OneKitBetaStart free

Privacy Policy

Effective date: April 19, 2026  ·  Last updated: October 20, 2026

OneKit is operated by AI Squads LLC, a California limited liability company ("AI Squads," "we," "us," or "our"). This Privacy Policy explains how we collect, use, share, and protect information about you when you use the OneKit desktop and iPhone applications and any related services (collectively, the "Service"). By using the Service you agree to this policy.

1. Information We Collect

Account Information

When you sign up, we collect your email address to create and manage your account. We use Supabase for authentication and data storage.

Contact Us

When you write to us with the Contact us form on onekit.co, we store your email address, your message, and which plan you asked about, so we can write back. A spam check from Cloudflare runs before it is sent. We keep a scrambled form of your IP address only to limit how many messages one place can send, never the address itself.

Cowork Spaces

When you join a cowork space on onekit.co (like HelpBnk Cowork) with your name and email, we keep them so the space's host can reach you. Other people in the room see your name and your character. Your email is never shown to them.

Connected Service Credentials

When you connect third-party services (Gmail, X/Twitter, LinkedIn, Instagram, Facebook Pages, TikTok, YouTube, Google Calendar), we store OAuth access and refresh tokens on your behalf so OneKit can act on your instructions. We also store your platform user ID and display name for each connected service so we can show you which account is linked. We never store your passwords for these services. Disconnecting removes the selected connection and its stored credentials. Other connections to the same account may remain active; disconnecting a feature is different from deleting your OneKit account or the content created through it. See "Google: Gmail, Contacts, and Calendar" and "Data Retention" below.

Waitlist and Your Mini Me Draft

When you request an invite on onekit.co, we store your email address. If you also give us your LinkedIn profile link, we store it to move you up the waitlist. If you tick the box that lets OneKit use your public LinkedIn profile to make your mini me, we record your answer, the words you agreed to, and the time, and we may use the public information on that profile (such as your name, photo, headline, and work history) to draft your mini me before your account opens. The draft is private: nobody else sees it until you sign in and approve it. Leaving the box unticked never changes your place on the waitlist. You can withdraw your permission or have the draft deleted at any time by emailing support@onekit.co. This is separate from connecting a LinkedIn account for posting, described under LinkedIn below.

Content You Create or Import

We store content you create or import through the Service, including contacts and email addresses you upload, email drafts and sent-email records, social media posts you compose, meeting transcripts and the notes written from them, and documents you upload for processing.

Meeting Notes

When you record a meeting, the audio is transcribed on your device by a bundled speech engine and is never uploaded; no recording is kept once the transcript exists. The transcript and the notes are stored in your account. The transcript is sent to the AI providers below when OneKit writes the summary, names the meeting, or answers a question you ask about it. You are responsible for telling the other people on a call that it is being recorded where the law requires it.

Knowing Your Voice

To label who said what (Speaker 1, Speaker 2), the Mac app tells the voices in a recording apart on your Mac. Those voice details are never uploaded or written to disk. They stay in memory while you record and, after the meeting, until OneKit quits or for 12 hours at most, so you can still mark a voice as yours. If you choose Remember when you mark a voice as yours, or turn on Know my voice in Meeting Notes settings, OneKit keeps one voice print of your own voice so your lines say You by themselves. A voice print is a short list of numbers that describes how you sound. It is not a recording, and OneKit never keeps one of anyone else. It is stored only on that Mac, encrypted with your Mac's keychain, and is never uploaded to OneKit or sent to anyone. Turning Know my voice off deletes it.

Your Voice

OneKit uses your microphone only when you ask it to: to dictate, to record a meeting, or, on iPhone, to call your mini me. OneKit does not record a call: your voice goes live to OpenAI for the call (see “Speech and calls on iPhone” below). We keep the call's length and how the connection went, to bill it and fix problems; what you ask Mini to do on a call is kept as messages in a Mini chat; and the call's written transcript is kept on your phone. Dictation and meetings are described under Meeting Notes above and “Groq and OpenAI” below.

E-Signature Records

When E-Signatures is used, we process the uploaded document, envelope and recipient details, field values, drawn or typed signature images, signing and viewing timestamps, IP address, browser/device information, audit events, document hashes, and completion-email and signed-copy download events. A recipient does not need a OneKit account to sign a document sent to them.

