Privacy

Last updated: 17 August 2026

handwritten.blog is run by Emile Silvis in the Netherlands. This page describes what the service actually handles, why it is needed, where it goes, and the controls available to you. Questions or privacy requests can be sent to hello@handwritten.blog.

What we collect

• Account and security data: your email address, a one-way password hash, email-verification state, announcement preference and its last-change time. Signed-in sessions record an IP address and user agent so the service can authenticate requests and protect accounts.
• Product-update subscriptions: if you subscribe without an account, we store the email address, where consent was given, when the confirmation request was sent and confirmed, and whether and when the address unsubscribed.
• Your blog: its address, title, description and optional custom domain; posts and pages; transcripts; original image or PDF uploads and derived display images; handwritten-link rectangles and destinations; publishing state; and the optional Fresh pages featuring preference.
• Email: addresses, message content, attachments and delivery metadata needed to send account mail and announcements you choose, or to receive post-by-email messages and handwritten comments. A comment stores the sender address privately, the normalized handwritten image, optional email-body transcript, confirmation and moderation state. Only an approved image and transcript appear publicly; the sender address never does. The application keeps a Resend message ID and processing result for inbound mail so a retried webhook cannot publish the same message twice.
• Service operation: request paths, times, IP addresses, browser or device information and error details may appear in hosting logs. Custom-domain setup also stores DNS and certificate state.
• Optional local reMarkable uploader: if you link the community package, we store a one-way digest of its upload-only token, its name and identifier, notebook UUIDs and revision hashes, and upload, conversion, and revocation state. We transiently process the complete native contents of each notebook you explicitly send, then discard that native archive after the request. Its rendered PDF and derived page images follow the same storage rules as other draft uploads. We never receive your reMarkable Cloud credentials.

Marketing-page analytics and ad measurement

Public pages on the main handwritten.blog marketing site use Umami Cloud to count page views and understand which public pages are useful. Umami receives the page URL and title, referrer, browser, operating system, device type and approximate country. Its tracker does not use cookies, collect form contents or store personally identifying analytics data.

Umami does not run on registration, sign-in, password, dashboard, admin or webhook pages; on any author's blog or custom domain; inside RSS; or in a downloaded blog export. It is not used to build advertising profiles or a personalized or algorithmically ranked feed.

Visitors who arrive through a paid Reddit link are asked whether they want to allow Reddit ad measurement. If you allow it, the Reddit Pixel runs on public apex marketing pages and sends a page-visit event, the current page URL and technical identifiers available to the pixel so Reddit can attribute the visit to an ad. We do not give the pixel an account email, form contents or handwritten content. If you decline, the Reddit script is not loaded. It never runs on registration, sign-in, password, dashboard, admin, author-blog or custom-domain pages.

Why we use it

We use this data to create and secure accounts, host and publish the blog you ask us to publish, deliver requested email, provide exports, configure custom domains, operate and troubleshoot the service, prevent duplicate or abusive requests, confirm comment senders, give authors a private moderation inbox, understand aggregate use of the public marketing pages, and measure paid campaigns when a marketing-page visitor chooses that measurement. We do not sell personal data or place advertising on author blogs.

Processors

• Fly.io hosts the Rails application, SQLite databases, background jobs, operational logs, volume snapshots and custom-domain certificates.
• Tigris, provisioned through Fly.io, stores page images, generated display variants and blog-export ZIP files in S3-compatible object storage.
• Resend sends application and announcement email and receives mail addressed to handwritten.blog, including post-by-email messages and attachments.
• Umami Cloud processes the anonymous, cookie-free marketing-page analytics described above.
• Reddit processes optional marketing-page visit events for ad attribution only after the visitor allows Reddit ad measurement.
• Honeybadger receives production exception messages, backtraces and limited framework context so operational failures can be diagnosed. Request URLs and data, sessions, browser headers, user context and background-job arguments are removed before reporting.

These providers process data only where their part of the service requires it. Email may also reach the provider chosen by the sender or recipient.

Retention and deletion

• Account and blog records stay while the account exists. Signing out deletes that session; a password reset deletes every existing session.
• A standalone product-update subscription remains so we can deliver the email requested, honour an unsubscribe, and retain the consent record. You can unsubscribe from every announcement without an account or ask us to delete the record.
• Deleting a blog removes its posts, pages, links, comments and attached images. Deleting the account removes the account, sessions, blog and its content. Storage deletion runs in the background, and deleted database records can remain briefly in Fly.io's rolling volume snapshots, whose current default retention is five days.
• Unconfirmed and unreviewed comments expire after 30 days. Rejecting a comment queues its image for deletion; the minimal moderation record and private sender address remain until the blog is deleted so rate limits and the inbound-mail ledger remain useful.
• Original uploads that back current sheets remain with those sheets so the portable export can include them. Failed uploads are kept for up to 30 days so you can retry; unattached uploads left by an interrupted request are eligible for cleanup after one day.
• A generated blog export has a download link for 24 hours. The ZIP and its request record remain attached to the account until the account is deleted; deleting only the source blog does not delete an already generated export.
• The minimal inbound-email delivery ledger (Resend message ID and result) and a custom-domain hostname awaiting certificate cleanup can outlive a deleted blog so retries remain safe and provider resources can be removed. The application does not keep the fetched raw inbound message in that ledger.
• Disconnecting a local uploader immediately revokes its server token. We retain its device, notebook, and upload ledger as part of the blog until the blog is deleted; the package's unlink or purge command removes its local token. Drafts, rendered PDFs, and imported images remain until their ordinary retention or deletion rules apply.
• Operational logs and processor-side copies follow the processors' current operational retention. Umami analytics age out under the current Cloud plan or can be deleted from the service account. Reddit retains optional ad-measurement events under its business-tool terms. Resend's processing terms cover email content and metadata held to deliver and receive mail.

Your controls

From dashboard settings you can correct account and blog details, change announcement consent, remove a custom domain, disconnect a local reMarkable uploader, turn off Fresh pages featuring, and opt a blog in or out of handwritten comments while the experimental feature is available. Authors approve or reject each confirmed comment from a private review inbox. You can create a portable blog export containing blog metadata, posts and pages (including drafts), transcripts, original uploads, display images, handwritten links, and comments including their private sender addresses and moderation state. Treat the export as private personal data. It does not contain your password, sessions, account email or inbound-message ledger.

Product announcements include an account-free, one-click unsubscribe link. You can subscribe again from the public marketing site; a fresh email confirmation is required before delivery resumes.

You can delete your blog or account in the danger zone. For access, correction, deletion or another privacy request that the dashboard cannot handle, email hello@handwritten.blog.