Privacy policy

What we keep

We keep only what the app needs to work for you.

• Your account: your email address, and your name and profile picture if you sign in with Google or GitHub. Also your time zone, languages and app settings.
• Sign-in sessions: the IP address and browser name of each signed-in device, to keep your account safe.
• What you add to your workspace: brands, offers and claims, posts and captions, leads with your notes, messages and follow-ups, job matches and applications, projects and tickets, and your do-not-contact list.
• Your résumé: the PDF is read in your browser. We keep the text from it, as a résumé you check and fix, plus the file name, size and page count. We don't keep the PDF file.
• Your AI key: encrypted (AES-256-GCM) before it is saved, and opened only on our server at the moment of an AI call. Your browser only ever sees its last 4 characters.
• Social connections: when you connect Facebook, Instagram or LinkedIn, we keep the access tokens, encrypted the same way, plus the names, IDs and pictures of the profile, Pages and accounts you pick, and the IDs and links of posts we publish for you.
• Images and videos you upload for posts.
• AI use: for each AI call, the task, the model, the number of tokens and the cost, so you can see your spend.

What we never keep

• Google Maps details: business names, phone numbers, websites, ratings and reviews from Google are fetched live when you open a lead, and are not saved. We keep only the Google place ID, and the map position for at most 30 days, as Google's terms allow.
• Your AI key and tokens in plain text: they never go to your browser, into our logs or into your data export.
• Card or bank details: OneForAll is free and takes no payments.
• Ads and tracking: no ads, no ad cookies, no tracking or analytics scripts. We don't sell or rent your data.

Why we use it

We use your data only to run OneForAll for you: to show it to you, to publish the posts you approve, to send the text of an AI task to your AI provider when you ask, and to keep the app safe. We don't look at what is in your workspace unless you ask us for help or the law makes us.

If a law like the GDPR applies to you: we use your data because you asked us to run the app for you (a contract), and to keep it safe and stop abuse (a legitimate interest).

Who else gets data

We share data only with these services, and only what each one needs:

• Your AI provider (Anthropic or OpenAI, the one you pick): when you use an AI feature, the text for that task is sent with your own key. That can be brand facts, a draft, a job post or your résumé text. Their own privacy terms apply to what they receive.
• Resend sends your sign-in emails, so it gets your email address.
• Cloudflare: R2 stores the images and videos you upload, at public links that are hard to guess, because Instagram must fetch them from a link. Turnstile checks that a person, not a bot, is signing in.
• Meta (Facebook and Instagram) and LinkedIn, only if you connect an account: we send the posts you approve and read what publishing needs, like your list of Pages.
• Google or GitHub, if you sign in with them: they tell us your email, name and picture.
• Google Places and PageSpeed Insights: for leads, the words and area of a search go to Google Places, and the website address of a lead you check goes to PageSpeed Insights. Nothing about you is in those calls.
• OpenStreetMap: place searches on the leads map go from your browser to OpenStreetMap's Nominatim service, which sees your IP address.
• Job sites: we read public job lists from them. Nothing about you is sent to them.
• Our server host stores the database. Where it is: see the top of this page.

We may also share data when the law makes us, for example after a court order.

Data about businesses you find

Leads hold facts about businesses: from OpenStreetMap, from the business's own website (like a public email or phone number), and what you type. If a lead names a person, you decide to keep it and how to contact them, so you must follow the contact laws of your country and theirs. Add anyone who asks to your do-not-contact list.

Cookies

We use a few small cookies that the app needs: one keeps you signed in, the others remember your language, time zone, accent color and brand filter. Your light or dark theme is saved in your browser. There are no ad or tracking cookies.

How long we keep it

• Your data stays until you delete it or delete your account.
• Sign-in links work once, for 15 minutes.
• Sign-in sessions end after 30 days.
• When you delete your account, your sign-in, your workspace and everything in it are deleted from our database at once.
• Images and videos you upload, and the account pictures we save, are deleted from file storage too: right after you delete all your data or your account, and within a day after you remove an image or video.
• Database backups are kept for the time shown at the top of this page, then deleted.

Your rights

Wherever you live, you can:

• Get a copy of your data: Settings, Data and export exports everything as one JSON file, or each table as a CSV file.
• Fix it: change anything in the app or in Settings.
• Delete it: Settings, Data and export deletes all your data, or your whole account. See Delete your data.
• Ask, object or complain: write to the contact email at the top of this page. We answer within 30 days.

You can also complain to a data protection authority: in Tunisia the INPDP, in the EU the one in your country.

How we keep it safe

Pages load over HTTPS. AI keys and social tokens are encrypted. Each workspace's data is kept apart, and every request checks who you are. No system is perfectly safe: if a breach puts your data at risk, we tell you and the authorities as the law requires.

Children

OneForAll is made for adults at work. Don't use it if you are under 16.

Changes to this page

When this page changes, the date at the top changes too. For big changes, we also email you before they apply.