Kit Conversations

Your conversations with Kit are stored in your account so they sync between your devices and stay searchable. Sharing your conversations with our team is off unless you turn it on. The app asks you when you sign up (accounts created earlier are asked once), and you can change your answer at any time in Settings → General → Privacy. If you say yes, we add 50 credits to your account once, as thanks, and you keep them if you later turn sharing off. Only conversations you start after your most recent yes are shared. Our team never sees any part of a conversation in which Kit used your Google data (Gmail, Calendar or Contacts, or anything OneKit derived from them): not what you typed, not which tools Kit used, and not Kit's replies. The same goes for a conversation in which Kit had Passwords, Files, your screen, your memories, your Brain or other private data in front of it, and for one OneKit cannot confirm was free of such data. In the conversations that remain, members of our team can see what you typed, which tools Kit used, and Kit's replies. Tool inputs and results, such as the content of a note, a search or a web page, are never shown, and neither is anything you attach to a message. Shared conversations are used only to fix and improve the product. They are never used to train AI models and never sold. Every time a member of our team opens a shared conversation, that access is logged.

Usage Data

We collect information about how you use the Service to improve reliability and performance: which apps you open and when, how long each Kit turn took, which tools it ran and whether they succeeded, how many tokens it used and what it cost, error types, and your thumbs-up / thumbs-down on Kit's answers with any reasons or comment you add. This usage data never contains the text of your messages, notes, emails or files. The desktop and iPhone apps also send crash reports (Sentry) that describe the failure, not your content. The desktop and phone apps send a short list of named events to PostHog about how the app is used, such as which onboarding step you reached, which permissions you turned on and whether you started a plan, linked to your account ID. The apps do no automatic tracking and no screen recording, and these events never include the text of your chats, messages, notes, emails or files, or your file names. In the desktop app you can turn them off in Settings, under Privacy (Share usage stats). Our website uses cookieless page analytics and page-speed measurements (Vercel) and remembers, in your own browser only, the link that brought you here so we can attribute a signup to its source (for a page someone shared with you, only which kind of page it was, never its address). The pages you get OneKit from, and the pages people share with you, also send a short list of named events to PostHog, such as a page opening, a download button being pressed, whether a download or invite code was accepted, whether the download page was opened by a link in one of our emails, whether you proved your email to open something shared with you, how far someone invited to a team got in joining it (never which team), or how far you got starting your free month on onekit.co/start: which step you reached, whether the card step sent you to Stripe or why it did not, whether, back from Stripe without a card, you pressed Start free or Add a card, and whether you booked a live setup call. At a co-working room's door on onekit.co (such as onekit.co/helpbnkcowork) they say how far you got going in: whether you joined or why not, whether you took or uploaded a photo for your character or skipped it, which ready-made character you picked, and that you went in, never your name, email or photo. When you pick a time for a call with Sepehr (“Ask Sepehr anything”) on onekit.co, or press the call button in one of our emails, we keep which call you picked, which page you picked it on and your approximate city, so we know who is coming. If you are signed in to OneKit on onekit.co, the pick is linked to your OneKit account; if not, to the random ID described below; for the button in our emails, which knows neither, to a one-way scrambled form of your internet address, never the address itself. Tapping the time again takes the pick back. Picks are kept for a year and deleted with your account. Every public page of onekit.co also says which kind of page it is (never its address, or whose page it is), how long it stayed open and how far down it was scrolled, both in rough steps, which section of the home page came into view, which button on the home, pricing, download and café pages was pressed, that the plans were switched (Individual or Teams, yearly, a credit level), only the site name of a link to another website you pressed, and that one of our scripts failed (never the error's message). They carry a random ID kept in your browser's local storage (not a cookie) until you clear this site's data, so we can tell a return visit, whether you are on a phone or a computer, and your approximate city. Once you sign in to OneKit on onekit.co (to start your free month, join a team or a co-working day), that ID is linked to your OneKit account ID, so we can see which visit led to your account. They never carry your email, the code you typed, what was shared, or your IP address, and no cookie is set for them. On our home, pricing, download, invite-code and onekit.co/start pages we also record a replay of how the page is used (what was on screen, scrolling, mouse movements and clicks) so we can see where people get stuck. Anything you type into a field, and any email address on the screen, is hidden before it leaves your browser, and the replay keeps the page's address without anything after it. We never record pages people share with you, profiles, forms, booking pages, team invites, or the OneKit apps. PostHog stores the replays. When someone shares something with your email and you prove that email to open it (with Google, which tells us only your email address, or a code we email you), no account is made: our site keeps that proof, and the email it is for, in a cookie on onekit.co for up to 30 days, so you are not asked again.

