Privacy Policy

Who is responsible

One: Think Together is provided by One Think, Inc. This policy covers the One app and its connected service. The company website and other One Think products have separate privacy information.

Age and children

One is intended for people aged 13 and up, subject to any higher local minimum age and permission requirements. It is not intended for children under 13. If you believe One has collected information from a child under 13, contact privacy@onethink.io so we can investigate and address the account and its information. One does not verify age through Apple or Google sign-in.

Your account and shared information

When you sign in with Apple or Google, your chosen provider and Firebase Authentication process your sign-in. One receives your account identifier, name, email address and verification status, and any profile image supplied by Google. If you choose Apple’s Hide My Email, One receives the private relay address instead of your personal email. One does not receive your Apple or Google password. You can choose a separate display name in One.

One stores the Circles you create or join, their details and membership settings, answers and replies you choose to post, their author names and timestamps, invitations, activity and read state, notification choices, blocks, reports and account-deletion requests. We use this information to provide the features you request, enforce access decisions, prevent abuse and handle support and deletion.

Authorized Circle members can read posted writing. One’s service can also process it; shared writing is not end-to-end encrypted. Other people may remember, copy or capture information they can read. Leaving a Circle or deleting your copy cannot recall their independent copies.

Drafts and private preferences

Unsent answer and reply drafts are encrypted on your device and kept separately for each account. Typing, saving, closing a draft or signing in does not post it. Only your explicit posting action sends the writing to a Circle. Signing out keeps your saved drafts for that account.

Your local interests and conversation preferences stay private until you choose to submit them. Asking One to find a Circle uses the chat messages you submit without publishing a profile or sending your saved preferences automatically. Turning on discovery separately publishes the reviewed name and preferences for matching. Editing local preferences does not automatically update a shared profile.

Writing retained from earlier versions belongs to the device’s installation rather than a signed-in account. Signing out does not erase it. Anyone who can unlock that local app data may be able to read it. Exporting writing creates a readable copy for the destination you choose, outside One’s encrypted storage.

Ask One, daily questions and Claude

One uses Anthropic’s Claude API to prepare daily questions for Circles. Claude does not post in Circle conversations. One may send the Circle’s purpose, topic and earlier questions to generate the next question.

Ask One is an optional chat for finding Circles. Before your first message is sent to Anthropic (Claude), One asks for your permission and explains what will be shared. One records the version of that explanation, your choice and its date for your account. You can turn off future AI messages in Settings. Turning this off does not delete saved chats or undo requests already sent.

When you send a message with that permission enabled, One sends the message, recent messages from that selected chat and a limited set of public Circle descriptions and tags to Claude. It does not include your other chats, account identity fields, saved preferences, member writing or private Circle details. Anything you type in the selected chat can be included, so avoid entering information you do not want processed by Anthropic. Ask One suggests Circles for you to review; it does not publish a profile, join a Circle or contact anyone.

Sent messages, One’s replies, suggested Circle cards, chat names and dates are saved in Firebase as private history for your One account. Other members cannot browse that history, but One’s backend and service providers process it to provide the feature; it is not end-to-end encrypted. You can keep separate chats, reopen or rename them, delete individual chats, or delete all Ask One history. Unsent chat drafts are encrypted only on your device and are not sent just because you type, switch chats or close the app. Locking One hides the chat from view; closing or backgrounding the app does not delete saved history.

One also uses Claude to assign search tags to discoverable Circles from their public names, purposes and topics. Those tags are stored in Firebase, updated when the public details change, and removed when a Circle becomes private or closes. Chat request limits use content-free counters.

Using your posted writing as context is optional and off by default. If you enable it, eligible excerpts of answers and replies posted after that choice may be used within their own Circle. One does not send your private drafts or account identity fields for this purpose. Turning the setting off stops future use of your writing, but does not erase questions already created. Public discovery does not show questions derived from member discussion.

For daily-question generation, One does not store the raw context as a separate conversation archive. Ask One’s saved history is described above. Anthropic processes API requests under its applicable commercial terms and retention rules; these can include security, abuse-prevention and legal retention. See Anthropic’s API data-retention information. The optional Test prompt in Developer options sends only a synthetic question request and an optional topic you enter.

Invitations, safety and notifications

An invitation is checked against its intended verified email address or account. One stores a matching hash or account identifier and a masked recipient hint. Creating an invitation does not automatically send email. Reviewing an invitation does not join its Circle.

