not the recording.

We don't use your data to train AI models. [CONFIRM: HandShake doesn't yet ask OpenRouter to use only providers that keep no data or don't train on it. Check OpenRouter's and each provider's data terms, or switch on OpenRouter's data-policy settings, before promising that the providers don't keep or learn from it.]

AI can get things wrong. HandShake checks every draft before you see it, and nothing goes out until a person sends it.

Tracked document links

Users can share decks, documents and videos on personal links. When someone opens one, HandShake records for the user's team:

• when it was opened, how long it was open, the time spent on each page or slide, and how much of a video was watched
• the type of device, operating system and browser, worked out from what the browser sends (the raw details aren't kept)
• the approximate city and country, from Google's network
• a random ID kept in the visitor's browser storage (not a cookie), so a return visit is recognised

HandShake doesn't keep the visitor's IP address. It uses it only to recognise the team's own views of their links (by comparing it with scrambled, hashed forms of the addresses team members used in the last 30 days) and to slow down too many requests. Visits by bots and link scanners aren't counted as views. If the browser sends a Global Privacy Control or Do Not Track signal, HandShake records only that the link was opened. Videos play through YouTube's privacy-enhanced mode (youtube-nocookie.com).

Slack

If a workspace connects Slack, HandShake sends its team members direct messages: a morning summary, an alert when a customer replies or opens a document, and similar notices. These can include contacts' names and short extracts of messages. Team members are matched to Slack by their email address.

Who can see it

Only your team, and only the contact groups the workspace owner gives each person. The owner sees everyone's activity, and each person sees their own numbers. We look at a workspace's information only to run, support and secure HandShake, or when the law requires it. [CONFIRM: who at Morpheus Capital LLC can access customer data, and when.]

Cookies in the app

The app uses one cookie, to keep you signed in, and your browser's storage for your sign-in and your screen preferences. It uses no analytics or advertising tools.

How long app data is kept

• While a workspace uses HandShake, its information is kept until the workspace deletes it.
• When a contact is taken out of every contact group, everything HandShake holds about them is deleted: messages, drafts, research, notes, updates, actions, meetings and document visits. Their basic record (name, email and organisation) stays.
• An organisation with nobody left in any group is removed, with its deals, notes and research.
• When a workspace owner removes a user, that user's sign-in, email connection and synced email are deleted.
• Notifications in the app are kept for 60 days.

[CONFIRM: how long Google Cloud keeps database backups, and how a workspace or user asks for all of their data to be deleted. There is no self-service account deletion yet.]

Keeping it safe

HandShake runs on Google Cloud. Connections to it are encrypted, and Google Cloud encrypts the data it stores. The access you give HandShake to your Google account, and a workspace's Slack connection, are kept in HandShake's database and never shown back in the app. [CONFIRM: HandShake doesn't add its own encryption to these stored access keys on top of Google Cloud's. Consider adding it before opening to customers.]

Service providers for the app

• Google Cloud: hosting (Cloud Run), the database (Cloud SQL) and the network in front of them, in the United States.
• Google: sign-in, Gmail, Google Calendar and Google Drive, and fonts.
• OpenRouter and the AI model companies behind it: OpenAI, Anthropic, Google, DeepSeek (through its host GMICloud), Meta and Xiaomi.
• Slack: notifications to the team.
• Tavily, SearchAPI.io and Brave Search: web searches for research.
• YouTube: videos shared on tracked links.

[CONFIRM: this list against the contracts in place, and keep it up to date.]

Your choices and rights

You can ask us at any time to:

• send you a copy of the details we hold about you
• correct anything that's wrong
• delete your details and take you off the waitlist
• stop sending you updates
• stop using HandShake to research you

App users can disconnect Google Drive in Settings, and can withdraw HandShake's access to their Google account at any time in their Google account settings. If you're a contact of one of our users, the user decides what HandShake keeps about you: you can ask them, or ask us and we'll pass your request on.

Email privacy@handshake.fit and we'll reply within 30 days. Depending on where you live, you may also have the right to complain to your local data protection authority.

Age

HandShake isn't intended for anyone under 18, and we don't knowingly collect details from anyone under 18.

Changes to this notice

If we change this notice, we'll update the date at the top. If a change affects how we use details we already hold, we'll email you first.

Contact us

Morpheus Capital LLC, Delaware, USA
[contact address]
privacy@handshake.fit