This is the Privacy Policy for the Oneway ecosystem: the Oneway App, the Oneway OS, Sign in with Oneway on any site, oneway.center, and any other or future Oneway service. It is published by Oneway Technologies LLC, a New York limited liability company. Oneway is in closed beta. Last updated October 18, 2026.
| What | Details | Why |
|---|---|---|
| Account | Your email and password. The password is kept only as a one-way hash. If you turn on two-step sign-in, its secret is kept encrypted and its recovery codes as hashes. | To sign you in and keep the account yours |
| Profile | Name, @handle, pronouns, bio, a location you type, website, links, picture, banner, and a birthday that stays private | To show you as you choose |
| What you post | Posts, photos, videos, comments, reactions, saves, reposts, drafts and the feeds you build | To publish what you make |
| Messages | Messages, files and reactions in chats, and the groups you are in | To deliver them |
| Places and plans | Centers you join, follow, save or visit. Events you answer. Bookings: your name, email, party size, dates and notes. An application to a Center's job or class listing opens a conversation with that Center. If you message or book a Center without an account, we keep what you send for that Center: your words, the name you give and the way to reach you that you give, an email address or a phone number as you typed it. | To run your plans |
| Location | Only if you turn sharing on. Never read from your device otherwise. | To show where you are, to the people you choose |
| Connected accounts | The access another platform gives us, and the account's name and ID | To post for you and show what is connected |
| Notes and ratings | Notes you add to other people's content, and your ratings of notes. An AI assessment of a note is stored next to the community's, never instead of it. | To give content context |
| Reports | Reports and appeals you send us | To review them |
| What | Details |
|---|---|
| Sessions | When a session started and was last used, and the network address or browser it came from. You can see them and end them. |
| Security log | Sign-ins, refused sign-ins to your account, and password and two-step changes, with the network address |
| What reached your screen | Which posts you were shown, how many times and when last, so Home does not repeat itself |
| How you watch | Whether you watched a video to the end, watched it again, how long you stayed, or skipped it. It shapes the next posts in Home and fades within minutes to hours, but not for a person under 18, whose Home it does not shape. We do not label posts by topic or guess your interests from your words. |
| Photos | Hidden data inside a photo, such as GPS position, is removed before it is stored. Videos and GIFs are stored as uploaded, with whatever their phone wrote into them. |
We use a sign-in cookie and your browser's storage for settings such as theme. We use no advertising or analytics cookies and no analytics trackers, and we do not track you across other sites or apps, so there is no tracking to opt out of. Some pages in the App and OS load fonts and map code from Google Fonts and unpkg, which can see your network address.
We do not read your messages to rank posts or show ads. Moderators cannot open conversations. No decision about you is made by automated means alone: recognition only suggests and a person at a business confirms, and an automated check on a report can only change its place in the queue.
| What | Who |
|---|---|
| Profile, posts, followers, who you follow | Everyone, unless you turn on Private profile. Also yours to set: Show who follows you, Show who you follow, Anyone can comment, Anyone can tag you. |
| Messages | Only the people in the conversation. A message to a business goes to whoever it set up to receive it: its AI assistant, a person, several people or a team. The conversation says which. |
| Activity and typing | Others, until you turn Show when you are active and Show when you are typing off |
| Events | The number going is public. The list is the organiser's. A friend going to the same event sees that you are going too. |
| Location | Off until you turn it on. You choose who: nobody, up to 25 named people, followers, friends, people in your Centers, or everyone, including people not signed in. You choose how exact: exact or about 1 km. You choose how long: 1 to 24 hours, or only while you use the app. We keep only your latest position, and turning sharing off deletes it. |
| Center pages | A Center's public pages are published to search engines, maps and AI assistants. This never includes a person's private information. |
| Search and suggestions | People can find you by name and you can be suggested to people you may know, until you turn those off |
A business keeps a guest list: the hotel you stayed at, the restaurant you booked. Recognition lets it see that a record is you.