Payment Information

Payments are processed by a third-party payment processor. We do not store full credit card numbers or payment credentials on our servers.

2. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Service
  • Execute actions you request (send emails, publish posts, sync calendars, transcribe audio) using your connected accounts
  • Authenticate you and keep your account secure
  • Communicate with you about your account, updates, and support
  • Monitor usage against plan limits and enforce them
  • Improve and develop new features based on aggregate, anonymized usage patterns
  • Improve Kit by reviewing conversations from accounts that have turned sharing on (see “Kit Conversations” above) and the feedback you give on its answers
  • Understand how people find OneKit (the referral source you tell us, and the link that brought you to the site)
  • Comply with legal obligations
  • Deliver signature requests, verify signing state, create the completed PDF, and preserve an audit trail

We do not sell your personal information to third parties. We do not use your email content, contact lists, or documents to train AI models.

Google user data

Data OneKit receives from Google APIs (Gmail messages, contacts, calendar events, and YouTube channel details) is used only to provide and improve the user-facing features you enable: reading, searching, organizing, and sending mail; recipient lookup and sender names; calendar display, event management, and booking links; and publishing to your YouTube channel. Google user data is not used for any other purpose in the list above. It is not used to send you communications, to measure plan usage, to understand referral sources, in team review of Kit conversations, in usage data or crash reports, for advertising, for market research, or to develop, improve, or train generalized (non-personalized) AI or machine learning models. Where a model processes your Google data, it does so only to produce the result you asked for, such as a brief or a reply draft, or to build the search index Kit uses to find things for you, and that data is never retained for training.

Email Tracking

When you send marketing emails through OneKit's Email tool, we may embed a small tracking pixel (a 1×1 transparent image) and rewrite links in your emails to measure open and click-through rates. This tracking data is visible to you in the campaign report. You can disable tracking on a per-email basis using the tracking toggle in the compose view. Recipients can opt out of future emails at any time via the unsubscribe link included in every marketing email.

Content Repurposing (Auto-Post)

When you enable auto-post for TikTok or Instagram, OneKit periodically polls your own account (using the OAuth credentials you provided) to detect new content you have published. OneKit downloads your content, temporarily stores it on our servers for the purpose of publishing it to your other connected platforms, and deletes the temporary copy after publishing. If you enable AI caption rewriting, your original caption goes through OneKit's AI service to the model that writes the platform-adapted version, the same way as every other AI request described in Section 3. OneKit only accesses content from your own authenticated accounts — it does not access or download content from other users' accounts.

3. Third-Party Services

The Service integrates with third-party platforms. When you connect them, their own privacy policies also apply:

  • Supabase — database, authentication, and file storage
  • E2B — the cloud machine behind Kit's computer. E2B Inc. is a United States company that runs each machine as its own hardware-isolated virtual machine. If you turn Kit's computer on, one machine is created for your account and runs your own copy of OneKit. See “Kit's Computer” below for what is stored there.
  • OpenRouter and model providers — AI request routing and processing. Every model OneKit offers is reached the same way, Claude included: OneKit's shared AI service sends the prompt and its context through OpenRouter to the company that makes the model — Anthropic, OpenAI, Google, DeepSeek, xAI, Meta, Moonshot, Alibaba (Qwen) or Z.ai — or to a hosting partner serving that model. Every text and chat request carries OpenRouter's data-collection opt-out, which routes it only to providers that do not store it or train on it. OneKit's backend sets that opt-out on every one of those requests; the app cannot turn it off, and picking a different model does not change it. Image requests are the exception: OpenRouter's image API does not accept the opt-out, so an image request, such as your selfie (see “Your selfie and your mini me” below) or a picture made in the Media tool, goes without it. These providers process the request only to return the result to you. The Mail tool's default classifier is a DeepSeek model served this way.
  • OpenAI — embeddings, so Kit can find things for you. OneKit turns text into numbers (embeddings) with OpenAI's text-embedding-3-small model. The text is the short facts Kit saves from your conversations, the message you just sent or what Kit is searching for, and passages from your email, meeting notes, screen history, Brain documents and past Kit conversations, which build the search index Kit uses on your device. It goes through OneKit's backend to OpenAI's API. OpenAI does not use API inputs for training, and our organization's data-sharing settings with OpenAI are turned off. The embeddings are used only to find things for you.
  • OpenAI — calls with your mini me on iPhone. When you call Mini, your voice goes live from your phone to OpenAI's voice model so Mini can hear you and talk back. See “Speech and calls on iPhone” below.
  • unavatar.io — company logos in Mail. When Company logos is on, Mail looks up the domain of a sender's address — example.com, not the address, the subject, or the message — first with Google's favicon service and, for a domain Google does not know, with unavatar.io. Personal mail domains such as gmail.com are not looked up at all. Turning Company logos off in Mail's settings stops the lookup.
  • fal.ai — image and video generation in the Media tool. The prompt and any reference image you provide are sent to fal.ai (or, for some models, through OpenRouter) to produce the result.
  • Groq and OpenAI — cloud dictation. When the Whisper dictation feature is set to the cloud engine, your audio is sent to Groq's transcription API (Whisper Large v3) and, if Groq is unavailable, to OpenAI's Whisper API; a short cleanup pass on the resulting text may also run on one of these providers. The text is stored locally on your device; the audio is not retained by OneKit after transcription. The on-device dictation engine sends nothing anywhere. Meeting recordings are always transcribed on your device (see Meeting Notes above); the transcript, not the audio, goes to the AI providers listed here for summaries and answers.
  • Google — Gmail inbox access, sending and mailbox organization; contact lookup and sender photos; and Calendar and booking features
  • Resend — transactional delivery of signing notices, short-lived links used to retrieve completed signed documents, and emails about your account (tips in your first two weeks, which you can stop, and notices about your plan)
  • X (Twitter), LinkedIn, Instagram, Facebook Pages, TikTok, YouTube — social media publishing

We only request the permissions these services require to perform the actions you explicitly instruct.

Models that run on your device

Speech becomes text on your own computer whenever the local engine is used. OneKit ships whisper.cpp with the base.en model, and can download NVIDIA's Parakeet model once to run through sherpa-onnx. Both run as processes on your machine: your audio is not sent to OpenAI, to NVIDIA, or to anyone else when they do the work. Meeting recordings are always transcribed this way. Reading text off the screen uses the operating system's own OCR — Apple Vision on macOS, Windows.Media.Ocr on Windows — which also runs locally. OneKit downloads the Parakeet model file itself from its public release; no content of yours goes with the request.

OneKit on iPhone: asking before anything goes to an outside AI

The iPhone app asks before it first sends anything of yours to an outside AI. The screen names what goes and who receives it: what you share (messages, photos and files) goes through OpenRouter to AI companies, Anthropic, OpenAI, Google and DeepSeek, or the maker of any model you pick, and when you call Mini, your voice goes to OpenAI so Mini can hear you and talk back. It says they don't train on your chats, and it links to this policy. Words you dictate reach OneKit as text and go the same way as typed words, and for your brief, messages in your groups do too. If you choose Not now, nothing is sent, and the parts of the app that do not use AI, such as team chat and Settings, keep working. Your answer is stored on your account, so it applies on every phone you sign in on, and you can read it again or turn it off at any time in Settings → More → Sharing with AI.

Your selfie and your mini me

If you take a selfie while setting up the iPhone app, it is uploaded privately to your account and sent through OpenRouter to OpenAI's image model (GPT Image), or to Google's Gemini image model when that one is unavailable, to draw your mini me. We delete the selfie as soon as it has been read for that drawing; the mini me is what stays. OpenRouter's image API does not accept the data-collection opt-out described above, so these image requests do not carry it. The selfie is optional: you can skip it.

Reading up on you during setup

To start your Brain, the name you give, the sentence you say or type about yourself, and any LinkedIn link you add are sent through OpenRouter to an Anthropic Claude model, with the data-collection opt-out. The model may search the public web for you; that search is run by the model's provider or by a search service OpenRouter uses, such as Exa. What it finds is shown to you first and is saved to your Brain only when you confirm it on the last setup screen.