Basic automated checks on One’s server can reject obvious abuse in names, Circle details and writing you submit to share. These checks do not send the text to an AI provider, keep a separate copy of rejected text, or scan private drafts. They cannot detect every harmful message; reporting and human review remain available.

If you report writing, One receives the selected content, your reason and any note you provide. Authorized reviewers can access the restricted report copy to assess it. Blocking is a separate choice. Membership, blocking and thread-notification settings determine access and delivery.

Remote notifications require your opt-in and iOS permission. One and Apple process a device token and account/installation binding to deliver them. Push payloads use generic One text, without answers, replies, names or Circle names. Daily reminders are separate local notifications. You can change these choices in One and iOS Settings.

Service providers and technical information

• Google and Firebase provide sign-in, the shared database, private Ask One history, backend processing and app-integrity checks. Their services can process account and app-installation identifiers, device-integrity tokens, IP addresses and request information needed to deliver and protect the service. See Firebase privacy information.
• Apple provides optional Sign in with Apple, device-integrity checks, push delivery and the App Store or TestFlight. Apple processes information under its own privacy policy.
• Anthropic processes the chat messages, public Circle details and limited daily-question context described above.

To understand which invitations lead to conversations, One keeps account-linked dates for opening question links and reviewing invitations, preparing question shares, first joining and contributing, receiving a human reply, and active days. These measurements contain no writing, email address or invitation secret and are removed when you delete your account. See link and activity privacy for browser action counts and their retention.

One’s app does not include advertising SDKs or Firebase Analytics. Firebase and Google Sign-In may collect diagnostic, device and usage information for service operation, security and SDK analytics. Infrastructure providers may retain operational and security records. If you contact us, we receive your message, contact information and anything you include. Please avoid sending another person’s private writing unless it is necessary for your request.

The shared database is hosted in the United States. We and our providers may process information in countries different from where you live. Applicable provider agreements govern their processing and international transfers.

Retention and deletion

Account information and shared writing remain while needed for the service or until you use the relevant removal or account-deletion controls. You can remove your own contributions even after leaving a Circle. Deleting an answer may leave an empty marker so other people’s replies remain available. Account deletion also covers private Ask One history and writing in Circles you previously left. It does not erase other authors’ writing or copies held outside One.

• Ask One history stays until you delete the chat, delete all Ask One history or delete your One account. Chat deletion removes the saved messages, replies, titles and suggested cards. A content-free chat identifier and deletion date remain until account deletion so delayed requests cannot restore a deleted chat. Limited permission records remain with your account.
• Unresolved reports expire 30 days after submission. Resolving a report removes its copied writing and note sooner. Moderation records expire 30 days after the action. Deleting an involved account also removes the relevant reports and moderation records.
• Push-registration leases last 30 days unless renewed. Delivery bookkeeping normally expires after seven days.
• Short-lived abuse counters expire after 24 hours. Completed deletion fences last two hours and limited completion receipts last seven days.
• Disaster-recovery history and daily backups are retained for up to seven days. Deleted information may remain in these restricted recovery copies until they expire. A minimal account identifier and deletion date are kept for eight days so a recovery can reapply account deletion before restored data is used.
• Unfinished deletion jobs remain until processing completes. Automated cleanup is asynchronous; One checks expiry when deciding whether records can still be used.
• Invitation expiry prevents acceptance but does not automatically erase invitation history.

For accounts using Sign in with Apple, deletion asks you to authenticate again and revokes One’s Apple sign-in access. This does not delete your Apple or Google account.

Cloud-account deletion and erasing local writing are separate actions. Drafts and the older local vault remain until removed on the device. Deletion can take time to complete; One provides progress and recovery rather than treating a request as instant completion. Providers may have separate retention duties. Support correspondence is retained as needed to answer the request and meet applicable legal obligations.

Your choices and requests

Edit your display name on the You profile. Use One’s settings to manage discovery, permission to send Ask One messages to Claude, optional shared-writing context, notifications, blocked accounts or account deletion. Ask One’s chat list provides rename and deletion controls. Device settings control system permissions. Contact privacy@onethink.io for access, correction, deletion or other privacy requests. Depending on your location, you may have additional rights to object, restrict processing, receive a copy or complain to a privacy regulator. We may need to verify your identity before acting on a request.

Where a legal basis is required, processing supports the service you request, your choices and consent where applicable, our legitimate interests in operating and protecting One, and legal obligations. Withdrawing an optional choice stops future processing covered by that choice; it does not undo processing already completed.

Changes to this policy

We will update this page when One’s privacy practices change and provide additional notice when required. The effective date above identifies the current version.