OneProfile
Privacy Policy
This Privacy Policy explains what information OneProfile ("OneProfile", "we", "us"), a sole proprietorship based in the United States, collects through the OneProfile desktop app and your OneProfile account (the "Service"), what we do with it, and the choices you have. It is part of our Terms of Service.
In short
- Your profile never reaches us in a form we can read. Your name, date of birth, Social Security number, address, income, driver's license, the passwords saved for sites, your Gmail connection and your results stay on your computer, encrypted. Our servers never receive them, unless you turn on backup: then your profiles are encrypted on your computer with a passphrase only you know before they are sent, so we can't read them. A phone you pair is shown your runs and how they went, encrypted end to end, and never your profiles' details.
- Our servers hold your account, not your identity: your email address, your plan and trial, your computers, and records that keep plans to their limits, charge OneProfile Run's runs, and keep accounts secure.
- Gmail is read on your computer only, with read-only access, to finish your sign-ups and, if you turn on Inbox cleanup, to unsubscribe you from those sites' marketing email. Nothing from your email reaches us.
- Stripe handles payments. We never see your card number.
- No ads, no trackers, no selling. We don't sell or share your information for advertising, and the app and these pages contain no analytics or tracking.
1. Information that stays on your computer
The app keeps the following on your computer only, encrypted with your operating system's own key (the Keychain on macOS, Data Protection on Windows):
- Your profiles: each person's name, date of birth, Social Security number, address, phone, email, income, employment and employer, housing, education, citizenship, driver's license, security question answers and the other details you enter.
- Passwords the app creates for, or you save for, the sites it signs you up to.
- Your Gmail connection: the Google OAuth client you set up, and Google's tokens (section 2).
- Your results: which sites you ran, their outcomes and the accounts made, the health check's findings, and the app's run logs.
- Inbox cleanup's record, if you turn it on: which senders it unsubscribed you from and how that went (section 2).
We have no route, service or copy that receives any of it in a form we can read, so we can't see, recover or disclose it. Deleting a profile in the app deletes it, and uninstalling the app and deleting its data folder removes the rest.
Backup, if you turn it on. Backup is optional and off until you turn it on in the app. It keeps a copy of your profiles (their details, passwords, saved site passwords, Site questions answers and site outcomes; never your Gmail connection, YOLO history or logs) on our servers, to protect them if your computer is lost and to keep them in sync on your account's computers. The app encrypts the copy on your computer before sending it, with a key made from a backup passphrase you choose (scrypt, then AES-256-GCM). We never receive the passphrase or the key, so we can't read your backup, and if you forget the passphrase, neither you nor we can restore it. Each computer you restore it on keeps the key it made, encrypted with that computer's own key, so it can keep the backup in sync without asking for the passphrase again. You can delete your backup in the app at any time (section 11).
The phone app, if you pair a phone. Pairing is optional. The phone app, opened in your phone's browser or from its home screen, signs in to your account and pairs with one of your computers by a code that computer shows. It shows what the computer runs, the sites' names and how their runs went, what a run waits on and the questions sites asked, and lets you start and stop runs and type a code a site emailed you; your profiles' details never go to the phone. The phone keeps its sign-in and the pairing's keys in the browser's storage, encrypted with a key the browser keeps and can't hand out. What your computer and your phone say to each other is encrypted end to end with keys they agree when you pair, which we never receive: our servers pass it between them without keeping it, and can't read it. If you turn on the phone's notifications, your computer sends "YOLO run finished" and its summary to your phone's notification service (Apple's, Google's, Mozilla's or Microsoft's, as your phone's browser uses), encrypted so that service can't read it; it doesn't pass through our servers.
2. Gmail
Connecting Gmail is optional. It lets the app do two things for you, on your computer:
- finish a sign-up, by reading the code or link a site emails you when you sign up;
- clean up your inbox, if you turn on Inbox cleanup: unsubscribe you from the marketing email of the sites the app signed you up for.
How the app uses Gmail:
- Your own Google client. You connect Gmail through an OAuth client that you create in your own Google Cloud project. Google grants access to your client, on your computer; no OneProfile server is involved, and we never receive your Google tokens or any email. The tokens are stored encrypted on your computer.
- Read-only. The app asks for one permission,
gmail.readonly, and no other. It can't send, change, label, move, archive or delete email. - Sign-up codes and links. During a run, the app searches only for email from the senders the site you are running is known to use, received within the last few minutes, and reads only those, to find the code or link. The code is typed into the site's form and discarded, and a link is opened only on that site's own domain.
