How We Use AI

For new accounts, this version applies from sign-up, from Wednesday 14 October 2026. For existing accounts, it takes effect on Monday 23 November 2026; until then, the current version applies.

1. The simple explanation

You give Handover a note, recording, photo or document. Handover sends the information needed for the feature to an AI service. The AI returns a transcript or suggestion, which Handover can show or save for you to review. Private AI changes the AI processing step; the crew workflow looks the same.

Your input -> Handover -> the vessel's AI service -> Handover -> a record or suggestion for human review.

For WhatsApp: your phone -> WhatsApp and Twilio -> Handover -> the vessel's AI service -> Handover.

2. What uses AI

In the Handover web app, you can type a note on every plan. Talk and Drop require paid access. You can record a voice note, or drop or paste an email, document, CSV file or picture. You can also drop or choose several files at once; each is read and reviewed in turn, and the results stay with the file they came from.

For a dropped email, PDF, Word document or CSV file, your browser reads the text and the Handover web app sends that text for AI sorting; the original file is not sent to the AI for that step. A PDF or Word document attached to a dropped email is read the same way, as a document in its own right carrying that email's sender, subject and date; its text and the email's own body text are sent for AI sorting separately. Other attachments, such as a picture or an email attached to the email, are left out with a notice.

When the vessel's masking setting is on, Handover masks recognised personal details in this text before AI sorting. Some details can remain readable, including the vessel's name and calendar dates. The masking section of this page explains its limits further. Pictures are sent as images and are read only when private processing is available for the vessel. The app checks pictures for recognised identity documents before submitting them; this check does not replace your responsibility to select appropriate content.

The results are suggestions for Actions, Updates and Library entries. You choose which to add now or add to Needs Review. Check names, numbers, dates and the source before relying on them. Saved items, source information and document attachments are handled as described in the Privacy Policy.

AI can get any of these tasks wrong. Check names, numbers, dates, priorities and instructions against the source before acting or sending a handover report. It is not a substitute for qualified judgement, navigation or emergency systems.

3. Which service handles a vessel's requests

A vessel with qualifying paid access uses private AI, which Tinfoil, Inc. (United States) runs on sealed servers. Qualifying access can come from its own subscription, a covering subscription or an active crew member's qualifying entitlement. Eligible trials, passes and access codes can count. One qualifying crew member can therefore make the whole vessel eligible.

Free plans do not themselves include private AI. A Free user working on an eligible vessel still uses that vessel's private AI. Vessels without qualifying access normally use standard AI: OpenAI for text, images and audio, in the app and on WhatsApp. OpenAI states that it does not use API inputs or outputs to train its models. It keeps text and image requests and replies for up to 30 days for abuse monitoring (longer only where the law requires it or to protect the service or others from harm), and does not keep voice recordings sent for transcription. Provider details are in the Privacy Policy's recipient table.

When qualifying access ends, new requests normally use standard AI. A separately enabled private vessel stays private until that setting is removed. Uncertain plan information can also keep a vessel on private AI. You do not select a separate AI provider for each note.

4. What private AI protects

Tinfoil, Inc. runs private AI on sealed servers: confidential-computing hardware designed to prevent its operators and hosting companies from reading the content being processed. Before Handover sends anything, it checks the server's attestation, a signed proof of what the server is running. A failed check stops that connection from being used to submit content.

Handover itself still receives your input, handles the result and stores records. Authorised crew can still see the records their permissions allow. Other services still provide storage, messaging, support, diagnostics, analytics and payments. Private AI does not remove those services or make the whole app end-to-end encrypted against Helmwise.

Tinfoil states that it does not train models on inputs or outputs and keeps no prompts or replies. One qualification applies. Its protected prompt cache can hold information derived from a request in hardware memory after the response, without a fixed expiry. Entries are displaced when space is needed or cleared when the hardware restarts. Handover supplies vessel-specific cache keys for relevant requests. Tinfoil keeps usage metadata, which is separate from content. See the Privacy Policy, section 4, for the fuller explanation.

5. What happens when something fails

If a private text model returns certain errors, Handover can retry once on a second model at the same private provider. It does not automatically move that request to OpenAI or another provider. Photo processing and voice transcription have no enabled second-model backup.

If the request still cannot be processed, the AI task fails and you may need to try again or enter details manually. Do not assume a failed request has been saved: check the app's status. The phone app may hold a pending recording for retry.

If Handover cannot read the routing settings, AI requests stop unless the vessel has a separate private-only setting that can still be used. A settings fault does not send a private request to standard AI. If a request cannot be safely associated with a vessel, some AI features may also refuse it rather than guess the route.

A deliberate change from private to standard AI for a still-eligible vessel is governed by the Terms and Data Processing Agreement. It is different from losing paid eligibility at the end of a subscription or trial.

6. What text masking does and misses

Before text reaches an AI service, Handover replaces private details, such as names, numbers and addresses, with placeholders. When the answer comes back, it puts the real details back in. The list that links each placeholder to its detail is held in our server's memory for that one request.

It looks for the names of your boat's crew and Library contacts, names after a title, phone numbers, email addresses, passport, ID and visa numbers, dates of birth, bank and card numbers, addresses and postcodes, and flight and booking references.

It applies to every AI request that sends text: notes, sorting, summaries and briefings, reading Word templates, Library and contact imports, and WhatsApp follow-up messages. It is on by default. A boat admin can switch it off in Settings, and then text goes as written. While masking is on, Handover refuses a request rather than send unmasked text if it cannot load the boat's crew and Library contact names.

Masking can miss some details. In our test of 12 October 2026 it found about 7 in 10 of the private details in our test texts. Voice recordings and photos go to the AI service as they are. An image-import feature can read a password or passcode visible in the image. Crop or remove unnecessary personal information and secrets before submitting them.

7. Audio, images and copies

Handover does not keep the original voice recording as a saved audio note or archive. A recording waiting on your phone for upload or retry is a separate copy. The transcript remains as a saved record. Suppliers keep some copies for set periods. OpenAI keeps text and image requests and replies for up to 30 days for abuse monitoring (longer only where the law requires it or to protect the service or others from harm) and does not keep voice recordings, Tinfoil keeps no prompts or replies, and Twilio keeps WhatsApp messages and files for 7 days. Deleted message text can stay in Twilio's backups for up to 30 more days.

For WhatsApp, Handover also keeps a message record: the text, the sender's number and the link to any photo or voice file. A clean-up clears these after Handover replies. The Privacy Policy, section 9, says what it clears and when.

Contact and library import images are used for extraction and are not kept by Handover as standalone import images after processing. Saved photo attachments are different: they stay with their records. Archiving a note does not delete its photos, and removal from view is not proof that every backup or delivered copy has been erased.

8. Your choices and questions

Submit only information you are authorised to process and need for the task. You can use the app instead of WhatsApp to avoid the WhatsApp and Twilio transport step. Manual entry is available where the feature supports it; voice transcription and other AI features cannot perform their AI task without sending the relevant content for processing.

There is no per-note choice of AI supplier. Contact hello@thehandover.app before changing a plan if you need to understand the effect on your vessel. Customers can raise reasonable data-protection objections under the Data Processing Agreement. If an objection cannot be resolved, its stop-use, termination and unused-prepaid-fee remedy applies. The Privacy Policy explains information rights, recipients and international processing.