Privacy policy

This page describes what ONE collects and what it does with it. It describes what the software does today, no more. Why most of your private material never reaches us is on Privacy by physics.

What we never receive

  • Your private key and your 24 words. They are made in your browser and are never sent to ONE.
  • The opener for your sealed notes. Notes are opened in your browser.
  • Your fingerprint. Touch ID runs on your device; we receive only a sealed copy of your key that it unlocks.

What we hold but cannot open

  • The sealed copy of your key, if you seal it to Touch ID or a passkey. It opens only with that passkey, on your device.
  • Your encrypted backup, if you make one. It is encrypted on your device with a key derived from your 24 words before it is uploaded.
  • Sealed notes sent to you. We store the encrypted text; only your key opens it.

What we collect

  • Account details when you sign up: your email address, or the profile your Google or GitHub sign-in or wallet returns.
  • Session cookies that keep you signed in. They are set for one.ie and its subdomains.
  • What you type to agents and in chat, and the records of what agents did for you (signals). Chat is stored readable on our servers so you can return to it.
  • Your public wallet addresses, and a record of each payment you send through ONE: recipient, chain, amount and transaction id.
  • When you buy: your email address and, for physical goods, your shipping address and name.
  • A visitor cookie, stored as a one-way hash in our analytics. Chat threads from visitors who are not signed in are linked to that cookie.
  • Your IP address, used as a rate-limit key for visitors who are not signed in, and kept for 24 hours.

Payments

Card payments are processed by Stripe. Your card number goes to Stripe and is never stored by ONE. We keep the order record: amount, currency, status and Stripe's identifiers.

Crypto payments are signed in your browser and sent from your own wallet. A public blockchain transaction is public by nature and ONE cannot remove it. Where a seller turns on escrow at pay.one.ie, the escrow address is held by ONE until the sale settles.

Personal data we seal

Email addresses, shipping addresses and similar fields from checkout are encrypted before they are stored, in a separate store we call the PII vault (AES-GCM). The order record keeps only a hash of your email and a pointer to the sealed value. Reading a sealed value is limited to callers with the right scope, and each read is counted.

Email

We send account and order email, and messages that groups send through ONE, using Postmark or Resend as the delivery provider. Those providers receive the recipient address and message content to deliver it.

Who we share with

Stripe (payments), Postmark and Resend (email), Cloudflare (hosting and storage), and the sign-in providers you choose (Google, GitHub). Agents call AI model providers with the text of your request in order to answer it; your keys and recovery words are kept out of what they are sent.

Erasure

You can ask for your data to be erased. Erasure shreds the sealed values for your account, including per-order shipping addresses, so they can no longer be read, and cascades through the records tied to you. A transaction already on a public blockchain cannot be erased by anyone. Write to security@one.ie and we will run it.

Not yet covered here

Retention periods (other than the 24-hour rate-limit key) and a dedicated privacy contact address are not yet defined. This page will be updated when they are.