Privacy Policy

This Privacy Policy explains what OneNextTask collects from users, how we use it, how we protect it, and what choices you have. OneNextTask is owned and operated by OneNext LLC, a Washington limited liability company ("Company," "we," "us," or "our"). We collect only what is necessary to provide the Service.

• We don't sell your personal information.
• We don't show ads or use advertising trackers.
• We don't use your content to train AI models.
• We don't use AI to make hiring, lending, insurance, medical, or other legally significant decisions about you — it generates task suggestions, nothing more consequential than that.

Account information: Email address (for authentication and communications), optional display name, and account creation timestamp.

Content you create: Tasks, goals, plans, notes, and brain dump text you submit. You own this content.

Interaction metadata (Telemetry): We explicitly log behavioral telemetry regarding how you interact with tasks, including completion timestamps, daily counts, category assignments, and the frequency and context of deferred actions (e.g., distinguishing between task "skips" and "soft-skips").

Diagnostic and crash data: When the app encounters an error, we automatically collect the error message, a partial stack trace, the page you were on, and your browser's user agent.

Notification data: If you enable push notifications, we store your browser push endpoint. Deleted when you disable notifications or delete your account.

Location data: If you enable location-based reminders through our companion app, your device checks your location against places you've saved. We only receive a location event when a saved trigger actually fires — not a continuous location feed.

Payment data: Handled entirely by our payment provider, which acts as an independent data controller for your payment transaction and as Merchant of Record for your subscription — not merely our processor. We store only a customer and subscription identifier and your subscription status; we never receive or store your full card number.

Legal consent records: The version of these Terms and this Policy you've accepted, the date, your required age and residency acknowledgments, and the IP address the acceptance was recorded from.

AI processing: When you use AI features, your submitted text and interaction metadata are sent to a third-party AI processing provider — see below.

We use your information to:

• Provide the Service — store your tasks, power the priority engine, and generate AI planning features.
• Analyze behavioral patterns — we utilize automated processing to evaluate your task engagement and psychological trends (such as task avoidance) to generate your weekly personal analytics and productivity insights.
• Authenticate your identity and maintain your session.
• Send push notifications and location-triggered reminders (when enabled).
• Detect and prevent fraud, abuse, and Terms of Service violations.
• Respond to support requests and send important service updates.
• Maintain a record of your acceptance of our Terms and this Policy.
• Meet legal obligations.

The Service uses a third-party artificial intelligence processing provider to power features like parsing brain dumps into structured tasks, managing clarification chats, and analyzing your weekly interaction metadata (telemetry) for pattern insights. When you use an AI feature, the relevant text content and behavioral data are sent to that provider to generate the result.

We require our AI processing providers not to use your content or telemetry to train their underlying foundation models, and to delete submitted data and generated output from their systems within a reasonable Trust and Safety retention period, currently strictly capped at no more than 30 days. We have not set up a Zero Data Retention arrangement with any AI provider, so your data is securely retained on the provider's systems for up to that 30-day period as part of normal processing.

Cloud infrastructure and hosting: Amazon Web Services (AWS) runs our servers and stores backup snapshots.

Database and authentication: Supabase stores your account credentials, task data, and manages row-level security sign-in.

AI processing: Anthropic processes text inputs and behavioral interaction telemetry to parse tasks and generate pattern insights under a strict 30-day Trust & Safety retention policy.

Payment processing: Paddle acts as an independent data controller and Merchant of Record for all orders. Paddle processes billing, transaction, subscription, and tax compliance data under its own privacy policies. We never receive, process, or store your credit card or bank details.

The current list of subprocessors, their roles, and processing locations are maintained on our Subprocessor List.

We may disclose information to: the service providers above; law enforcement, regulators, or courts when legally required; professional advisors such as attorneys or accountants; or another company in connection with a merger, acquisition, or sale of assets. We do not sell, rent, or trade your personal information.

• Active account data: retained while your account is active
• Completed tasks: retained for up to 12 months to generate your weekly analytics history, even though they are hidden from your active task view
• Deleted tasks: retained 30 days for recovery, then permanently purged
• Daily snapshots: up to 12 months for weekly analytics history
• Legal consent records: retained for the life of the account plus the period needed to show a valid consent history
• Account data after deletion: permanently deleted within 30 days of your request

All data in transit is encrypted with TLS. Your stored data is protected by database row-level security — each user can only access their own data. Authentication uses one-time email verification codes, not stored passwords. Access to production data is restricted to authorized personnel. No system is completely secure; if we become aware of a breach affecting you, we will notify you as required by law.

Access and Data Portability: You can export a copy of your personal data and task history in a machine-readable format (JSON) at any time directly through your account settings in the app. You may also request a copy of your data by emailing us, which we will provide within 30 days.

Correction: Update your account information and task content directly in the app at any time.

Deletion: Delete your account through app settings. Personal data is permanently deleted within 30 days. We recommend exporting your data prior to initiating account deletion.

Other U.S. states: Depending on where you live, you may have similar rights under other state privacy laws — including Virginia, Colorado, Texas, Oregon, and others with comparable statutes. Regardless of whether your specific state's law currently applies to us, we extend the same rights to access, correct, export, and delete your personal information to any U.S. resident who requests it.

To exercise any right, email privacy@onenexttask.com.

The Service is strictly limited to individuals aged 13 and older. We enforce this through a mandatory age-verification disclaimer during the signup process, and we do not knowingly collect personal information from anyone under 13.

Users between 13 and 17 may use the Service only as an Authorized User under a parent or legal guardian's active subscription account, with that parent or guardian's consent and supervision — see Section 3 of our Terms of Service.

If we become aware that we've collected personal data from someone under 13 without the consent required by law, we will delete that information and terminate the associated account immediately.

We use session cookies and local storage to maintain your authentication state and preferences. Our payment provider's checkout also sets essential cookies needed to process your transaction securely and prevent fraud. We do not use third-party advertising cookies or cross-site tracking.

Your information may be processed in countries other than your own, including the United States, where our service providers are located. We use appropriate safeguards for international transfers where required by law.

OneNextTask is strictly limited to residents of the United States. We enforce a mandatory residency disclaimer at signup and do not operate in, market to, or intentionally collect data from individuals located in the European Union, European Economic Area, United Kingdom, or any other jurisdiction outside the United States.

OneNextTask is a productivity application. Avoid submitting highly sensitive personal information that violates third-party acceptable use policies or isn't necessary for task management — including payment card details, bank credentials, government identification numbers (SSNs/Passport numbers), protected health information (PHI), or content facilitating prohibited activities outlined in Section 7 of our Terms of Service. You are solely responsible for the content you choose to submit.

AI-generated results can be incorrect. Don't rely solely on the Service for emergency, medical, mental health, legal, financial, or other safety-critical decisions.

If the Company is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to applicable law. We will notify you before your data is transferred under a different privacy policy.

We may update this Policy. When we make a material change, existing accounts must review and affirmatively re-accept the updated Terms and this Policy before continuing to use the Service. For significant changes to data practices, we intend to also notify active subscribers by email in advance.

Privacy questions, requests, or concerns: privacy@onenexttask.com

We respond to all privacy-related requests within 30 days.