Build my whole Brain

If you choose Build my whole Brain, OneKit reads the folders you pick on your computer (text, PDF, Word and spreadsheet files, and a code project's README, project file and recent commit titles; never hidden folders, app data, or files named or shaped like passwords and keys) and sends the start of each file, with passwords and keys removed first, through OpenRouter to a DeepSeek model with the data-collection opt-out, to write draft pages; the same text goes into the search index on your computer (see OpenAI above). Your name and any LinkedIn or site link you add go to the web search described above; OneKit never signs in to LinkedIn or opens your LinkedIn page itself. The drafts join your Brain only when you keep them.

Speech and calls on iPhone

When you dictate instead of typing, Apple's speech recognition turns your voice into text, under Apple's own privacy terms, and OneKit receives only the text, which is handled like anything you type. A call with your mini me is different. When you press Call, your voice is sent live from your phone to OpenAI's voice model so Mini can hear you and talk back, and Mini's spoken replies come from OpenAI. Your voice does not pass through OneKit's servers, and OneKit does not record it: our server only opens the call with OpenAI (giving it your first name and time zone) and counts the call's minutes. OpenAI does not use API inputs for training. When you ask Mini on a call for something of yours, such as your calendar or a message to send, the request becomes a message in a Mini chat and is handled like a typed one, and Mini's answer goes back to OpenAI to be spoken. The microphone is on only during the call, and the call's written transcript is kept on your phone.

Google: Gmail, Contacts, and Calendar

When you connect Google, OneKit requests access for the features you enable. Gmail access includes message contents, headers, attachments, and labels so you can read and search mail, compose and send messages, and organize your inbox by marking messages read, starring, archiving, or marking spam. Mail synchronizes messages into a local index and message cache on your device for display and search. Contacts access covers your saved contacts and Other Contacts, meaning people you have emailed. It supports recipient lookup and sender names and photos. A sender's photo is the profile photo Google already holds for that contact; a company logo is looked up from the sender's domain alone and can be switched off (see “unavatar.io” above). OneKit does not request or read your Google Workspace directory. Calendar access supports displaying calendars and events, managing events, and providing booking links. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. OneKit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google data in AI features

Mail's AI classification, briefs, and reply drafting process relevant email content and thread context. Kit can also use connected Google data when you ask it to work with Mail or Calendar. These AI requests pass through OneKit's backend and OpenRouter to the selected model provider; processing does not happen entirely on your device. Each of them carries the data-collection opt-out described above, so it is routed only to providers that do not store it or train on it. A request that carries Google data, or anything OneKit derived from it, stays within that one service: it is not sent to a third-party search index, and the image and video generation tools are withheld from that conversation. Web search is switched off for that conversation unless the model runs the search itself, inside the same request, at the same provider — today that is Google's Gemini models, which search with Google's own grounding. On every other model, a conversation that has touched Google data cannot search the web. To build the search index Kit uses on your device, passages of your email and meeting notes, and memory facts that may come from them, are also sent through OneKit's backend to OpenAI's embeddings API (text-embedding-3-small), which does not use them for training (see “OpenAI” above). Those embeddings are used only to find things for you. Google OAuth access and refresh tokens are stored encrypted in OneKit's backend. Calendar features also synchronize event information through the backend. We do not use Google data for advertising, market research, or AI model training. Conversations that touch Mail, Calendar or Contacts are excluded from optional staff conversation review.

Outside AI agents do not get Google data

OneKit can hand Kit's tools to an AI agent you run yourself: the optional setting that answers your chats with your own Claude or ChatGPT plan, and the local connector on your computer that any MCP client can use. Google user data is withheld from both. Mail, Contacts, Calendar, scheduling availability, meeting notes, past conversations, and the memories Kit writes for itself are not offered to those agents and cannot be called by them, so neither Google user data nor the notes and memories OneKit derives from it reach the AI provider behind them. Files you saved into your Brain yourself stay available to those agents, as your own documents, wherever their content came from.

Disconnecting Google and deleting data

You can disconnect Mail and Calendar in Settings. Disconnecting one feature or workspace does not remove another active connection to the same Google account. When you disconnect the last connection for a Google account, OneKit also asks Google to remove the app's access to that account. Mail's local message index and HTML cache are removed when no Mail connection remains for the account; while another workspace still uses it, those shared caches remain available. Disconnecting does not automatically erase every derived brief, saved draft, conversation, contact-photo cache, or other record already created through the Service. For deletion of retained records, including help clearing data stored on your device, contact support@onekit.co. You can also revoke OneKit's access in your Google Account; revoking access prevents future access but does not itself delete records already held by OneKit.

