When you register we collect your email address and a hashed password (managed by Supabase Auth). We never store your password in plain text.
We store a SHA-256 hash of your API keys — never the raw key. The first 12 characters (prefix) are stored in plain text for display purposes only.
For billing and service operation we log: the model used, input and output token counts, credits deducted, your user ID, and the API key ID. We do not log the content of your messages.
Payments are processed by Stripe. We store only the credit pack purchased, amount paid, and Stripe session ID. We never see or store your card number, CVV, or full billing address.
Standard server logs may include IP address, browser/client type, and timestamps for security and debugging purposes. Logs are retained for 30 days.
We do not sell your data, use it for advertising, or train AI models on your usage.
Your API requests are routed to the following providers. Each receives your prompt content as required to generate a response. Their privacy policies govern their data handling.
| Provider | Purpose |
|---|---|
| Anthropic | Claude AI models |
| OpenAI | GPT models |
| Gemini models | |
| Stripe | Payment processing |
| Supabase | Database and authentication |
We use industry-standard protections: TLS encryption in transit, hashed API keys, AES-256-GCM encryption for OAuth tokens, row-level security on all database tables, and least-privilege service accounts. No system is perfectly secure — if you discover a vulnerability please contact us at privacy@oneforall.dev.
Depending on your location you may have the right to:
To exercise any of these rights email privacy@oneforall.dev. We respond within 30 days.
Our lawful basis for processing your data is contract performance (providing the service you signed up for) and legitimate interests (security, fraud prevention). You may lodge a complaint with your local data protection authority if you believe we have mishandled your data.
We do not sell personal information. California residents may request disclosure of categories of data collected and may request deletion. Contact us at the email below.
The service is not directed to children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us immediately.
We may update this policy. If changes are material we will notify you by email at least 14 days before they take effect. Continued use after that date constitutes acceptance.
Questions or requests: privacy@oneforall.dev