Privacy Policy

1. Who we are

OnePage is made by Bairat Labs, LLC, a company organized under the laws of the State of Delaware, United States. Bairat Labs, LLC is the data controller (or "business", under CCPA/CPRA terminology) responsible for the personal information described in this policy. Throughout this policy, "OnePage," "we," "us," and "our" refer to Bairat Labs, LLC.

2. Scope of this policy

This policy covers two things: the OnePage mobile app (iOS and Android) and this website (tryonepage.com), including our blog, guides, comparison pages, and free tools (custody schedule generator, expense split calculator, and similar). Where a section applies only to the app or only to the website, we say so explicitly.

3. Information we collect and why

OnePage is built to collect only what it needs to run the app. Here is what each category of app data includes and why it exists:

We do not collect device advertising identifiers or browsing history outside our own website. Handoff location fields are free-text entries. In versions that offer message location pins, you may separately choose to share coordinates from your device. OnePage asks for foreground location permission, lets you review the pin, and requires a separate send action. Cancelling the preview does not send a pin. A sent pin is stored with your account-linked family message and may contain precise location. We do not continuously track your location, request background location access, or collect motion or fitness data.

Opening a sent pin in a map service passes its coordinates to that service. Private stars and personal follow-up reminders are visible only to the parent who created them; shared pins are visible to both parents. Delivered means the recipient app acknowledged a message. Seen means it was displayed in the conversation, not that the recipient agreed with or understood it. Notification delivery alone does not establish either receipt.

Some fields in the children's info library, allergies, medications, and medical notes, are health-related information about your child. In some jurisdictions this counts as a special, more sensitive category of data with additional legal requirements beyond ordinary personal information. See Section 11 for how we handle this specifically.

4. How we store your data

OnePage's app data is stored using Google Firebase, a cloud platform operated by Google LLC, specifically:

• Firebase Authentication: manages your account and sign-in (email/password, Sign in with Apple, Sign in with Google).
• Cloud Firestore: stores structured data: your schedule, messages, expenses, and info-library entries.
• Firebase Storage: stores files you upload: photos, videos, receipts, and legal documents.
• Cloud Functions: runs backend logic such as invite handling, push notifications, and the AI features described in Section 6.

Firebase data lives in Google-operated data centers and is encrypted in transit and at rest (see Section 14). Access to your family's data is restricted by Firebase Security Rules to the accounts that belong to your co-parenting group; other OnePage users cannot see your information.

5. Sign-in methods

You can create a OnePage account using:

• Email and password: stored and managed by Firebase Authentication.
• Sign in with Apple: we receive a unique Apple ID token and, if you choose, a private relay email address. Apple's practices are governed by Apple's Privacy Policy.
• Sign in with Google: we receive a Google ID token and your public Google profile name and photo, if provided. Google's practices are governed by Google's Privacy Policy.

We never receive your Apple or Google password. Authentication is handled entirely by Apple and Google via OAuth 2.0.

6. AI features

Except for the optional AI onboarding route described below, OnePage uses Amazon Bedrock for generated answers and drafts and for search embeddings, which are numeric representations of text used to retrieve relevant records. These Bedrock requests use our AWS service endpoint in us-east-1; model routing may use other AWS regions within the United States. Generated responses use Anthropic Claude through Bedrock, and embeddings use Amazon Titan. These services process the content described below under AWS's service terms. This is not a claim that data stays on your phone or that all AI processing requires a separate button press.

Our onboarding backend retains private usage-reservation and result-state metadata to enforce limits and handle requests, not the raw setup narrative, returned model output or hashes of that narrative. The onboarding Worker's application Logs, Traces and Issues controls are disabled. This does not mean that Cloudflare or Anthropic retains no data, and it is not a zero-retention guarantee.

Anthropic's commercial API policy says inputs and outputs are not used to train its models by default; providing feedback or otherwise opting in can allow that use. Its API retention policy says inputs and outputs are deleted within 30 days under its standard arrangements, with exceptions for agreed arrangements, services with longer retention, Usage Policy enforcement and legal requirements. Policy enforcement or legal requirements can lead to longer retention. We have not verified special account-specific retention arrangements for this onboarding route and do not promise zero retention. These are commercial API practices, not the terms for a parent's personal Claude subscription.

Creating an onboarding draft, asking the assistant, preparing an AI activity draft and uploading a document are user-initiated actions. Indexing, eligible message follow-up analysis and scheduled summaries can run in the background. AI-generated output can be wrong; review proposed actions before saving them. See the Terms of Use for the full accuracy disclaimer.