LinkedIn

When you connect your LinkedIn account, OneKit collects your LinkedIn profile name and user ID (one time only, during connection) and stores an OAuth access token to publish posts on your behalf. OneKit does not access, read, or store your LinkedIn feed, connections, messages, or any other LinkedIn content beyond what is listed here. Posts are only published when you explicitly approve them. OneKit does not use LinkedIn data for advertising, analytics, or any purpose other than publishing posts you author. You can withdraw consent at any time by disconnecting LinkedIn from the Repurpose page, which permanently deletes all stored LinkedIn data including your access token and profile information. You may also request full deletion of your LinkedIn data by contacting us at support@onekit.co. OneKit's use of the LinkedIn API is subject to the LinkedIn API Terms of Use.

Instagram (via Meta Platform)

When you connect your Instagram account, OneKit signs you in with Instagram's own login (the Instagram API with Instagram Login), reads your professional account's username and ID, and stores an Instagram access token to publish the posts you approve. This requires an Instagram Business or Creator account; no Facebook Page is needed. When auto-post is enabled, OneKit periodically reads your own recent Instagram posts to detect new posts for cross-platform repurposing (see Section 2, "Content Repurposing"). By default OneKit asks only for the permissions needed to publish: instagram_business_basic and instagram_business_content_publish. OneKit never reads your direct messages. Posts are only published when you explicitly approve them. OneKit does not use Instagram data for advertising, profiling, surveillance, eligibility determinations, or any purpose other than publishing posts you author and showing you your own numbers (see "Instagram stats" below), and never sells it. You can withdraw consent at any time by disconnecting Instagram from the Repost page, which permanently deletes your access token, your account identifiers and any Instagram numbers OneKit saved for you. You may also request full deletion by contacting us at support@onekit.co. OneKit's use of the Meta Platform is subject to the Meta Platform Terms and Meta Developer Policies.

Instagram stats (optional)

Only if you choose "Connect with stats" on the Repost Stats page does OneKit also ask Instagram for instagram_business_manage_insights. With it, OneKit reads your account's numbers (followers, new followers and unfollows, reach, views, interactions, likes, comments, saves and shares) and your posts' numbers (views, reach, likes, comments, saves, shares and profile visits), and shows them to you on the Stats page, read from Instagram each time you open it. If you are a member of a OneKit space whose app keeps Instagram numbers, and you have your own teammate there, OneKit also saves them once a day in your own tables in that space: one row per day for your account (the last 30 days when it starts), and one row per post from the last 30 days with its date, link, the first 140 characters of its caption and its numbers. Only you and your own teammate in that space can see these rows: the space's owner and admins can't. Your teammate, an AI that runs on the AI providers in Section 3, reads them only to help you, for example to plan your week. These numbers are never used for advertising or profiling and never sold. They stay until you disconnect Instagram or ask us to delete them. Disconnecting Instagram, a deletion request by email to support@onekit.co, or Meta's data deletion callback when you remove OneKit on Instagram deletes every number OneKit saved for you, usually within minutes.

Facebook Pages (via Meta Platform)

When you connect a Facebook Page through Facebook Login for Business, OneKit asks for four permissions, and uses each for one thing: pages_show_list to list the Pages you manage so you can choose one; pages_manage_posts to publish the post you wrote and approved to that Page; pages_read_engagement to read the Page's name and the link to the post OneKit published, so we can show them back to you; and business_management only so Pages you manage through a business portfolio appear in that list. For each Page you connect, OneKit stores the Page ID, the Page name and an encrypted Page access token. OneKit does not store your personal Facebook access token, and does not read your personal profile, friends, messages, comments, followers or insights. The Page's public profile picture is shown next to its name. Posts are only published when you press Post. OneKit does not use Facebook data for advertising, profiling, surveillance, eligibility determinations, or any purpose other than publishing posts you author. You can withdraw consent at any time by disconnecting the Page on the Repost Accounts page (in the app or at onekit.co/repost), which deletes the stored token and identifiers for that Page, and you can also remove OneKit in Facebook under Settings → Business integrations. You may also request deletion by contacting us at support@onekit.co. OneKit's use of the Meta Platform is subject to the Meta Platform Terms and Meta Developer Policies.

