What we collect,
and what we don't.

The One Analytics ("we", "us") respects your privacy. This policy explains what information we collect, how we use it, and your rights regarding that information.

We do not sell personal data. Ever.

We collect only what's necessary to run the Service:

• Account information: Email, password hash, supporter status, and usage metadata (AI queries per day, last active).
• Billing: Stripe handles payment processing for optional supporter contributions. We store only a customer ID and supporter status — never raw card numbers.
• Usage analytics: Pages visited, features used, and anonymized performance data to improve the Service.
• Communications: If you email us, we keep the message and our reply.

We use collected information to:

• Provide, maintain, and improve the Service.
• Process supporter contributions and prevent fraud.
• Enforce usage limits (e.g. free tier daily AI query cap).
• Send transactional emails (receipts, password resets, service notices).
• Respond to support requests.
• Publish aggregated, de-identified statistics about the Service.

We share personal information only with:

• Service providers who help us operate the Service — Supabase (authentication + database), Stripe (billing), Vercel (hosting), Anthropic (AI inference). Each operates under strict data-protection agreements.
• Law enforcement when legally required, such as in response to a valid subpoena.
• Business transfers: If we're ever acquired, merged, or sell assets, user information may transfer as part of that deal — subject to the same protections.

We do not sell personal information to advertisers or data brokers.

We use essential cookies to keep you signed in and remember preferences. We may use privacy-respecting analytics (e.g. Plausible, PostHog) to understand aggregate usage. We do not use third-party ad trackers.

Depending on your jurisdiction, you have the right to:

• Access — request a copy of the data we have about you.
• Correction — ask us to fix inaccurate information.
• Deletion — request deletion of your account and associated data.
• Portability — receive your data in a common, machine-readable format.
• Opt-out — unsubscribe from non-essential emails.

Email [email protected] to exercise any of these rights. We respond within 30 days.

We keep account information for as long as your account is active. After account deletion, we retain billing records for 7 years (tax compliance) and security logs for 90 days. All other data is deleted within 30 days.

We encrypt data in transit (TLS 1.3) and at rest (AES-256). Passwords are hashed with bcrypt. Access to production systems is restricted and logged. If we ever experience a breach affecting your data, we'll notify you within 72 hours as required by law.

The Service is not intended for users under 18. We do not knowingly collect information from children. If you believe a child has provided us information, email us and we'll delete it.

We may update this Privacy Policy from time to time. Material changes will be announced by email and via a notice on the site at least 14 days before taking effect.

Privacy questions? Email [email protected].