7. Subscriptions

OnePage Plus subscriptions are managed through RevenueCat, a subscription management platform. When you subscribe, RevenueCat receives your purchase token from the App Store or Google Play and validates your subscription status. RevenueCat stores your subscription state (active, expired, or cancelled) linked to your account, but never receives your payment card details, those are handled entirely by Apple or Google.

8. Transactional email

We send account-related email, including verification, password resets, applicable setup and invitation reminders, subscription notices and opted-in weekly digests. Our transactional delivery provider is Zoho ZeptoMail. Reminder and digest messages include applicable stop or unsubscribe controls. We do not use your email address for marketing without your consent, and we never sell or rent your email address to anyone.

9. Push notifications

If you enable notifications, OnePage sends push notifications through Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM), routed via the Expo push notification service. These delivery services process device push tokens and notification payloads, which can include a title, a message preview and routing identifiers. Message location coordinates are not included in the notification body. We record send outcomes and supported notification interactions to assess reliability and usefulness; acceptance by a delivery service is not proof that you saw or opened a notification. You can disable notifications in your device settings or use the applicable controls in OnePage.

10. How we share your data

We share your information only in these specific circumstances:

• Within your family. Shared schedules, messages, expenses, info-library entries and shared photos are available to authorized family members according to their role. Care Circle access requires the applicable parent approvals and scopes. Private notes, private stars and personal message reminders are not shared with the other parent.
• With a map service you open. Opening a location pin passes its coordinates to that service, under its own privacy practices.
• With our service providers to operate and measure the app, including the hosting, AI, analytics, attribution, subscription and delivery services listed below.
• If required by law, such as in response to a valid subpoena, court order, or other legal process, or where necessary to protect the safety of a user or the public.
• In a business transfer, if Bairat Labs, LLC is involved in a merger, acquisition, or sale of assets, in which case we will notify you before your data becomes subject to a different privacy policy.

We do not sell personal information and we do not share it with advertisers, data brokers, or anyone for cross-context behavioral advertising, as those terms are defined under CCPA/CPRA and similar laws.

Here is the full list of service providers we share data with, what each one handles, and where to read more:

11. Children's information

OnePage is designed for use by adult parents and guardians, not by children. You must be at least 18 years old, or the age of majority in your jurisdiction, to create an OnePage account. We do not knowingly allow children to create accounts, and OnePage does not collect personal information directly from children; the app has no separate login or profile for a child.

The info-library feature lets a parent store information about their child (medical notes, school contacts, allergies) for coordination purposes between the two parent accounts. This is provided by the parent, about the parent's own child, and is visible only within that family's co-parenting group. We do not use children's information for advertising, profiling, or any purpose other than helping their parents coordinate care. If you believe a minor has created an account, or that a child's information was submitted in error, contact us at hello@tryonepage.com and we will remove it promptly.

12. Website cookies and analytics

tryonepage.com may use privacy-respecting analytics tools, such as Google Analytics, Microsoft Clarity, or PostHog, to understand aggregate visitor behavior (pages viewed, referring site, device type, content engagement, tool use, search result counts, and download, app-store, source-link, or contact clicks). This website asks every visitor before loading these optional tools. If you decline, their scripts are not requested and OnePage's custom analytics events are not sent. You can change your choice through the Cookie settings link in the website footer. Website analytics are not tied to your OnePage app account, and the website does not use third-party advertising cookies. We do not send raw website search terms, calculator inputs, custody schedules, family names, dates, income, expense amounts, or parenting-plan text through website analytics events.

13. Your rights and choices

You can exercise the following rights at any time:

• Access: you can access and review much of your personal information directly within the app.
• Correction: edit your profile, schedule, and info-library entries directly in the app.
• Export: OnePage Plus subscribers can export a PDF summary of their data from within the app.
• Deletion: delete your account from Settings → Account → Delete Account. What happens next depends on your family. If you are the only member of your co-parenting group, your family's data is deleted from our live database and file storage immediately, along with your login credentials. If you share a family with a co-parent, your own account and login credentials are deleted immediately, but messages, expenses, and other records you authored remain part of the shared family history, marked as authored by a removed user. We retain those shared records because OnePage is designed as a tamper-evident, append-only record both co-parents rely on, and because unilaterally deleting one parent's side of a shared, court-relevant record could itself cause harm to the other parent. This is our product rationale, not a statement of which specific legal exception (for example, under GDPR Article 17 or CCPA/CPRA) applies in a given jurisdiction; that determination should be confirmed with counsel and may mean this practice needs adjustment for some jurisdictions or circumstances.
• AI choices: you can complete onboarding manually without choosing "Create a draft," use manual activity entry instead of requesting an AI draft and choose not to request assistant answers or document extraction. Background processing described in Section 6 is not controlled by a single app-wide AI opt-out. Contact us with questions about processing or your applicable privacy rights.
• Opt out of marketing email: use the unsubscribe link in any digest email; account-critical email (like password resets) cannot be turned off while your account is active.

