Privacy policy
Your data. Clearly explained.
How Handlefree, this website and support handle information.
Updated 10 November 2026
Who is responsible
Aeon GbR
Brünnleinsweg 126
90768 Fürth
Germany
Represented by: Sophia Schmieder & Kapish Bhardwaj. Privacy requests: support@onekapisch.com.
Scope and overview
This policy covers Handlefree for iPhone and Apple Watch, this website and support correspondence. Handlefree has no account system or vehicle-command backend. Vehicle communication is local Bluetooth. Website hosting and Apple’s services have separate data flows described below.
Data stored by the app
Pairing creates a private vehicle key. The key, VIN, authenticated Bluetooth identifier and access policies (such as Holiday Mode, the signal guard and Watch access) are stored in non-synchronizing, device-only iPhone Keychain. The Pro trial start date and a cached purchase flag are also kept in the device-only Keychain, so reinstalling does not restart the trial; StoreKit on your device remains the source of truth for purchases. Local appearance, name, steering-side, favorites, confirmed-control settings and the handles-skipped count are stored in protected app storage excluded from backups. Handlefree does not upload this information to us.
Bluetooth and Apple Watch
Signed requests and status queries are exchanged with your vehicle over Bluetooth. The Watch companion relays short-lived requests through the paired iPhone using Watch Connectivity; the private vehicle key is not transferred to Watch. Bluetooth permission is necessary for vehicle access. Where owner authentication is requested, iOS handles Face ID, Touch ID or the passcode; Handlefree does not receive biometric templates. Local processing provides the functions you request (Article 6(1)(b) GDPR, where applicable).
Diagnostics and retention on your device
The app holds up to 200 diagnostic events in memory and writes diagnostic messages to Apple’s unified system log, whose retention is managed by the operating system. These messages are designed to omit VINs, keys and command payloads. The in-app Copy action includes the app/iOS version and event times, writes a device-local clipboard copy and sets it to expire after five minutes. Copies you paste elsewhere follow the destination’s retention. There is no automatic diagnostic upload by Handlefree.
Deleting local access
Use the vehicle/key deletion control in Handlefree Settings to remove the local credential and reset preferences. Also remove the matching key from the vehicle’s key list to revoke vehicle authorization. Uninstalling alone may leave Keychain data behind. We cannot remotely read, restore or erase your local vehicle key.
Apple services and beta testing
Apple processes data when you use TestFlight, the App Store, In-App Purchase, Siri or Shortcuts under its own notices. Apple processes Handlefree Pro payments; we receive no card or Apple Account details. For sales statistics, Apple sends us notifications about Pro purchases and refunds (App Store Server Notifications), which our service provider RevenueCat, Inc. (USA) processes for us: product, price, currency, storefront country, date and Apple’s transaction number. They contain no name, email address or Apple Account, and the app itself sends nothing to us or RevenueCat. The basis is our legitimate interest in understanding sales (Article 6(1)(f) GDPR). Apple may also show its standard rating prompt. TestFlight provides developers with testing information, including usage and crash information; feedback you choose to send can include screenshots and contact details. This is separate from Handlefree’s lack of an analytics SDK. App Store installations may also be subject to your Apple analytics-sharing settings. Apple’s TestFlight privacy notice.
Website delivery and hosting
Vercel hosts the website and may process IP address, browser information, requested URL, request time, referrer and security events to deliver and protect it. The basis is our legitimate interest in secure, reliable delivery (Article 6(1)(f) GDPR). Retention depends on the configured hosting/security service and the need to investigate incidents. Vercel and its subprocessors may process data outside the EEA. Applicable transfer arrangements are described in Vercel’s data processing terms. Vercel data processing terms.
Cookies, analytics and media
This website uses Vercel Web Analytics, a cookieless statistics service of our hosting provider Vercel, to count page views in aggregate. It sets no cookies and uses no local storage. According to Vercel, visitors are distinguished only by a hash of the incoming request that is discarded after 24 hours, and no IP address is stored with the data. We see aggregated figures only: pages viewed, referring website, filtered query parameters, approximate location (country, region, city), device type, operating system and browser. The basis is our legitimate interest in understanding which pages are useful and improving the website (Article 6(1)(f) GDPR); Vercel processes the data as our processor under the data processing terms linked above. A content blocker can block these statistics; the website works the same. When you click or press an App Store button on this website, it takes you straight to the App Store, and a small script on our page sends one count to our server: the button’s position, the page and how many different App Store buttons were pressed on that page within the last minute. Links to Handlefree shared elsewhere, for example in a post or an email, go through handlefree.app/app-store/: our server notes that the link was opened and forwards you to the App Store. In both cases we store the time, your country (derived by Vercel from the connection; the IP address itself is not stored), the type of device (iPhone, iPad or Mac, Android or other, read from the browser’s description, which itself is not stored) and, for links from other websites, that website’s name. To count repeats only once and to recognise automated clicks, short-lived markers made of the device type, country, page and button or link are kept for at most 10 minutes; they identify no one. The link to the App Store carries a campaign name (the page or source, such as a guide’s name or “email”) so that Apple’s App Store statistics show us, in aggregate, how many visitors from each source install the app; Apple processes this under its own privacy terms. No cookies, local storage or identifiers are used, so taps cannot be linked to you or to each other. The counts are kept with Upstash (a Redis database service connected through Vercel, which may process data outside the EEA): totals per day, page, country, device type, button and link source, plus a list of the latest 200 events. The basis is our legitimate interest in knowing which pages lead visitors to the app (Article 6(1)(f) GDPR). There are no advertising trackers, tracking pixels or social plugins. Your chosen language is part of the page URL. Fonts, images and video are served from this site. Following an external link contacts that provider under its own privacy terms. Hosting security mechanisms remain subject to the hosting service described above.
Support correspondence
If you email us, we process your address, name if provided, message and attachments to answer your request. The basis is Article 6(1)(b) GDPR for service-related requests or Article 6(1)(f) for other correspondence and troubleshooting. Our email service provider processes correspondence to deliver and store it. We retain correspondence as needed to handle the request, follow-up and any applicable legal retention or claims; you may request deletion where continued retention is not required. Do not send VINs, keys, passwords or precise location.
Recipients and your rights
We do not sell personal data. Hosting and email providers, RevenueCat for purchase statistics, Apple within its services, and authorities where legally required may receive data as described above. Subject to the applicable conditions, you may request access, correction, deletion, restriction or portability, object to legitimate-interest processing, and withdraw consent for processing based on consent. Contact us to exercise these rights. You can complain to a supervisory authority, including the Bavarian authority for the private sector. No automated decisions with legal or similarly significant effects are made by this website. BayLDA.
Changes
We update this notice when our services or processing change. The date above identifies this version. Contact support for privacy questions or a copy of information about your correspondence.
