Privacy policy

OnYou · on-you.app · Last updated: August 17, 2026

This policy explains what data OnYou («the app», «the service») collects, what it uses it for and what rights you have over it. It is written in plain language on purpose: we would rather be understood than sound impressive.

1. Who is responsible for your data

The data controller is Alfa Marketing S.A. (Quito, Ecuador). For anything about your data or this policy, write to hello@on-you.app.

2. What data we collect

Data you give us when you create your account and use it

Category	What it includes	What for
Account	Email address and password (the password is stored encrypted; we never see it in the clear).	Identifying you and giving you access to your board.
Profile	Your name and your WhatsApp number.	Showing you in the history and being your address inside the app: that is how the tasks other people delegate to you reach you.
Your content	The tasks you create (name, details, dates, city, labels), how they are organised into books/sections/sheets, the comments and the activity history.	It is the service itself: managing and following up on your tasks.
Proof photos	Images uploaded when a task requires one on completion.	Leaving evidence that an activity was done.
Contacts	Details of other people that you add: name, WhatsApp number and, optionally, email, city and company. You can type them in by hand or, if you ask for it, bring them over from your Google or Outlook address book (see section 4).	Being able to assign or delegate tasks to them.
Push notifications	If you enable browser notifications, the technical identifier of your device so we can send them.	Letting you know about due dates and news even when the app is closed.
Waiting list	Only if you put your hand up for a paid plan: your email, which plan you are interested in, whether you want it monthly or yearly, and the language you use the app in.	Letting you know when that plan opens. Nothing else: it is not used for advertising and it is not shared.

Data that is generated on its own

The usual technical data that any web service records (IP address, browser and device type, access times), through our infrastructure providers, in order to run and protect the service.

About other people's numbers and contacts. When you add someone as a contact or assign them a task, you are uploading a third party's data. You are responsible for having a legitimate reason to do so (for example, a working or collaboration relationship) and for that person being able to exercise their rights. OnYou is the tool; the relationship with those people is yours.

3. How your board is shared (and how it is not)

OnYou is designed so that nobody sees anyone else's board. When you delegate a task to someone with an account, that person sees only that task, not your board. We do not expose your task list or your contact book to other users.

The link for people without an account

When you assign a task to someone who does not have an account, that person gets a private link. It is worth knowing exactly what it does:

What it opens. Only the tasks addressed to their number within your board, plus the name of the book, section and sheet those tasks live in — just enough for them to know which activity it is about. The rest of your board is not sent to them: not your other tasks, not your contacts, not the index of your other books and sections.
How long it lasts. Ninety days, and the clock resets every time they open it. A link in use does not expire; one that nobody opens for three months does.
Who can open it. Anyone holding the link, because the link is the credential: it asks for no password. That includes whoever sent it, who still has it in their own WhatsApp. Treat it like a key.
How to cut it off. From Tools › Team access links you can deactivate it, or change the code so the old link stops working and a new one has to be sent.

If that same person receives tasks from more than one board, their panel tells them how many — only the count, never whose — and suggests opening an account to see them together in one place. It shows the number and not the names on purpose: whoever sent the link can also open that panel, and telling them there who else that person works with would reveal something that is not theirs to know.

If you receive tasks through one of these links and want to know what data of yours exists, correct it or have it deleted, write to hello@on-you.app stating the number the tasks arrive on; you can also ask the person who sent you the link directly, as they are the one running that board.

4. Who we share data with (processors)

We do not sell your data. We process it with providers acting on our behalf, only so that the service works:

Provider	What for
Supabase	Database, authentication, storage of the proof photos and sending of the service emails (the code to sign in or to confirm your account).
Netlify	Hosting of the web application.
Anthropic	Only if you use the AI checklist generator: processing the description you write in order to return the list of tasks. See the detail below.
Browser Web Push providers	Only if you enable notifications: delivering them to your device.

The AI, specifically. When you press «generate with AI», the only thing that leaves OnYou is the text you have just written describing the activity and the language you want the answer in. Your name does not travel, nor your email, nor your number, nor your contacts, nor your photos, nor the rest of your board. The description goes to Anthropic's API, the list of tasks comes back, and that is where it ends: Anthropic does not use what is sent to it through the API to train its models on its own initiative. If you would rather nothing left at all, the list can be written by hand and pasted in — that route exists precisely for this.