- Nothing else kept. The app doesn't store, log or display the contents, subjects or codes of your email. The only thing it keeps about your email is Inbox cleanup's record, below.
- You can disconnect at any time, in the app or at https://myaccount.google.com/connections.
Inbox cleanup. Inbox cleanup is off until you turn it on, and each profile has its own. It runs when you click Clean up now, and, if you tick Also after each scheduled run, after each scheduled run of that profile.
- What it reads. It searches only for email from the senders of the sites the app made an account on for that profile, received since that sign-up. For each site it looks at up to the 10 newest of those emails, leaving out Spam and Trash, and reads only their Gmail labels and four headers: From, Subject, List-Unsubscribe and List-Unsubscribe-Post. It reads an email's body only when those headers give no secure (https) unsubscribe address, and then only to find the unsubscribe link; the body is then discarded.
- Which email it uses. Only marketing email. It never unsubscribes by email in Gmail's Updates, or by email about your account, its password or security, a code or verification link, a welcome, an order, a receipt, shipping, a bill, a booking, a membership, credit, or an application and its result.
- What it sends, and to whom. Once for each sender, from your computer directly to that sender (or the service that sends its email), never to us: either a one-click unsubscribe request (the standard one, "List-Unsubscribe=One-Click", sent to the address the email gives, with no cookies or other data), or a visit to the sender's own unsubscribe page, in a hidden window with no cookies or saved sign-ins, clicking at most one confirm button. Nothing is typed into the page, and no sign-in is attempted. As with any website you visit, the sender sees your computer's IP address. Senders whose page asks you to sign in or needs more than one click, and those that unsubscribe only by email, are left for you to unsubscribe from yourself, and the app tells you which.
- What it keeps, on your computer only. Whether the cleanup is on; for each Gmail account (known only by a scrambled code), each sender's domain, which site it belongs to, how its unsubscribe went and when, with the sender's address kept only as a scrambled code; and the last cleanup's counts. It is encrypted with your operating system's key, in the profile's data, isn't part of your backup, and is deleted with the profile. No full address, unsubscribe link, subject or content of any email is kept, logged or sent to us.
- How to stop it. Turn off Inbox cleanup on the profile's card, or disconnect Gmail. The app can't undo an unsubscribe already made: to get a sender's email again, subscribe again on its site.
Limited Use. OneProfile's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The app asks only for gmail.readonly, and uses information from Gmail only for the two features you ask it for: reading the codes and links of the sign-ups you run, and, if you turn on Inbox cleanup, unsubscribing you from the marketing email of the sites it signed you up for. That information is read on your computer and never transferred to us. It leaves your computer only to go back where it came from, as these features need: a sign-up's code or link to the site that sent it, and an unsubscribe request to the sender whose email offered it. It is never transferred to anyone else, never used for advertising, never sold, never used to decide anyone's credit or eligibility for anything, never used to train AI or machine-learning models, and never read by a person.
3. Information you send to third-party sites
When you run a site, the app fills in that site's form with the parts of your profile it asks for and submits it from your computer, as you instructed. That information goes directly to the site (a store, card issuer or lender), not through us, and the site's own privacy policy governs what it does with it. Read the policy of each site you use. Inbox cleanup's unsubscribe requests also go from your computer directly to each email's sender (section 2).