| Setting | Default | What it says |
|---|---|---|
| Let places recognise you | On | A place can match its guest list to you by your name, photo, bio and what you post publicly here, and someone there confirms it. Off means no place is shown that a record is you. |
| Include accounts you connect | Off | Your X, Bluesky or Mastodon account can match you too. Off until you turn it on. |
Both are in Settings, under Privacy. Turn the first off and no business is shown a match or suggestion about you. We never tell a business that you exist and said no.
| Platform | How it connects |
|---|---|
| Instagram, Facebook, X, Threads, LinkedIn, TikTok, YouTube, Pinterest, Reddit, Google Business Profile | Through the platform's own sign-in screen |
| Mastodon | You approve it on your server |
| Bluesky | Your handle and an app password, never your main password |
| Telegram, Discord | A bot token and channel, or a webhook address |
| Casino record | Details |
|---|---|
| Identification | For reports the law requires, a casino collects name, address, date of birth, ID type, number and issuer, and taxpayer number where one exists. ID and taxpayer numbers are sealed, shown masked, and every opening is logged. |
| Reports and cases | Currency transaction reports and suspicious-activity cases. A suspicious-activity case is never disclosed to the person it concerns, so we cannot tell anyone whether one exists. |
| Exclusions and limits | Exclusion lists, and limits a person sets on themselves, which that person sees in the App |
| With | What |
|---|---|
| People you choose, and businesses you deal with | As the sections above say |
| Sites you sign in to with Oneway | An ID that is different on every site and your public profile. Your email only if you tick Share my email. You can revoke a site in Settings. |
| Platforms you connect | What you post there and what you ask us to import |
| Apps and integrations built by others | Only what a Center has granted. A grant is per Center and can be revoked. |
| AI providers | What you give an AI feature, when you use one. The code can use xAI, Groq, OpenAI, Anthropic and fal (images). |
| Resend | Your email address and the message, to send account email |
| Stripe, Twilio | Only if a business turns on payments or texting |
| OpenStreetMap Nominatim | The words you search for and the map area, not who you are |
| GitHub | Hosts oneway.center and may log visits. Where the App itself is hosted will be named here before it opens to the public. |
| Authorities | When the law, a court order or a regulator requires it, or to protect someone's safety |
We do not sell your information and we do not share it for advertising, so there is nothing for a Global Privacy Control signal to opt you out of. If Oneway is merged or sold, we will tell you first.
| What | How long |
|---|---|
| Account | Until you delete it. After that we keep your email address, the date you joined and the date you left, so no one else can register the address and inherit your history. |
| Posts | Deleting a post removes it from view. The record stays in our database. |
| Messages | A new conversation starts with messages that disappear after 2 days. The room's settings decide who can change that. When a message expires it is hidden, and its words, attachments and reactions are erased from our database the next time the conversation is opened. Attached files are not yet removed by this. Older conversations keep their messages until a timer is turned on. A business may be required to keep its conversations longer, and the conversation says so. |
| Location | Your latest shared position, until it expires or you turn sharing off |
| Orders | A paid order is kept as the Center’s record of a sale, for as long as the Center keeps its records; the Center decides, and you ask the Center to see or correct it. An order that was never paid is deleted after 7 days. |
| What you send a Center without an account | Kept for that Center, as one of its messages or bookings. The Center decides how long, and you ask the Center to see, correct or delete it. |
| What reached your screen | Kept until you delete your account, which removes it. We have not set an end date before then. We will set one and publish it here before the App opens to the public. |
| The security log | Kept after you delete your account too. We have not set an end date. We will set one and publish it here before the App opens to the public. |
| Casino compliance records | At least five years, as the law requires. They cannot be deleted on request. |
| Backups | We will state the backup period here before the App opens to the public. |
| Legal holds | We may keep records longer when the law, a regulator or a legal claim requires it, and only for as long as it does. |
| You can | How |
|---|---|
| See what Oneway knows about you | Settings, Understanding. For a full copy, email us. A copy covers your posts, comments, follows, memberships, profile, event answers and places. It does not yet include messages, bookings, location, connected accounts, what reached your screen, linked identities or the security log. |
| Correct it | Edit your profile any time. Remove linked identities in Settings. |
| Delete your account | Settings, Delete your account, with your password and your code if two-step is on. If you own a Center, hand it over first. |
| Turn things off | Recognition, matching by connected accounts, location sharing, being found by name, suggestions, each kind of notification, the weekly email, and your rewards standing moving between businesses |
| Choose who can message you | Friends, people from your Centers, people you have crossed paths with, or anyone. New people can wait in requests. |
| Removed | Stays |
|---|---|
| Every session. Your profile, picture and search listings. Your posts from view, and your reactions, reposts and saves. Your follows, blocks and mutes. Your Center memberships and your own space. Sites you signed in to with Oneway. Photos, videos and files you uploaded. What your Brain kept. The accounts you connected, with the access we held for them. Your linked identities. Your shared location. What reached your screen, and what the feed learned from it. Your list of bookings. Your notifications. | Comments and messages you left in other people's conversations, shown as Deleted account. The minimal record described above. Records a business keeps about you, including its bookings. The security log. Records the law requires. |
Deleting your account removes the access we held for each connected account. It does not remove Oneway from each platform's own list of connected apps. Remove it there too, in the platform's settings.
