Privacy Policy

Who runs ONO

ONO is operated by ONO, Alberta, Canada.

What we collect

Your first name and email address, so we can send you a sign-in link and know who you are. Passwordless sign-in remains available. You can also choose an optional password for your own account. You enter it directly into the authentication provider; plaintext passwords are not stored in ONO application tables or logs. The provider handles password authentication under its own policies.

The document you upload (PDF, JPG or PNG, up to 10 MB), and what ONO writes about it: the explanation, your options, next steps and any draft response.

A record that you agreed to the Terms and this Privacy Policy: which versions, your four original confirmations, your separate permission to send your document to Google Gemini through Lovable, and when.

If you pay for a completed response or unlimited monthly or yearly access: purchase and subscription identifiers and status are associated with your ONO account ID (UUID). We also keep a record of which single-response purchase was used for a response, including valid purchases made at earlier prices. ONO does not receive your card details. Website payments are handled by Stripe through RevenueCat; iPhone and iPad in-app purchases are handled by Apple, with RevenueCat tracking their status.

If you use Contact ONO: what your request is about, your message, when you sent it, and its status.

Who helps us run ONO

Lovable Cloud stores your account, your document and ONO's results, and sends the sign-in email.

Before you upload a document, we ask for your separate permission to send it to Google Gemini through Lovable's AI service to read it and create the explanation and any response. We do not send your document for this without that permission.

On the website, Stripe takes payments through RevenueCat. On iPhone and iPad, Apple handles in-app purchases. RevenueCat keeps track of purchase and subscription identifiers and status linked to your ONO account ID (UUID). ONO checks with RevenueCat to verify paid access.

These services have their own privacy policies: Lovable, Stripe, Apple, RevenueCat.

What we delete, and what we keep

Your document, the explanation and any draft response are deleted from ONO's active records when you tap Delete & exit, or automatically after you have been inactive for 30 minutes — a scheduled cleanup then removes them, normally within 5 more minutes. Delete & exit also signs you out.

This deletion covers ONO's active document and result records. The services that help run ONO, and their backups, may keep their own records for longer under their own policies.

Delete & exit does not delete your account. While you keep an account, we keep your agreement record, sign-in account and used single-response purchase records.

You can request account deletion through Delete account, with fresh email authentication and typed confirmation. Its default is to delete consent evidence and all user-linked active ONO records with your account, including profile, contact requests, documents, explanations, saved responses and user-linked purchase-use records. No legal obligation to retain consent evidence is established here. An exception requires a specific applicable legal hold to be documented, with its scope and review or release conditions; there is no general consent archive.

The process keeps only a one-way fingerprint of each spent purchase identifier in a separate global list to prevent reuse, only while its provider receipt could restore credit. The list has no ONO owner or account mapping, name, email, amount or timestamp. It is not used as consent evidence or for advertising. This does not erase or anonymize provider records.

After verified completion, the process removes the old account identifier and work records. Only a minimal request reference, secret status-recovery fingerprint, completed status and completion time remain for no more than 30 days, then are purged. The recovery secret can connect its holder to the request during that period; the receipt is private, not anonymous. Unfinished requests retain only the information needed to reconcile cleanup, stay pending, and never expire into completed status. A missing or expired receipt is not proof of completion.

Stripe, Apple, RevenueCat, Lovable and other providers may keep their own payment, processing, delivery or backup records under their own policies. ONO active-record deletion and the 30-day recovery limit do not promise removal of provider records or copies you saved, shared or emailed. Account deletion does not cancel subscriptions; cancel separately with the payment provider.

Contact requests are kept separately from your documents and are not removed by Delete & exit.

Your choices

You can ask to see, fix or delete your information, or delete your account, through Contact ONO. We review each request.

You can request account deletion through Delete account, with fresh email authentication and typed confirmation; your request stays pending until cleanup is verified. The process follows the purposes and limits above, not indefinite retention of consent or user-linked audit records.

Response email

Email my response is your choice. ONO uses your currently verified account email and the saved response to send the email through Lovable Emails. It does not send your original document, a sign-in link or a session token, and does not send marketing or forward to other addresses.

An email copy remains in your mailbox after Delete & exit or ONO account cleanup. You control that copy through your email service. Lovable's privacy policy linked above applies to its processing and retention; your mailbox provider has its own policy. ONO does not promise removal of their delivery records or backups.

ONO checks your verified email and your private, unexpired saved response again before sending. If ONO knows the response has been deleted, it will not start sending. Leaving the page or putting the app in the background clears its email status, but cannot recall an email already accepted for sending.

If sending cannot be confirmed, ONO does not automatically send again. Check your inbox before trying manually again; another request could send a duplicate. Lovable Emails applies its sending limits and handles blocked addresses and unsubscribe requests.

Optional response email is available for an eligible saved response that ONO can verify was paid for, while it remains private and unexpired in ONO. Older saved responses without verifiable payment proof stay readable and copyable, but cannot be emailed.

Mobile Home advertising

Advertising is off in this source draft. When enabled after review, Google AdMob may show non-personalized banner ads only on the mobile Home screen. The website does not add ads or advertising trackers in this version. Ads do not appear beside your document, explanation or response.

When ads are enabled and permitted, Google may process basic device and network information, such as IP address, device or operating-system information, and ad events such as impressions or clicks. Non-personalized ads still involve data processing. Google keeps its records under its own policies; ONO does not promise a new retention period or removal of Google's backups.

ONO does not send your name, email, account or document ID, problem type, uploaded file, explanation or response to an ad network. ONO does not add personalized ads, Firebase Analytics, fingerprinting, IDFA use or cross-app tracking.

Before requesting ads, ONO must respect the applicable Google privacy choices. You can change these through Ad privacy options when advertising is enabled. If permission or subscription status cannot be confirmed, ads stay off without blocking ONO. Accepting ONO's document agreement is not advertising permission.

Read Google's Privacy Policy and how Google uses advertising information.

What we do not do

Your document is private. It is never shared through a public link, and other people cannot see it.

ONO does not use document or account information for advertising. The mobile Home-only advertising described above is separate from document processing; no advertising trackers are added to the website in this version.