Privacy Policy

1. Who is responsible

ONE, 421 8th Ave #8689, New York, NY, US, is the controller of your personal data. Privacy questions and requests: goldrusher9009@gmail.com. General support: goldrusher9009@gmail.com.

ONE is not currently offered in the European Union, the European Economic Area or the United Kingdom, so we have not appointed a representative there.

2. What we collect

Account. Your email address, the name you ask ONE to call you, a password hash (never the password itself), and, if you add one, the public part of a passkey. When you sign in we record a session with its IP address, browser or device type and expiry, and we keep security records such as recent password checks.

Your tasks. What you hand over, how you will know it is done, background and deadlines you add, your conversations with ONE, the questions it asks and your answers, the actions it prepares, your approvals or rejections, the evidence it collects, and a timeline of what happened.

Decision records. For approvals and rejections, we keep the decision time, the interface version used, whether it came from the website or app, a reported or inferred coarse device category, and a one-way hashed reference to the signed-in session. Certain recovery decisions also record the time, website or app channel and session reference. These decision records do not contain the session token, precise location, IP address or full browser identification string; sign-in sessions separately contain the information described above. We use decision records to trace authorization and investigate errors or misuse.

Google data, only if you connect it. Connecting Google is not available yet, and ONE reads no Google data today. Once it opens, ONE connects to Google only when you choose to, and Gmail and Calendar are connected separately:

• Gmail: messages you search for and select to attach to a task (imported as plain text only — HTML is not executed and attachments are not opened); the copy of each email ONE sent for you, read back from your Sent folder to check it matches what you approved; and, only if you turn them on, new replies in threads linked to your active tasks and a minimal mailbox index (message IDs, labels and dates — no subjects or bodies).
• Google Calendar: events ONE creates on calendars you own after you approve the full details, read back to confirm they were created; and, only if you turn them on, minimal fields of your primary calendar (event ID, status, title, start and end) and busy/free windows for suggesting times.
• Your Google account email and an encrypted connection token, so ONE can act only within the permissions you granted.

Usage and technical data. Records of each AI planning run (number of model calls, tokens used, time taken), saved planning records that can include task context, model responses and tool requests and results, error codes, and server logs needed to run and secure the service. Relevant Google content you chose to use can also appear in planning records. We do not use third-party analytics or advertising tools.

Mobile app. If you turn on notifications, a device push token. If you use voice input, speech is converted to text by your device's speech service and ONE receives only the text. Read-aloud uses your device's built-in voices.

Human assistance. If you allow a member of ONE's support staff to help with a task, we record whom you allowed, which task fields were shared, for how long (1 to 60 minutes), and what they reported.

Content reports. If you report something ONE wrote, we keep the category, your optional note and a short excerpt of the reported content (up to 500 characters), copied from your own data. ONE staff review reports by hand; they are never sent to the AI model.

Messages to us. What you send when you contact support.

3. How we use it, and our legal bases

• To provide ONE as you ask — understanding tasks, following up, preparing actions for your approval, carrying out the actions you approve and verifying results (performance of our contract with you).
• To read Google data you connect, only for the features you turn on (your consent, which you can withdraw at any time by disconnecting).
• To keep ONE safe and reliable — preventing abuse and spam, enforcing daily limits, securing accounts, and fixing problems (our legitimate interests in a secure service).
• To send service emails such as email verification and password resets (performance of our contract).
• To comply with the law and respond to lawful requests (legal obligation).

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

4. AI processing

ONE uses large language models provided by OpenRouter, processed in the United States and other countries where OpenRouter's model providers operate. For each step, ONE sends only the content needed to complete it — for example your task, the relevant conversation, and the text of an email or event you attached. During the beta, ONE uses free model endpoints through OpenRouter. Requests are routed only to providers that OpenRouter lists as not collecting data, but we have no contract with the model providers that forbids them from using your input to improve their models. Please do not give ONE passwords, bank card or account numbers, health information or other sensitive data.

More about how ONE uses AI: How ONE uses AI.

5. Google user data and Limited Use

ONE's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. ONE does not use Google Workspace API data to develop, improve, or train generalized or non-personalized AI and/or ML models. Content needed to complete a request you make is sent to our AI model provider (OpenRouter) only to produce that result. During the beta, ONE uses free model endpoints through OpenRouter. Requests are routed only to providers that OpenRouter lists as not collecting data, but we have no contract with the model providers that forbids them from using your input to improve their models. Please do not give ONE passwords, bank card or account numbers, health information or other sensitive data.

Details for each Google permission: How ONE uses Google data.

