Oneliine Privacy Policy

Oneliine is operated by Valubyl Ltd, a company registered in Israel. Valubyl Ltd ("Oneliine," "we," "us," or "our") is the data controller responsible for your information.

This Privacy Policy describes how Oneliine collects, uses, and protects information when you use the Oneliine mobile application (the "App"). By using the App, you agree to the practices described in this Policy.

Information We Collect

We collect only the information needed to provide the App's journaling features:

• Account information. When you create an account, we collect your email address, or, if you use Sign in with Apple, the account identifier Apple provides. We never receive your Apple password.
• Journal content. The titles and text of the journal entries you create, whether written freely or through a guided session.
• Onboarding responses. Two questions asked once during setup, used to understand who uses the App. They do not affect your experience.
• Usage information. Basic activity needed to operate features, such as which guided sessions you have played and your progress within them.
• Subscription information. If you take out a paid subscription, we receive confirmation of its status from Apple or Google through our subscription provider: which product you purchased, whether it is currently active, and when it renews or expires. We never receive your card or payment details. See "Payments and Subscriptions" below.

We do not collect your contacts, location, photos, or health data, and the App contains no advertising software.

The App collects no device or advertising identifiers of any kind. Not Apple's advertising identifier (IDFA) or vendor identifier (IDFV), and not Google's advertising ID or Android ID. The subscription service we use offers this collection as an option; the App does not enable it. Nothing you do in the App is used to build an advertising profile, and we do not share your information with advertisers or data brokers.

The App uses one third-party analytics service, described under "Analytics" below, and one subscription management service, described under "Payments and Subscriptions" below.

How We Use Your Information

We use the information we collect to:

• provide and maintain the App and its journaling and guided-session features;
• keep your entries available to you across sessions and, where enabled, across your devices;
• create and secure your account;
• provide any paid subscription, restore purchases you have already made, and make subscriber content available on the devices you sign in to; and
• respond to your requests and support inquiries.

We do not use your journal content to train artificial intelligence models, and the App does not include any AI feature within the writing experience.

How Your Information Is Stored and Protected

Your account and journal content are stored on secure servers operated by our infrastructure provider, Supabase. Access is restricted through per-user access controls, so that other users of the App cannot access your entries.

Our Supabase database and file storage are hosted in Frankfurt, Germany (Amazon Web Services region eu-central-1), within the European Union.

Information is encrypted in transit using industry-standard protocols (HTTPS/TLS) and encrypted at rest by our infrastructure provider. On your device, your sign-in session and any unsaved drafts are held in protected system storage. We maintain reasonable administrative, technical, and physical safeguards designed to protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

You may also enable an optional Face ID or PIN lock to restrict access to the App on your device.

Analytics

We use PostHog, a product analytics tool, to understand how the App is used — which features people open, how often sessions are completed, how long entries take to write. This is how we decide what to build next.

What PostHog receives: the names of screens you open, the names of guided sessions you start and finish, and counts — the number of words in an entry, the number of seconds a session ran. It also receives standard technical information such as your device model and operating system version.

What PostHog never receives: anything you write. Not the text of your entries, not their titles, not the prompts you responded to. Not your email address or your name. Not your IP address, which we explicitly suppress, so no approximate location is derived from it. Your entries are identified to us only by a random identifier, and we do not send that identifier to PostHog either — so the analytics data cannot be linked back to any individual entry.

Your account is represented in PostHog by a random ID with no personal information attached to it.

PostHog data is stored on servers in the European Union. You can read PostHog's own privacy policy at posthog.com/privacy.

Payments and Subscriptions

Oneliine offers an optional paid subscription.

We never receive or store your card or payment details. All payments are processed by Apple (through the App Store) or Google (through Google Play) inside their own payment systems. Your card number, billing address, and any other payment credentials go directly to Apple or Google. They never pass through the App and are never stored on our servers.

To know whether your subscription is active — so that the App can make available what you have paid for on any device you sign in to — we use RevenueCat, a subscription management service.

What RevenueCat receives:

• your Oneliine account identifier, the same random identifier described under "Analytics" above, which is what allows a purchase made on one device to be recognised on another;
• your subscription and purchase history as reported by Apple or Google: which product you bought, whether it is active, and when it renews or expires;
• the platform you are using (iOS or Android); and
• your device's IP address, as any internet service receives when your device contacts it, from which an approximate country is derived. We never send RevenueCat your location, and the App never requests access to your location.

What RevenueCat never receives: anything you write. Not the text of your entries, not their titles, not the prompts you responded to. Not your email address, and not your name.

We keep a copy of your subscription status on our own servers — which product, whether it is active, and when it expires — so that the App can check what you have access to. That record contains no payment details.

You can manage or cancel your subscription at any time in your Apple or Google account settings. You can read RevenueCat's own privacy policy at revenuecat.com/privacy.

How We Share Information

We do not sell your personal information, and we do not share it with advertisers or data brokers. We share information only:

• with service providers that host and operate the App on our behalf (such as Supabase, Apple, Google, PostHog, and RevenueCat), under obligations to protect it;
• when required by law or in response to valid legal process; and
• to protect the rights, safety, and security of our users or the App.

Data Retention

We retain your information for as long as your account is active or as needed to provide the App. When you delete an entry, it is removed from our systems. When you delete your account, your account and its associated data are permanently deleted.

Records that Apple, Google, or RevenueCat hold about a purchase are kept under their own retention policies, since they are required to retain transaction records for tax, accounting, and fraud-prevention purposes. If you would like us to request deletion of your subscription record from RevenueCat, contact us at the address below.

Your Rights and Choices

• Access and correction. You can view and edit your entries at any time within the App.
• Deletion of entries. You can delete any entry, which removes it from our systems.
• Account deletion. You can permanently delete your account and all associated data at any time from within the App: open your profile tab — the last tab, labelled with your first name — and choose Delete account. This action is permanent. If you signed in with Apple, deleting your account also revokes the App's Sign in with Apple authorisation, so Oneliine no longer appears under Sign in with Apple in your Apple ID settings and any private relay address stops forwarding mail to us.
• Sign out. Signing out clears your session and any unsaved local drafts from the device.
• Subscription. You can manage or cancel a paid subscription at any time in your Apple or Google account settings.

Depending on your location, you may have additional rights under applicable law, such as the right to access, correct, delete, or obtain a copy of your personal information. To exercise these rights, contact us at the address below.

Children's Privacy

The App is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

Third-Party Services

The App relies on Supabase for backend hosting, on Apple for optional Sign in with Apple, on PostHog for product analytics (see "Analytics" above), on Apple and Google for payment processing, and on RevenueCat for subscription management (see "Payments and Subscriptions" above). Your use of those services is also subject to their respective privacy policies.

Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide notice within the App. Your continued use of the App after changes take effect constitutes acceptance of the updated Policy.

Contact Us

Oneliine is operated by Valubyl Ltd, a company registered in Israel, which is the data controller responsible for your information.

If you have questions about this Policy or your information, or wish to exercise any of your rights, contact us at yaakov@valubyl.com.