Privacy Policy
Last updated: September 30, 2026
OneStep ("we", "our", "the app") turns a goal you type into a plan — milestones,
action steps, and daily habits — and helps you track it over time. This policy
explains what we collect, why, and how you can delete it.
Information we collect
- Account information. Your email address, and whether you
signed in with email/password, Sign in with Apple, or Google Sign-In.
- Content you create. The goals, milestones, action steps,
habits and day-to-day tasks you enter or generate, plus your daily habit
and task completion history.
This is the data the app exists to store — it's synced to our database so
it's available across your devices.
- Calendar access. Calendar features are optional and
only start once you turn them on.
Device calendar: after you grant the OS-level calendar
permission, OneStep reads the events on your device's calendars (their
titles and times) to show them next to your plan and schedule around them,
and adds your habits and action steps as events. You can hide individual
calendars in Settings. Events read from your device calendar stay on your
device, apart from the start and end times the "Today" planner uses
(see below).
Google Calendar: if you connect a Google account, you grant
OneStep access to view and edit events and to view your list of
calendars. We store a Google access credential (a refresh token) for that
account on our servers — it is never sent back to the app — together with
the account's email address and the calendar OneStep writes to. With it,
our server reads the events (titles and times) on that account's
calendars to show them in the app, and creates, updates and deletes the
events for your habits and steps. Event contents pass through to your
device; they are not stored on our servers. Disconnecting in Settings
deletes the stored credential, and you can also remove OneStep's access at
myaccount.google.com/permissions.
- Notifications. The daily reminder you configure in
Settings is scheduled on your device. No push token or notification data
is sent to us.
- Subscription status. Whether you're on the free or
premium tier. Purchases are handled entirely by Apple/Google and RevenueCat
— OneStep never sees or stores your payment card details.
- Diagnostic data. If crash reporting is enabled, basic
crash and error logs (device type, OS version, stack trace) are sent to our
error-monitoring provider to help us fix bugs. This never includes your
goal content or password.
How we use it
- To create your account and keep your goals, habits, and progress in sync
across your devices.
- To generate your plan: when you enter a goal, the text you provide is
sent to Anthropic's Claude API to produce the milestone/step/habit
breakdown. Anthropic processes this text to generate a response; it is not
used to identify you.
- To plan your day: when you use the "Today" brain dump, the text you type
is sent to Anthropic's Claude API, together with the titles and times of
the OneStep habits and steps already planned for today. If calendar access
is on, only the start and end times of your calendar events are
included, so the plan can avoid them — never their titles or details.
- To break a step into a checklist, revise part of your plan, or write
your weekly check-in: the step, plan or goal text involved is sent to
Anthropic's Claude API. The weekly check-in also includes your active
goal titles and how many times you completed each habit last week and
this week.
- To send the daily reminder notification you opt into.
- To show your calendar events alongside your plan and add your habits
and steps to your calendar, if you turn calendar features on.
- To determine your subscription tier and unlock premium features.
- To diagnose and fix crashes.
Your permission for AI features
OneStep asks for your permission before it sends anything to Anthropic,
and nothing is sent until you agree. You can turn this off at any time in
Settings → AI planning; with it off, OneStep sends nothing
to Anthropic, and features that need AI to build or change a plan won't
work until you turn it back on.
Who we share data with
We don't sell your data. We use the following service providers, each of
whom processes data only to provide their specific service to us:
- Supabase — hosts our database and handles
authentication.
- Anthropic — processes the goal and task text you submit,
and the progress summary described above, to generate your plan and
check-ins. Only with your permission.
- RevenueCat — manages subscription entitlement state.
- Apple / Google — process sign-in (Sign in with Apple,
Google Sign-In) and, for subscribers, all payment processing. If you
connect Google Calendar, Google's Calendar API also provides and receives
the calendar events described above.
- Sentry — receives crash/error diagnostics, if enabled.
Data retention
We keep your account data for as long as your account exists. You can
delete everything at any time — see below.
Deleting your account
Open the app, go to Settings → Delete Account, and confirm.
This immediately and permanently deletes your account and every goal,
milestone, action step, habit, habit-completion record and day task
associated with it, along with any stored Google Calendar credential. This
cannot be undone. Events OneStep already added to your calendar stay there
until you delete them. Deleting your account does not cancel an active
App Store or Play Store subscription — cancel that separately from your
device's subscription settings.
Children's privacy
OneStep is not directed at children under 13, and we do not knowingly
collect information from children under 13.
Changes to this policy
If we make material changes to this policy, we'll update the "Last
updated" date above.
Contact
Questions about this policy or your data? Email
tylerautonsmith@gmail.com.