Depending on where you live, such as California, Colorado, Connecticut, Texas, Virginia, New Jersey and other states, you may have the right to know what we hold about you, to get a copy, to correct it, to delete it, to opt out of sale, sharing for advertising and profiling, and to appeal if we say no. We do not sell your information or share it for advertising, and you can turn recognition off at any time.
To use a right, email williamrau78@gmail.com. We answer within 30 days, and may need to confirm it is you. You may ask someone to act for you; we will ask for proof they can. Using your rights will not change how we treat you. If we refuse, reply with the word Appeal and someone who did not make the first decision will review it and tell you the result in writing within 45 days. For Facebook and Instagram data, see Data Deletion.
You can look around Oneway without signing in. We make no account and no record of you for it. A like or dislike you press is kept in your browser, on this device, and is not sent to us; when you sign in, it is sent once, as you. Nothing you do signed out becomes a page or appears in search. To comment, repost or save, you sign in. You can also message a Center from its page, book a table and pay a Center without an account; the sections above and below say what is kept when you do.
When you buy from a Center through Oneway, you do not need an account. You pay on Stripe’s own page, to the Center’s Stripe account. Your card details go to Stripe and never to Oneway, and Stripe keeps your email address, billing address and shipping address. We keep the order: what it was for, how many, its amount, Oneway’s fee, the name Stripe was given, and whether Stripe says it is paid or refunded. If you were signed in, your account’s address is kept on the order too, so it is yours to find, and an event ticket answers you Going. A paid order is the Center’s record of a sale. Oneway’s fee is at most 1% of the sale, and it is refunded when the sale is refunded.
Posts and comments are checked automatically for hate, threats and sexual words. A match is sent to a person at Oneway to review, with the words that matched; the check itself hides nothing. A message to a Center’s team from someone without an account is checked the same way, more strictly, and is not sent if it has any of those words or a link: the page says so, so it can be written again.
Oneway is for people 13 and older. When you sign up for the App we ask your birthday. It stays private, is never shown on your profile, and sets the protections for your age. When you sign up for a workspace, to join a Center’s team or to start a business, we ask only which age range you are in, never your birthday. A sign-up from someone younger than 13 is refused before anything about them is stored, and we do not knowingly collect information from anyone under 13. If you think a child under 13 has an account, email us and we will delete it.
An account for someone 13 to 17 starts protected:
Where a state’s law asks for more for minors, that law applies. We have read New York’s SAFE for Kids Act and Child Data Protection Act, and we apply the strictest rule we have read to every account under 18, in every state, until we have read that state’s own law.
Oneway is run from New York, United States. If you use it from another country, your information is handled in the United States and in the countries of the services named above.
When this policy changes, the date at the top changes with it. A material change is shown in the App before it takes effect, and we ask again where the law or a platform requires it.
Oneway Technologies LLC, a New York limited liability company
williamrau78@gmail.com
