The HandoffPath Charter

Public, durable commitments about how HandoffPath behaves toward its users and toward the AI tools it works with.

This document is the contract. If product ever drifts from it, the document — not the product — is the source of truth, and the product is wrong.

Why this exists

HandoffPath sits between you and every AI tool you use. That's a position of trust. Other tools in this position have, historically, picked a winner — got paid to recommend one provider, locked user data into a proprietary store, quietly degraded support for competing platforms.

We won't. This charter is how we make that promise verifiable.

The commitments

1. Your data can live in your Drive

Connect Google Drive once and every Resume Pack is mirrored there as plain markdown. If HandoffPath disappears tomorrow, those packs stay where they are, readable by every AI you use and by you with cat.

Drive sync is opt-in, not mandatory. When Drive is not connected, packs live in the HandoffPath database as plain markdown rows that you can export at any time (see commitment 7). We recommend connecting Drive — the export step becomes zero clicks instead of one, and the file sits where your other AI tools already look for context.

The HandoffPath database is a cache and an index. Your Drive, when connected, is the source of truth.

2. The format is public

The Resume Pack format is specified in docs/RESUME_PACK_SPEC.md and is plain markdown — no extensions, no proprietary syntax. Anyone can build a reader, a generator, or a converter without asking us.

We will version the format publicly. Breaking changes get a new version number and a documented migration path.

3. Every AI tool is a first-class citizen

We do not tier features by provider. The product Claude users see is the product ChatGPT users see is the product Gemini users see is the product Grok users see is the product Cursor users see.

Where one AI tool's integration is stronger than another's, we say so — publicly, on the integrations page — but we do not artificially weaken the others.

4. You can bring your own keys

Paste a Gemini or xAI key in Settings and HandoffPath uses your key for every Pack generation instead of the shared server key. Keys are encrypted at rest (lib/server/secret-vault.ts), never displayed back to the browser after save, and can be removed in one click.

Without a configured user key, HandoffPath falls back to the shared server key — your usage rolls up against the shared quota. Configuring a user key removes that constraint and gives you direct billing with the provider.

We do not resell tokens. We do not take revenue share from any AI provider for usage routed through HandoffPath. Those commitments stand regardless of whose key signs the request.

5. The eval results are published unedited

Resume Pack quality is measured against the rubric in docs/RESUME_PACK_EVAL.md. Scores are published in the footer of every marketing page, sourced from real eval runs committed to the repo. We do not curate which runs we publish.

If a provider scores poorly, we say so. If our prompt regresses against the baseline, we say so.

6. No exclusive partnerships

We will not sign an exclusive distribution, integration, or revenue agreement with any AI provider. This door is closed.

7. Export is one click — and so is deletion

You can download every pack, every block, and every project as markdown files in one action: Settings → Your data → Export my data, served by app/api/account/export/route.ts as a plain .zip of Markdown. No retention period required, no support ticket, no "download my data" dark pattern.

Deletion is the same promise in reverse. Settings → Your data → Delete my account (app/api/account/route.ts) removes every row you own, deletes your screenshots from storage, and cancels any billing — permanently, in one action, no ticket.

8. Telemetry is metadata only

HandoffPath uses PostHog for product analytics — which features get used, where users drop off, which AI providers return errors. We need this to make the product better. The Charter constrains what we send:

• Never the pack content. Block text, pack markdown, Continue Prompts, attachments, AI provider responses — none of it touches the analytics pipeline. Only counts, providers, durations, and outcome enums.
• Never API keys. BYOK keys are encrypted in our database via AES-256-GCM and never appear in events.
• No session replay. The textarea where you type blocks would expose your work in flight; we permanently disable PostHog's replay surface.
• Respect Do Not Track. Browsers that send the DNT header are excluded from telemetry without further configuration.
• Categorised errors, not raw messages. External SDK error strings occasionally carry sensitive substrings (file IDs, URLs); we bucket errors into a small enum before sending.

The catalogue of events we track lives at lib/analytics/events.ts — a single TypeScript file that's the source of truth. Every event name and payload shape is there; if it's not in that file, we don't send it.

What this rules out

These are things we will not build, even if asked, because they break the charter:

• A "HandoffPath for Claude Pro" tier — breaks commitment 3.
• A proprietary pack format that requires our renderer — breaks 2.
• A sponsored "recommended AI" default in the UI — breaks 3, 5, and 6.
• Pack storage that does not round-trip cleanly through cat — breaks 1.
• A revenue share with any AI lab tied to user volume — breaks 4 and 6.
• Sending pack content, block text, or API keys to analytics — breaks 8.
• Session replay of the workspace — breaks 8.

How this changes

Adding a commitment is easy. A new clause can be appended with a single commit, dated.

Removing or weakening a commitment is hard. It requires:

1. A written justification explaining what real user need is unmet by the current clause.
2. A 30-day public notice on the marketing site before the change takes effect.
3. The old clause preserved in the document's git history. We do not rewrite.

In practice the charter only grows. Bank-quiet, not startup-pivot-loud.

The one-line test

If a user asks "what happens to my packs if HandoffPath shuts down tomorrow?" the answer has to be one of:

• "Nothing — they're still in your Drive, in markdown, readable by every AI." (Drive connected.)
• "You export them once with one click and you have them all in markdown." (Drive not connected — see commitment 7.)

That pair of sentences is the charter, compressed. Both are durable — neither requires HandoffPath to still exist for your data to be yours.

Ratified 2026-06-01 by Caisson HQ.