Privacy Policy

• Account details: your email address, name, and password (stored as a secure hash), plus your profile and settings.
• What you create: your chats with One, messages, files and photos you attach, spaces, projects, canvases, comments, and anything you ask One to remember.
• Voice: when you use voice chat or dictation, your microphone audio is streamed to our AI provider to be understood and answered. We don’t keep the recordings; what was said becomes part of your chat.
• Location: an approximate area based on your network, for local answers like weather. If you turn on Share device location, your device location is used for that reply and isn’t stored.
• Connected apps: when you connect an app such as Gmail, Google Calendar, Google Drive, GitHub, Slack, Notion, HubSpot or Stripe, we store the access you granted (or the API key you entered) and read or change data in that app only when you or One use it for you. Some apps keep a copy of recent items (for example email messages or calendar events) so they load quickly in Oncirca.
• Usage and billing: what you use that counts toward your plan’s usage, and your plan and subscription status. Payments are handled by our payment processor; we never see your full card number.
• Technical and security data: IP address, device and app version, sign-in history, and records needed to prevent abuse and keep accounts safe. If you turn on notifications, a device token so we can send them.
• Reports and support: content you report to us and messages you send to support.

• To provide Oncirca: answer your requests, run the tools you ask for, sync your work across devices, and share spaces with the people you invite.
• To measure usage, run your plan, and send account, billing and security messages.
• To keep Oncirca safe: prevent fraud and abuse, enforce limits, and review reported content.
• To fix problems and improve reliability.

We don’t use your content to train AI models, and we don’t sell or rent your personal information or share it for advertising.

One is powered by OpenAI. When you chat, use voice or dictation, search the web, or create images, the relevant messages, files and context are sent to OpenAI to produce the response. OpenAI processes this data under its API terms: it doesn’t use API data to train its models, and it may keep it for a limited time (generally up to 30 days) to detect abuse. Oncirca asks for your consent before your first AI request.

AI responses can be wrong. You can report a response or a generated image from the app, and we review reports.

We share information only with service providers that help us run Oncirca, under contracts that limit their use of it to providing their service:

• Supabase: database, sign-in and file storage.
• Vercel: hosting for the app and website.
• OpenAI: AI responses, voice, dictation, web search and images.
• Composio: secure connections to some third-party apps you choose to connect.
• Google and the other apps you connect: to read and act on your data in those apps, at your request.
• Polar: payments and subscriptions (web purchases only).
• Resend: email delivery, such as invitations and digests.
• Apple: push notifications, if you turn them on.

People you invite to a space can see what you share there. We may also disclose information if the law requires it, to protect people’s safety, or as part of a merger or sale of the business (in which case this policy keeps applying).

Oncirca’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the features you use in Oncirca, we don’t use it for advertising, we don’t use it to train AI models, and people at Oncirca don’t read it unless you ask us to, it’s needed for security, or the law requires it.

• Your account and content are kept while your account is open.
• Deleted projects can be restored for 30 days, then are removed.
• Copies of connected-app data are removed when you disconnect the app.
• Security records are kept for up to 180 days.
• When you delete your account, we delete your account, content and app connections, and cancel any subscription. Backups roll over within a short period after that. We may keep limited records where the law requires it, such as payment records.

• Delete your account any time in the app: Settings → Account → Delete account.
• Disconnect an app any time from Apps in Oncirca, or from that app’s own security settings.
• Turn off memory, device location, notifications and email digests in Settings.
• Access, correct or export your information, or ask a privacy question, by emailing [email protected]. Depending on where you live, you may have more rights under local law (for example in the EU, UK or California); we honor them, and you can complain to your local data protection authority.

We don’t use advertising or analytics cookies. The app stores your sign-in session and preferences on your device so you stay signed in. If you type a request on oncirca.com before signing up, the site keeps it in a short-lived cookie for up to 30 minutes so the app can pick it up.

Data is encrypted in transit and at rest, access is limited to what each part of Oncirca needs, and connected-app access can be revoked at any time. No system is perfectly secure, so please use a strong, unique password.

Oncirca isn’t for children under 13 (or the minimum age in your country), and we don’t knowingly collect their information. If you believe a child has given us information, email [email protected] and we’ll delete it.

Oncirca is run from the United States, and our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards for those transfers.

If we change this policy in a meaningful way, we’ll tell you in the app or by email before it takes effect. Questions or requests: [email protected].