Privacy Policy

Onereach is an audience analytics platform for content creators. We take privacy seriously and we’ve written this policy in plain English. It explains what we collect, why, and what control you have. By using Onereach, you agree to this policy.

1. Who we are

Onereach is operated by the team behind trackwithonereach.com. For privacy questions or data-rights requests, contact us at support@trackwithonereach.com.

2. What we collect

We collect three categories of data:

• Account data, your name, email, hashed password (or magic-link state), and subscription details. Provided directly by you when you sign up.
• Connected platform data, the metrics we retrieve for the accounts you link (follower counts, post engagement, content metadata, and, where a platform provides it, audience demographics). How we get this depends on the platform. For YouTube, you connect via Google OAuth and we receive the metrics Google exposes to you; we never store your Google password, only the OAuth tokens needed to fetch data on your behalf, encrypted at rest. For Instagram, Facebook, TikTok and X, you give us a public handle and we retrieve publicly available metrics for it through a third-party data provider; there is no OAuth, and we never ask for or hold any credential for those platforms.
• Usage data, basic technical info about how you use Onereach: pages visited, features used, error logs, and IP address. Used to keep the Service working and to improve it.

3. How we use it

We use your data to:

• provide the Service, render dashboards, run analytics, send digests and alerts;
• secure your account, prevent fraud, and debug issues;
• communicate with you about the Service (transactional emails, product updates);
• improve Onereach in the aggregate (e.g. understanding which features get used).

We do not sell your data, and we do not use it to train third-party AI models.

4. Connected platforms

When you connect a platform, you’re subject to that platform’s own terms and privacy policy. We integrate in two different ways.

YouTube uses Google’s official API via OAuth. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Instagram, Facebook, TikTok and X do not use those platforms’ official APIs. Instead, we request publicly available data for the handle you give us through RapidAPI, a third-party API marketplace, and the independent data providers listed on it. To do this we send that public handle to the provider. We never send your Onereach password, your email, or any platform credential, and we only ever receive data that is already publicly visible on the account. These providers operate their own infrastructure outside our control, and their processing is governed by their own terms.

You can remove a platform connection at any time from your Onereach dashboard, and for YouTube also from Google’s security settings. When you disconnect, we stop fetching new data and delete any stored OAuth tokens within 30 days.

5. Cookies

We use a small number of essential cookies, primarily to keep you signed in (an auth-session cookie set by Supabase) and to remember basic UI preferences. We don’t use third-party tracking cookies, and we don’t share data with advertising networks.

6. Service providers we share with

To run Onereach, we use a small number of trusted infrastructure providers, each bound by their own data-processing agreements:

• Supabase, authentication and database hosting.
• Vercel, application hosting and edge networking.
• Lemon Squeezy, subscription billing. They act as the merchant of record, so your payment details are given to and held by them, never by us.
• Resend, transactional and digest email delivery.
• RapidAPI and the independent data providers on it, used to fetch publicly available metrics for the Instagram, Facebook, TikTok and X handles you connect. They receive the public handle, nothing more.
• Anthropic, used to generate the AI content insights on your dashboard. When you view those insights we send the titles and engagement figures of your recent posts. Anthropic does not use this to train their models.
• Vercel Analytics, privacy-friendly, cookie-free aggregate traffic measurement.

Each is bound by its own terms and data-processing commitments. We don’t share your data with anyone else, and we never sell it.

7. Where data is stored

Data is stored on infrastructure operated by the providers above, primarily in the United States and the European Union. By using Onereach you acknowledge your data may be processed outside your country of residence.

8. How long we keep it

Active accounts: we retain your account data and connected-platform metrics for the life of your account, plus a 30-day grace period after deletion in case you change your mind. Logs and aggregated analytics: up to 12 months. Billing records: as long as required by law (typically 7 years).

9. Your rights

You have the right to:

• access the personal data we hold about you;
• correct anything that’s inaccurate;
• export your data in a portable format;
• delete your account and associated data;
• object to or restrict certain processing;
• lodge a complaint with your local data-protection authority.

Most of these are self-serve from your dashboard. For anything else, email support@trackwithonereach.com and we’ll respond within 30 days.

10. Security

We use industry-standard practices: TLS for data in transit, encryption at rest for sensitive fields (including OAuth tokens), least-privilege access controls, and regular dependency updates. No system is perfectly secure, but we’ll notify affected users promptly if a breach materially impacts them.

11. Children

Onereach is not intended for users under 16. We don’t knowingly collect data from children under that age. If you believe a child has signed up, contact us and we’ll delete the account.

12. Changes to this policy

We may update this policy as the Service evolves. If we make material changes, we’ll notify you by email or in-app at least 14 days before they take effect. The current version is always available at trackwithonereach.com/privacy.

13. Contact

For privacy questions, data-rights requests, or anything else, email support@trackwithonereach.com.