4. Information our servers hold
To run your account and keep each plan to its limits, our servers (on Amazon Web Services) hold:
| What | Details | Why |
|---|---|---|
| Your sign-in | Your email address, a password verifier (not your password itself: the app proves it without sending it), and your authenticator app's secret if you turn on two-step sign-in, held by Amazon Cognito | To let you sign in and to email you |
| Your account | An account id, when it was made, your plan and any limits we changed for your account, your subscription's status and period, whether the account is suspended and why, any free tester access we gave you (when, until when, and whether it was ended), any invitation to OneProfile Business (when, its agreed monthly price and Stripe's id of it, our own note on whose account it is, and when it was ended), our records of who changed your account's access and when, and Stripe's ids for your customer record and subscription | To give you what your plan includes, and to keep a record of access we give |
| Your computers | For each installation of the app: a random id the app makes when installed, its operating system, app version, the computer's name (as its owner named it, such as "Sam's MacBook Pro", shown in the app's list of your computers), Amazon Cognito's id of the sign-in device it is used with, and when it was added, confirmed, last used and removed; and when computers were removed, for each plan's removals in 30 days. And which computer holds your account's one session, since when and when it was last seen, and the computer it took the session over from, if it did | To keep plans to their number of computers and sessions, to sign out a computer you remove, to tell a computer that another one took over your session, and to let you see and remove them |
| Trial records | Your trial's start, the installation it started on and how many of its sign-ups are used, and for each sign-up a code made from its site and profile (the app makes it on your computer, with a key that never leaves it, so we can tell sites and profiles apart but never which they are); and for each computer a trial was used on, a code made from that computer's hardware identifier (its hardware UUID on a Mac, its machine GUID on Windows). The app scrambles the identifier on your computer, in a way that can't be reversed, before sending it with your requests; our servers scramble it again with a secret key of ours and keep only that result, with which account's trial it was. It can't be turned back into the identifier, or matched to a computer without our key, and we never receive the identifier itself | To give each account, and each computer, one free trial of 30 sign-ups, each site and profile counted once, even if the app is reinstalled |
| Profile count | For each person's profile, a fingerprint made on your computer from the person's name, date of birth and Social Security number, scrambled with a random value of your account's (a "salt") in a way that can't be reversed, and scrambled again on our servers with a secret key of ours. It can't be turned back into the person's details, compared across accounts, or used to check whether someone is a customer | To keep plans to their number of people |
| Run records | On OneProfile Run, for each run you start: an id the app makes for it, when it started, whether it was a YOLO run or a site run by itself, whether it was charged (what, when, and Stripe's id of the payment), declined (and the reason Stripe gave), refunded (when, why, Stripe's id of the refund, and, where the app said the run failed to start, the app's words on why), or part of an earlier run, and when its first site started; and for 24 hours, a code of its profile and, for a site run by itself, of the site, made on your computer with a key that never leaves your computer, so we can tell a retry from a new run but not which profile or site it is. And how many runs were charged and started in the current month | To charge each run once before it starts, never a retry, to refund a run that never started, and to show the month's runs in the app |
| Site requests | When you suggest a site for OneProfile to add: the name and address you give it, your note, when you sent it, and your account id; and how many suggestions you made in the last day | To decide which sites to add, and to keep suggestions to a few a day |
| Problem reports | When you send one with Report a problem: your note, the app's version, build and environment, your computer's operating system and its version, the last part of the app's own logs (and, on Windows, of its installer's log), the installation's random id, your account id if you are signed in, and when; and how many reports were sent that day from your account, your installation and (signed out) your network's scrambled code. Before anything is sent, the app takes out of the note and logs your profiles' details, email addresses, codes and long numbers, passwords, keys and tokens, links' details and your computer's user folder, and shows you exactly what is sent | To find and fix what went wrong, and to keep reports to a few a day |
| Referrals, credits and promo codes | Your account's referral code; the friend's referral code you entered, whose account it was, when, and how it stands (waiting for your first payment, credited, or refused and why); the credits your referrals earned, what is left of them, and the Stripe invoices they were put on; the promo codes you redeemed for OneProfile Run, when, and the run that used one. And for each computer your account is used on, the same scrambled code of its hardware identifier the trial records keep. When a referred account's first payment comes, we ask Stripe whether the two accounts saved the same card (Stripe's fingerprint of it, which isn't the card number), and keep only the answer | To credit each referral once, refuse a referral between accounts on the same computer or card, take promo codes and credits off charges, and show them in the app |
| Terms acceptance | The version of the Terms and this policy you accepted, the time, the installation, and a one-way hash of the network you were on (your IP address's network block, not the address) | As our record that you agreed |
| Security signals | When your account starts a session or adds a computer: the installation, a one-way hash of your network block, and your country | To detect a shared or misused account |
| Your backup | If you turn on backup: your profiles as the app encrypted them on your computer with your backup passphrase, which we never receive, so we can't read them; each version's size and when it was made | To keep your profiles backed up and in sync on your account's computers, and to restore them on a new one |
| Paired phones | If you pair a phone: for each, the kind of phone it said it is (such as "iPhone") and its platform, Amazon Cognito's id of its sign-in device, the computer it is paired with and when; a pairing offer while the computer shows its code (10 minutes); while the phone app or the desktop app is open, its connection to our relay and since when; one-time tickets to connect with, as one-way hashes, for a minute; and how many pairing and relay requests were made in each hour or minute. Never what your computer and phone say to each other, which is encrypted end to end and passed on without being kept | To let your phone see and start your computer's runs, to keep it to the phone and computer you paired, and to keep requests to a reasonable number |
| Codes we email you | A one-way hash of each code we send to confirm a new computer or to move your session to another computer (made with a secret key of ours, so the code can't be worked out from it), the attempts made, and when codes were sent | To confirm the computer is yours, and to limit how many codes are sent |
| Request logs | For each request the app makes to our servers: the time, what was asked, the result, your IP address, the app's user agent, and your account id. Never your password, tokens or what the request carried | To operate, secure and fix the Service |
We get this information from you (your email address and the names you choose), from the app on your computer (the rest), from Stripe (your subscription's status), and from us (any tester access we give you).
