Privacy Policy

This policy explains what OneMove (operated by Hivemind Labs, “we”, “us”) collects, why, and the controls you have. Our data infrastructure runs on Supabase in the United States (us-east-1).

1. What we collect

• Account data: your email address and authentication metadata.
• Goal and business data: the number you’re tracking (e.g. revenue, calls booked), targets, and context about your business you choose to share.
• Check-ins: whether you completed each day’s move and what you report happened.
• Coach conversation: the messages you exchange with the AI coach, stored to give it memory of your situation.
• Usage events: product analytics such as pages viewed, features used, and timestamps.
• Technical data: a hashed version of your IP address, device/browser type, and cookie identifiers (see Section 7).
• Payment data: handled by Lemon Squeezy — we receive your plan, status, and transaction reference, not your full card number.

2. Why we collect it

• To generate a relevant, specific move each day and remember your context over time.
• To run check-ins, coach replies, and the weekly scoreboard.
• To operate billing, entitlements, and the free trial.
• To secure accounts, prevent abuse, and enforce fair-use limits.
• To understand product usage and improve OneMove.
• To send transactional email (check-ins, receipts, account notices) and, where you’ve opted in, product updates.

3. Legal bases (GDPR)

For users in the EEA/UK, we rely on: contract (to provide the service you signed up for), legitimate interests (security, fraud prevention, product improvement), and consent (optional marketing email, non-essential analytics cookies). You can withdraw consent at any time without affecting the lawfulness of earlier processing.

4. Who processes your data

We share data with the following processors, each bound by a data processing agreement:

• Supabase — database, authentication, and storage.
• Vercel — application hosting.
• OpenRouter, routing to model providers including Anthropic and OpenAI — AI processing of your goal data and coach conversation to generate moves and replies.
• AWS SES — transactional email delivery (check-ins, receipts, notices).
• Lemon Squeezy — payment processing, billing, and tax collection as merchant of record.

5. International transfers

Our primary database is hosted in the United States (Supabase, us-east-1). If you’re located outside the US, your data is transferred to and processed in the US and other countries where our processors operate. Where required, we rely on standard contractual clauses or equivalent safeguards with our processors for these transfers.

6. Retention

We keep your account and coaching data for as long as your account is active, so the coach can maintain useful memory of your situation. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we’re required to retain records (e.g. billing records) for legal or tax purposes.

7. Memory controls

The coach’s memory of your business context is not a black box. Go to Settings → Memory to view what the coach remembers about you, edit or correct it, export it, or delete it. Deleting memory doesn’t delete your account or billing history.

8. No selling, no training on your data

We do not sell your personal data. We select AI model providers under API terms that do not permit training on your data — in other words, your goals, numbers, and coach conversation are not used to train the underlying models. We only use your data to generate your own coaching responses and to operate and improve OneMove itself.

9. Cookies

• Session cookie (essential) — keeps you signed in.
• Anonymous ID cookie (essential) — lets logged-out visitors keep their first move and trial progress.
• First-party analytics — aggregated usage data collected directly by us, not shared with ad networks.

We don’t use third-party advertising cookies. You can block cookies in your browser settings; essential cookies are required for OneMove to function.

10. Your rights (GDPR)

If you’re in the EEA/UK, you have the right to access, correct, delete, restrict or object to processing of, and export (portability) your personal data. Email support@onemove.coach to exercise these rights, or use Settings → Memory for coaching data directly. You also have the right to lodge a complaint with your local data protection authority.

11. Your rights (CCPA/CPRA)

If you’re a California resident, you have the right to know what personal information we collect, request deletion, correct inaccurate information, and opt out of the sale or sharing of personal information. We do not sell or share your personal information as defined by the CCPA/CPRA. Email support@onemove.coach to make a request; we won’t discriminate against you for exercising these rights.

12. Children

OneMove is not directed to anyone under 18, and we don’t knowingly collect data from children. If you believe a child has provided us data, email support@onemove.coach and we’ll delete it.

13. Security

We use encryption in transit and at rest, access controls, and least-privilege practices with our processors. No system is perfectly secure; if we become aware of a breach affecting your data, we’ll notify you as required by applicable law.

14. Contact

Privacy questions or requests: email support@onemove.coach or hello@onemove.coach.