If you are located in the European Economic Area, the United Kingdom, California, or another jurisdiction that grants additional rights under laws like the GDPR, UK GDPR, CCPA/CPRA, or a comparable state or national privacy law, see Section 15 for how those rights apply and how to exercise them. We respond to verified rights requests within 30 days, or sooner where local law requires.

14. Data retention

Temporary extracted message-to-activity fields become unusable after 24 hours and are cleared by a subsequent scheduled sweep, subject to service availability and backlog. Successfully saving the activity clears those temporary fields immediately. This does not delete the original message, saved activity, source references or quota records. Sent location pins remain part of the shared message history and follow the shared-family retention rules below.

We retain your data for as long as your account is active. When you delete your account, Firestore records, Firebase Storage files, and your Firebase Authentication credentials are deleted immediately as part of that same request (subject to the shared-family exception described in Section 13), not on a delayed schedule. This does not cover routine, short-lived infrastructure backups our cloud providers may keep as part of their own disaster-recovery processes, those age out under our providers' standard backup cycles rather than being individually purged. RevenueCat retains purchase tokens and subscription status, no cardholder data, for as long as needed to meet standard financial record-keeping obligations under applicable law.

15. Security & encryption

We take the security of your family's data seriously:

• Encryption in transit. All data moving between the app, this website, and our backend is encrypted using TLS (HTTPS), including calls to Firebase, AWS Bedrock, RevenueCat, and ZeptoMail.
• Encryption at rest. Data stored in Firestore and Firebase Storage is encrypted at rest by Google using industry-standard AES-256 encryption; the same applies to data processed through AWS Bedrock.
• Tamper-evident records. Confirmed messages and expenses are cryptographically hashed and chained to their prior version, so any attempt to silently alter a historical record after the fact is detectable. This is an integrity mechanism, it makes tampering detectable, and is separate and different from encryption for confidentiality: it does not hide the content from OnePage's systems, it proves the content hasn't been secretly changed.
• Access control. Firebase Security Rules restrict read and write access to authenticated members of your specific co-parenting group. No other OnePage user can see your family's data.

No system is perfectly secure, and we cannot guarantee absolute security. If you believe you've found a security vulnerability in OnePage, please report it to hello@tryonepage.com.

16. International data transfers

OnePage is available globally, and our infrastructure providers (Google Cloud/Firebase, AWS) operate data centers in multiple countries, which may result in your data being processed outside your home country, including in the United States. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, such as Standard Contractual Clauses or an equivalent legal mechanism, as required by GDPR and UK GDPR, through our infrastructure providers' own data processing agreements.

Optional AI onboarding also uses Cloudflare and Anthropic's direct API. The AWS region description in Section 6 does not apply to that route. We do not promise that it is processed in your home country or a particular region, and have not verified an account-specific data-residency arrangement for it.

17. Legal compliance and applicable law

We design OnePage to comply with applicable privacy and data protection laws in the jurisdictions where we operate. Laws we specifically account for in how we've built and operate OnePage include:

• The General Data Protection Regulation (GDPR) and UK GDPR, for users in the European Economic Area and United Kingdom;
• The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and comparable state privacy laws including but not limited to Virginia's VCDPA, Colorado's CPA, Connecticut's CTDPA, and Utah's UCPA, for users in those states;
• The Children's Online Privacy Protection Act (COPPA), reflected in Section 11;
• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA);
• Australia's Privacy Act 1988 and the Australian Privacy Principles.

Data protection law continues to evolve, varies by jurisdiction, and can require specific formal steps beyond disclosure, for example, some laws require an in-region representative or a designated privacy contact for companies based elsewhere. Where a jurisdiction requires that kind of representative and we haven't yet named one here, that is a gap for us to close, not a suggestion that the requirement doesn't apply. Where the specific requirements of your local law grant you rights beyond what is described in this policy, that law governs, and you are welcome to contact us at hello@tryonepage.com to exercise those rights; we will work with you to honor them even where a formal process is not yet built into the app.

18. Changes to this policy

We may update this Privacy Policy from time to time as OnePage's features, or the law, change. If we make a material change, we will notify you within the app and update the effective date at the top of this page. This policy is a disclosure of our practices; our contractual terms with you are set out separately in our Terms of Use.

19. Contact us