TikTok

When you connect your TikTok account, OneKit collects your TikTok creator username, nickname, and account privacy/interaction settings (such as allowed privacy levels and whether comments, duets, or stitches are enabled on your account). We store an OAuth access token and refresh token to publish video content on your behalf. Before each post, OneKit queries your current creator settings to ensure your chosen privacy level and interaction preferences are valid and respected. OneKit does not access, read, or store your TikTok feed, followers, direct messages, analytics, or any content beyond what is listed here. Videos are only published when you explicitly approve them and select your privacy and disclosure preferences. OneKit does not use TikTok data for advertising, profiling, or any purpose other than publishing content you author with settings you choose. You can withdraw consent at any time by disconnecting TikTok from the Repurpose page, which permanently deletes all stored TikTok data including your access token, refresh token, creator username, and saved posting preferences. You may also request full deletion by contacting us at support@onekit.co. OneKit's use of the TikTok API is subject to the TikTok Terms of Service and TikTok API Terms of Service.

OneKit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, market research, or AI model training, and we do not use data obtained through Google Workspace APIs to develop, improve, or train generalized (non-personalized) AI or machine learning models. Google user data is used only to provide and improve the connected user-facing features described in this policy, including background synchronization and AI briefs that you enable. Humans at OneKit do not read your Google user data unless you ask us to for support, it is needed for security or to comply with law, or it has been aggregated and anonymized.

3A. Kit's Computer

Kit's computer is an optional cloud machine that runs your own copy of OneKit so Kit can keep working while your own computer is off. You have to turn it on. Nothing is created until you do, and one machine belongs to one account. A plain-language guide to it is at onekit.co/help/kits-computer.

The machine

Each machine is a hardware-isolated virtual machine with 2 CPUs and 4 GB of memory, run for us by E2B Inc. in the United States. It is created for your account and used by no other OneKit account. Between tasks it is paused with its memory and disk kept, so it resumes where it stopped instead of starting over.

It is signed in as you

The machine holds a OneKit session for your account so Kit can work with the same account data you see on your own computer: your conversations, calendar, mail and the files in its work folder. It follows the approval settings and tool switches from your own app, which OneKit copies to it and re-copies whenever you change them. Every approval it asks for is answered on your phone or your desktop; the machine cannot approve itself.

What is stored on it

The files Kit creates or downloads while working, the profile of the browser it uses, and OneKit's own local data. They stay on the machine's disk until you reset or delete it. Update replaces the machine's system and carries your work folder across, so an update keeps your files.

What is never stored on it

Your Passwords vault, and the saved credentials for your connected accounts (Gmail, Calendar, LinkedIn, X, Instagram, Facebook Pages, TikTok, YouTube). Those stay encrypted in OneKit's backend as they do today, and a tool that needs one is issued a short-lived token that lives in memory. The Passwords and Meeting Notes tools are switched off on the machine, and it cannot watch or read the screen of your own computer. When a website asks for a login, Kit stops and you take over its screen and type it yourself; what you type is kept in that machine's browser profile, which no keychain protects, until you reset or delete the machine.

Screenshots

While it is awake, the machine sends a picture of its own screen every few minutes so you can see what it was last doing when you open it asleep. Only the newest picture is kept, under 256 KB, in a private storage bucket that only your own account can read. It is deleted with the machine.

Watching it

The live screen is not public. The address is issued when the machine wakes, stops working when it sleeps, and is handed only to your signed-in account.

Network

The machine reaches the internet through the provider's own outbound addresses, which are shared with their other customers and change over time. A website Kit visits sees one of those addresses rather than yours.

Deleting it

Delete Kit's computer destroys the machine, its disk, its saved states and its screenshot. Reset does the same and builds a clean one, keeping your work folder only if you ask it to. Deleting your OneKit account deletes the machine the same way. We keep the record of when it was awake and how many minutes were billed for as long as your account exists, because that is our billing record.