Downloads and updates. The app and its updates are downloaded from our content delivery network (Amazon CloudFront), and, while you are signed in, the sites the app runs from our storage (Amazon S3); each receives your IP address and the file requested in order to deliver it. At its start and every hour, the app also fetches from CloudFront the notice it shows across the top of its window, with no account details or credentials of any kind. We haven't turned on logs of these downloads. These policy pages are served by CloudFront too, and set no cookies.
5. Payments
Payments are processed by Stripe, Inc. You enter your card and billing details on Stripe's pages, and Stripe stores them; we never see or store your full card number. When you first choose a plan, we give Stripe your account's email address, so your receipts reach you, and your account id, so your payments are matched to your account. Stripe tells us your subscription's status, plan and billing period, and gives us ids for your customer record and subscription. On OneProfile Run, Stripe saves your card when you choose Run, and for each run you start we ask Stripe to charge it (the amount, your customer record's id and the run's id); Stripe tells us whether the payment went through, or why it didn't, and we ask it to refund a run that never started. We ask Stripe to make and end our promo codes, to look up one you enter for OneProfile Run, and to put a referral credit on your customer balance for your next invoice; and, for a referral, for the fingerprints of the cards each account saved, to compare them. Stripe uses your information as its privacy policy describes, including to prevent fraud. Stripe also sends your receipts.
6. How we use information
We use the information in section 4 to:
- provide the Service, sign you in, and keep your account, trial and subscription in order;
- enforce each plan's limits on computers, people and sessions, and the one trial per account and computer;
- protect accounts and the Service from sharing, fraud and abuse, including by asking for an emailed code or suspending an account for review;
- email you about your account: confirmation and sign-in codes, security alerts, billing problems, and changes to the Service, its prices, these terms or this policy;
- operate, troubleshoot and improve the Service, answer your requests, and meet legal obligations.
We don't currently send marketing email; if we start, you will be able to unsubscribe from it at any time. We don't use your information for advertising, and we don't make decisions about you that have legal or similarly significant effects by automated means alone. We don't use the information we hold to train AI models.
7. Who we share it with
We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We share it only:
- with our service providers, which process it for us under contract: Amazon Web Services (hosting, sign-in, email delivery, storage and logs) and Stripe (payments);
- for legal reasons, when we believe in good faith that the law, a court order or a valid legal process requires it, or that it is needed to protect someone's safety, our rights, or the Service from fraud or abuse;
- in a business transfer, if the Service is sold or merged, to the business that takes it over, which must follow this policy for the information it receives;
- with your consent, or at your direction.
8. Where it is stored
Our servers are in the United States (Amazon Web Services' US East region). The Service is for people in the United States.
9. How long we keep it
| What | How long |
|---|---|
| Your account, plan, subscription, computers and profile fingerprints | While your account exists, then deleted at once when you delete it in the app (or within 45 days of a request to us) |
| Terms acceptances, billing ids, and trial records (which account and computers have had a trial) | While your account exists. When you delete it in the app, they go with it, but for each computer a trial was used on: its scrambled code stays, naming no account, so the computer has no second trial |
| Run records | A run's record about 13 months, for questions about a payment, or until you delete your account; its codes 24 hours (deleted within 2 days) |
| Site requests | While your account exists, then deleted with it |
| Problem reports | 90 days, or until you delete your account (with the ones sent signed out from its computers) |
| Security signals | 30 days |
| Emailed code hashes | 10 minutes (deleted soon after); when codes were sent, a day |
| Request logs | About 90 days |
| Paired phones | Until you unpair the phone (from the phone or the computer) or delete your account; pairing offers, connections, tickets and request counts a few hours at most (deleted within 2 days) |
| Your backup (if you turn it on) | Until you delete it in the app or delete your account. Each earlier version is kept 30 days after a newer one replaces it, and the 10 most recent earlier versions are kept until newer ones replace them; all are deleted when you delete your backup or your account |
| Backups | Deleted data can stay in our database's backups for up to 35 days more |
Stripe keeps its own records of your payments as its policy describes.