WhatsApp: OnYou creates links that open WhatsApp with a message already written, but it is your own WhatsApp that sends that message when you decide to. The app does not send WhatsApp messages automatically, nor does it hand your contacts over to WhatsApp.

Data that leaves Ecuador

The servers of Supabase, Netlify and Anthropic are outside Ecuador, so your data is processed abroad. That transfer rests on the data processing agreement we have signed with each of those providers, which incorporates contractual data protection clauses: they bind the provider to a level of protection equivalent to the one Ecuadorian law requires, to process the data only on our instructions, to maintain security measures, not to use it for their own purposes, and to return or delete it when the relationship ends.

Part of that transfer is also necessary in order to provide the service you signed up for: without hosting and without a database there is no app. We do not transfer your data to any third party for purposes other than those described in this policy.

If you connect your Google or Outlook address book

So that you do not have to type names and numbers one by one, the app can read your address book from Google or Outlook and pour it into the contact book you have inside OnYou. This is optional and only happens when you press the button and accept the provider's own permission dialog.

Only names and phone numbers are read. No emails, no notes, no photos, no other part of your account.
The permission is read-only: OnYou does not create, change or delete anything in your Google or Microsoft account.
That data is used for one thing only: filling your contact book inside OnYou, so you can assign tasks without typing them again.
You can withdraw the permission whenever you want from the security settings of your Google or Microsoft account, without going through us.

OnYou's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically: that information is not used for advertising, is not sold, is not transferred to third parties except as needed to provide you the service, and is not used to train artificial intelligence models.

5. How long we keep the data

Completed tasks are archived and then deleted on their own according to the window you configure (48 hours by default); tasks set to auto-delete are removed 48 hours after being completed.
Proof photos delete themselves 3 months after they were uploaded. We warn you inside the app three weeks before, so you can download any you need to keep. What gets deleted is the file: the record that the activity was completed, by whom and when, stays. It is a proof photo, not a historical archive.
The rest of your content is kept while your account is active.
If you delete your account, we delete your content except for whatever the law requires us to keep for a time.

6. Your rights

You can access, correct, export or delete your data, and object to certain processing. Most of it you can do from the app itself; for anything else, write to hello@on-you.app and we will reply within a reasonable time. If you feel we did not handle your request properly, you may turn to the data protection authority that corresponds to you.

How to delete your account

Without asking anyone and without writing an email: inside the app, under More › Tools › Session › Delete my account. If you no longer have the app installed, the same route is explained at on-you.app/borrar-cuenta.html.

This deletes your sign-in account, your profile, your boards, your tasks, your contacts, your comments, your history and the proof photos you have uploaded. It is immediate and it cannot be undone: that is why the app asks you to type the word BORRAR first. Anything another person has saved in their board is theirs and stays there, the same way an email you already sent stays in the inbox of whoever received it.

7. Security

We encrypt passwords, serve everything over a secure connection (HTTPS) and isolate each account's data at the database level, so that one account cannot read another's. No system is infallible, but we treat your data with care and fix the problems we find.

If a security breach happens

If we detect unauthorised access to personal data, or an improper loss or disclosure, this is what we do:

Contain it first. We close the way in and record what happened, when, and which data and people were affected.
Notify the authority. We report it to Ecuador's Superintendency of Personal Data Protection within fifteen (15) days of becoming aware of the incident, and to any other authority that applies in your country of residence.
Notify you. If the incident poses a high risk to your rights, we tell you without undue delay — by email and inside the app — explaining in plain language what happened, which data was involved, what we have already done and what you should do (for example, change your password or deactivate your team's access links).
Keep a record. We log every incident of this kind internally, including those that do not reach the notification threshold, so we can show how they were handled and avoid repeating them.

If you ever think you have found a security flaw in OnYou, write to us at hello@on-you.app before making it public. We genuinely appreciate it.

8. Minors

OnYou is a work tool and is aimed solely at people over 18. We do not knowingly collect data from minors. If you believe a minor has given us data, write to us at hello@on-you.app and we will delete it.

9. Changes to this policy

If we change this policy, we will update the date above and, if the change is significant, we will tell you inside the app. Continued use of the service after a change means you accept the version in force.

10. Contact

Privacy questions: hello@on-you.app.