4. Data Sharing

We share your information only in the following circumstances:

  • Service providers — vendors who help us operate the Service (e.g. Supabase for the database, Stripe for payments, Sentry for crash reports, PostHog for app and website usage analytics and website session replays, Vercel for hosting, cookieless site analytics and page-speed measurements, Resend for email, E2B for Kit's computer) under confidentiality obligations
  • Business transfers — if AI Squads LLC is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. Google user data is transferred in such a case only after we obtain your explicit prior consent
  • Legal requirements — when required by law, court order, or to protect our legal rights or the safety of others
  • With your consent — for any other purpose with your explicit permission
  • Signature participants — the sender and designated recipients receive the document, signing status, and completed signed copy as needed to complete the transaction

5. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. When you disconnect a third-party service, the selected connection and its credentials are removed. Content and derived records already created through the Service may remain, and other active connections to the same account continue to operate as described above. You can delete your account yourself, at any time: on the desktop app, Settings → You → Delete account; on the phone app, Settings → Delete your account. Deletion takes effect immediately — your conversations, meeting transcripts and notes, files, workspace, subscription and account are removed at once, and the app clears what it kept on that device. Data our processors hold in backups is purged on their schedule, within 30 days. We retain only what we must for legal, tax or compliance purposes.

If you use Kit's computer, what sits on that machine and the one screenshot it keeps are removed when you reset it, when you delete it, and when you delete your account. See “Kit's Computer” above.

Signed documents and their audit evidence are retained while the sender's account remains active so the sender and designated recipients can access the completed record. When a sender deletes their account, never-sent drafts are deleted with it; signature requests that were already sent, and their audit evidence, are kept for the people who signed them with the sender's identity removed, because they are transaction evidence for the other parties. Beyond that, a deletion request may be limited or delayed only where retention is reasonably necessary to resolve a dispute, prevent fraud, or comply with law. We will explain any applicable exception when responding to a request.

6. Security

We use industry-standard security measures including encryption in transit (TLS) and infrastructure-level encryption at rest provided by our hosting platform. OAuth tokens are encrypted and stored in access-controlled databases with row-level security policies. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security but we take reasonable steps to protect your information.

7. California Residents — CCPA Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

  • Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you
  • Right to Delete — request deletion of your personal information, subject to certain exceptions
  • Right to Opt Out of Sale — we do not sell personal information
  • Right to Non-Discrimination — we will not discriminate against you for exercising any of these rights

Notice of financial incentive

We offer 50 credits, added to your account once, for turning on conversation sharing. The personal information involved is the Kit conversations you start after you turn sharing on, shared as described in “Kit Conversations” above. Opting in is optional: you can accept when the app asks, or turn sharing on in Settings → General → Privacy. You can withdraw at any time by turning sharing off in the same place, and you keep the credits.

To exercise your rights, contact us at support@onekit.co. We will respond within 45 days.

8. EU/EEA/UK Residents — GDPR Rights

If you are located in the European Union, European Economic Area, or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR):

  • Right of Access — request a copy of the personal data we hold about you
  • Right to Rectification — request correction of inaccurate or incomplete personal data
  • Right to Erasure — request deletion of your personal data, subject to certain legal exceptions
  • Right to Restrict Processing — request that we limit how we use your data in certain circumstances
  • Right to Data Portability — request your data in a structured, machine-readable format
  • Right to Object — object to processing of your data based on legitimate interests, including for direct marketing purposes

Lawful basis: We process your personal data on the basis of contractual necessity (to provide the Service you signed up for) and legitimate interest (to improve and secure the Service). Where we rely on consent (such as for optional email tracking), you may withdraw consent at any time.

To exercise any of these rights, contact us at support@onekit.co. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. International Users

The Service is operated from the United States. If you access it from outside the US, your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer.

10. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the app at least 14 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Data Deletion Requests

To delete everything OneKit has stored in connection with your account — including OAuth tokens, platform user IDs, and any content you created through the Service — delete your account in the app: desktop, Settings → You → Delete account; phone, Settings → Delete your account. It takes effect immediately. If you no longer have the app, or you are the only owner of a workspace other people still use, contact us at support@onekit.co from the email address on your account and we will complete the deletion within 30 days.

You can also disconnect any individual platform (Instagram, Facebook Pages, X, LinkedIn, TikTok, YouTube, Gmail) at any time from within the OneKit app, which removes that connection and its stored credentials. See the Google section and Data Retention for how other active connections, local caches, and previously created records are handled.

13. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, contact us at:

AI Squads LLC

California, United States

support@onekit.co