6. Who we share it with

We do not sell personal data or share it for cross-context behavioral advertising. We share it only with:

• Service providers who process it on our behalf: hosting and database (OVHcloud, the United States); AI models (OpenRouter); service emails (Resend); and, only if you turn on mobile notifications, Expo and Google Firebase Cloud Messaging.
• Google, when ONE calls Google APIs on your behalf — for example to send an email you approved.
• People you choose: the person an approved email is addressed to, attendees of an approved event, and ONE support staff you allow to help with a specific task.
• Authorities or others when the law requires it, or to protect the rights and safety of people and of ONE.
• A successor if our business is reorganized or sold, under the same protections (including the Google Limited Use requirements).

7. People who are not ONE users

Emails, events and messages you bring into ONE contain information about other people, such as the people you write to and meeting attendees. We process it only to carry out your tasks, and it is deleted with your data. Every email ONE sends carries the notice "Sent by ONE, an AI assistant, on behalf of the owner of this email account." so recipients know an AI assistant was involved. Anyone can contact us at goldrusher9009@gmail.com about data we may hold about them.

8. How long we keep it

• Account and task data, including account-linked decision records and saved planning records: until you delete the relevant data or delete your account.
• Imported Gmail and Calendar content: with the task it belongs to; connection tokens are removed when you disconnect Google or delete your account.
• Content reports: until you delete your account; the excerpt and your note are cleared 90 days after a report has been reviewed.
• After account deletion: a minimal record (an opaque account identifier, operation number, times, stage, counts and safe error codes) is kept so that old background jobs cannot re-create the account. It contains no email address, name, password or content. A deletion receipt can be used to check progress for 30 days.
• Integrity proofs after account deletion: signed aggregate integrity anchors and cryptographic hashes remain so earlier action records can still be checked for alteration. They contain no email address or message content. Account-specific ledger records and account-to-hash mappings are deleted; retained hashes and signatures do not expire automatically when an account is deleted. Someone who already holds your exported proof may be able to associate it with a retained hash.
• Backups: may contain deleted account data, including planning records, until removed under the applicable retention policy. The service's backup retention period is 7 days.
• Server logs: up to 100 MB per service, after which older entries are overwritten.
• Copies held by others are outside our control: emails you sent stay in your Gmail and in recipients' mailboxes, events stay in Google Calendar until you remove them, and files you downloaded stay on your devices.

Deletion removes data from the application; it does not promise to erase operating-system snapshots or residual disk sectors.

9. Your choices and rights

• Export: download an encrypted backup or a readable JSON file in Settings → Privacy and data.
• Delete: delete your account and data in Settings → Privacy and data → Delete account and data. See Delete your account.
• Disconnect Google: once Google can be connected, in ONE's settings; you can always remove ONE's access at Google account permissions.
• Pause: Private mode pauses new reading and actions that have not started.
• Depending on where you live, you may also have the right to access, correct, restrict or object to processing, to data portability, and to withdraw consent. Withdrawing consent does not affect processing that already happened.

Write to goldrusher9009@gmail.com. We answer within 30 days, or sooner where the law requires, and may need to confirm your identity first. You can also complain to your local data protection authority.

10. Security

Connections from your browser or app to the public ONE service use HTTPS. Google connection tokens are encrypted at rest, passwords are stored only as hashes, and you can sign in with a passkey. Each external action needs your separate approval, and approvals cannot be reused. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

The bodies of new AI planning transcripts created by the current version are encrypted in the database with service-managed keys. Separately stored usage records, summaries, indexes and other service metadata are not covered by this transcript-body encryption. Historical files from older versions and older backups may still contain plaintext; importing history does not by itself delete the source files. Those copies remain until handled under the applicable migration, deletion and retention procedures. Authorized service processes can decrypt stored transcript bodies to carry out your tasks or prepare your export. Plaintext is used in memory and temporary working directories during processing, and in readable exports you request. This is not end-to-end encryption.

11. International transfers

We host ONE in the United States. Our providers may process data in other countries, including the United States and other countries where OpenRouter's model providers operate for AI processing. Where the law requires, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

12. Age and regions

ONE is for people aged 18 or older and is not directed at children. If we learn that someone under 18 has an account, we will delete it. ONE is not currently offered in the European Union, the European Economic Area, the United Kingdom or mainland China; by using ONE you confirm that you are not located in any of these regions.

13. Cookies and local storage

ONE uses only cookies that are strictly necessary: a session cookie that keeps you signed in, and short-lived cookies that protect sign-in and passkey requests. The web app also stores three small items in your browser: your light or dark theme, when you last used ONE (to summarize what happened while you were away), and whether this browser has signed in before (to open on sign-in rather than sign-up). We use no advertising or analytics cookies, so there is no cookie banner.

14. Changes to this policy

The version and effective date are shown at the top of this page. If we make material changes we will tell you in the app before they take effect and ask you to review and accept the new version.

15. Contact

ONE, 421 8th Ave #8689, New York, NY, US · goldrusher9009@gmail.com