Privacy Policy

Last updated: 20 July 2026

This Privacy Policy explains how One Chat ("we", "us"), a business based in New South Wales, Australia, collects, uses, and protects personal information when you use our websites and applications (the "Services"). It is written to comply with the Australian Privacy Principles, and — because our users are worldwide — with the GDPR, UK GDPR, and US state privacy laws including the CCPA/CPRA.

Three commitments define this policy:

We never use your conversations to train AI models — ours or anyone else's.
Your messages travel to AI providers only on zero-data-retention terms.
When you delete something, it is actually deleted.

1. Information we collect

You provide:

Account details — email address, password (hashed), and sign-in provider (Google, Microsoft, or email).
Conversations — your messages ("Inputs"), the AI's replies ("Outputs"), files you upload, and things the Services build for you (documents, spreadsheets, code).
Memory — facts, preferences, and lessons distilled from your conversations to personalise future answers.
Connected-app content — when you link a third-party app (e.g. Gmail, Notion, a calendar), the access tokens you authorise and the specific content fetched to answer your requests.
Feedback and reports — ratings, feedback reasons, bug reports, and screenshots you attach.
Payment details — handled by our payment processor; we never see full card numbers.

Collected automatically:

Usage data — messages sent, models used, message-credit consumption, features used, timestamps.
Device and log data — IP address, browser and OS type, approximate region derived from IP, and security logs.
Cookies — strictly necessary cookies for sign-in and preferences. We do not use advertising cookies or cross-site trackers.

We do not knowingly collect sensitive information (such as health information) as a category — though your conversations may contain whatever you choose to write, and we treat all conversation content with the protections in this policy.

2. How we use information

Purpose	Examples	Legal basis (GDPR)
Provide the Services	Answering your messages, building memory, running connected-app actions, syncing your account	Contract
Billing and plans	Managing subscriptions, credit allowances, preventing abuse of free tiers	Contract; legitimate interests
Security and integrity	Preventing fraud, enforcing rate limits, investigating abuse	Legitimate interests; legal obligation
Support	Responding to reports and requests, diagnosing bugs you tell us about	Contract; legitimate interests
Service communications	Receipts, notices about changes to terms, security alerts	Contract; legal obligation
Product analytics	Understanding which features are used, in aggregate	Legitimate interests
Legal compliance	Responding to lawful requests, keeping required records	Legal obligation

What we do not do: we do not use your conversations, files, memory, or connected-app content to train AI models; we do not sell or share personal information for advertising; we do not show ads.

Automated processing. The Services are built on AI: your messages are processed by machine-learning models to generate replies, and your conversations are processed to build your personal memory. These processes personalise your experience but are not used to make decisions with legal or similarly significant effects about you.

3. Who receives your information

We share personal information only with service providers who process it for us, under contracts that restrict their use of it:

AI model providers — your messages (without your account identity) are routed through an AI model marketplace to the model you select. Routing is restricted to zero-data-retention endpoints: the provider processes the request, returns the answer, and retains nothing. Providers that train on user content are excluded from routing entirely.
Infrastructure — database, authentication, and file storage; application hosting and delivery.
Memory processing — a dedicated memory service that stores and organises your personal memory in a partition private to your account.
App connections — an integration service that executes the connected-app actions you authorise.
Web search — when you enable web search, your search queries (not your identity) are sent to a search provider.
Payments — a payment processor handles card details and billing.

We may also disclose information where required by law or to protect the safety of any person, and, if the business is sold or reorganised, to the successor entity under this same policy (we would notify you).

We may disclose personal information to service providers located overseas, principally in the United States. Where we do, we take reasonable steps consistent with Australian Privacy Principle 8 to ensure recipients handle it consistently with the APPs, and for European and UK data we rely on adequacy decisions or standard contractual clauses.

4. Google user data

Where you connect Google services, One Chat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the features you request, is never used for advertising, and is never used to train AI models.

5. Retention — and real deletion

Conversations, files, artifacts, memory — kept while your account is active so the Services can serve you your own history.
Delete a conversation or memory — it disappears from your account immediately and is permanently removed from our systems, including backups, within 30 days.
Erase all memory — one control in Settings removes everything the assistant remembers, effective immediately.
Delete your account — one control in Settings. Your login, conversations, artifacts, memory, usage history, and connected-app tokens are deleted immediately, and residual copies are purged from backups within 30 days. We keep nothing to "restore later". Limited billing records may be retained where tax or accounting law requires.
Security and billing logs — retained up to 12 months, or longer where the law requires.

6. Your rights and controls

Built into the product, no request forms:

See your memory — every fact and lesson on one page.
Correct or delete any memory, lesson, or conversation.
Export everything — one click downloads your chats, artifacts, and memory in a portable format.
Delete your account — one click, described above.
Disable memory per conversation, and revoke connected apps at any time.

Depending on where you live you may also have statutory rights to access, correct, delete, restrict, or port your personal information, to object to processing, and to withdraw consent. We honour these for all users regardless of location — contact privacy@one-chat.app and we will respond within one month.

We do not sell personal information, and we treat Global Privacy Control signals as an opt-out of any "sale" or "sharing" as those terms are defined by US state laws.

Complaints. You can complain to us first and we will respond promptly. You can also complain to your local regulator — in Australia, the Office of the Australian Information Commissioner (oaic.gov.au); in the EU, your data-protection authority; in the UK, the ICO.

7. Security

Personal information is encrypted in transit and at rest. Stored API credentials are sealed with envelope encryption and are never displayed after entry. Access to production systems is restricted and logged. No system is perfectly secure; if a breach occurs that is likely to result in serious harm, we will notify you and the relevant regulator as required by law.

8. Children

The Services are for adults. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it.

9. Changes to this policy

We will post any changes here and update the date above. For material changes we will notify you by email or in the product at least 30 days before they take effect.

10. Contact

Privacy questions or requests: privacy@one-chat.app

One Chat, New South Wales, Australia.