10. Security
Everything between the app and our servers is encrypted in transit (HTTPS), and our database and storage are encrypted at rest. Your password is never sent to us. Each part of our backend has access only to what it needs, and our logs never contain passwords, tokens or request contents. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires. Keep your computer and its operating system account secure: they protect the information that never leaves it.
11. Your choices and rights
Whatever state you live in, you can:
- get a copy of the information our servers hold about you, in the app: the Account card's Your data, Download, saves it as a file. To correct it, message us on Telegram: @toniojx (https://t.me/toniojx);
- delete your account and the information we hold, in the app: Your data, Delete account, with your password. It cancels your subscription first (at once, with no refund for the rest of its billing period), refunds a OneProfile Run run that was charged but never started, deletes your backup and your Stripe customer record and card, and can delete your profiles on that computer too. Stripe keeps its records of your payments, and section 9 says what else we keep and why;
- delete what's on your computer by deleting profiles in the app (with their Inbox cleanup records), disconnecting Gmail, or uninstalling the app and deleting its data folder;
- delete your backup in the app (Backup… > Delete backup): it is deleted from our servers at once, with every earlier version;
- remove a computer from your account in the app;
- unpair a phone from the phone app or the computer's Phone card: what we hold about the pairing is deleted at once.
We answer requests made to us within 45 days. To protect your account, we confirm a request comes from you, usually by email from your account's address; the app's Download and Delete account need you signed in, and deleting needs your password typed again. We won't treat you differently for using any of these rights.
12. US state privacy rights
We honor the rights below for every customer, whether or not a law requires it of a business our size.
California (CCPA, as amended by the CPRA). In the last 12 months we have collected these categories of personal information, for the purposes in section 6, from the sources in section 4, and disclosed them to the service providers in section 7: identifiers (email address, account and installation ids, IP address, and the scrambled code of a computer a trial was used on); commercial information (plan, trial, subscription, run and payment records); internet or network activity (request logs and security signals); approximate geolocation (country); and account log-in details (email and password verifier, a sensitive category we use only to sign you in); and, if you turn on backup, your profiles in encrypted form, which we can't read. We have not sold or shared personal information, including of anyone under 16, and we don't use or disclose sensitive personal information for any purpose other than providing the Service. You have the right to know what we collect, use and disclose; to access, delete and correct it; and not to be discriminated against for using these rights. You can get a copy of your information and delete your account yourself, in the app (section 11), or make a request by messaging us on Telegram: @toniojx (https://t.me/toniojx), or through an authorized agent with your signed permission; we will confirm the request with you. Retention periods are in section 9.
Nevada. We do not sell covered information as Nevada law defines it. You may still ask us not to by messaging us on Telegram: @toniojx (https://t.me/toniojx).
Other states. Residents of states with consumer privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon) have similar rights to access, correct, delete and get a copy of their personal information, and to opt out of its sale, targeted advertising and profiling. We don't sell personal information or use it for targeted advertising or profiling. To make a request, message us on Telegram: @toniojx (https://t.me/toniojx). If we decline it, you can appeal by replying to our answer, and if we decline the appeal you can contact your state's attorney general.
Global Privacy Control and Do Not Track. We don't track you across sites or sell your information, so there is nothing for these signals to turn off; we treat them as a request to opt out regardless.
13. Children
The Service is for adults 18 and over in the United States. We don't knowingly collect information from anyone under 18. If you believe a child has created an account, message us on Telegram: @toniojx (https://t.me/toniojx), and we will delete it.
14. Changes to this policy
When we update this policy, we change its version at the top and tell you by email or in the app before the change takes effect. If the change is material, the app asks you to accept the new version before you go on using the Service.
15. Contact
OneProfile
Questions and requests: Telegram: @toniojx (https://t.me/toniojx)