Oneslice Privacy Policy

1. Who we are and what this policy covers

Oneslice is operated by ALOY BOSE, an individual doing business as Polytonist, based in India ("we", "us", or "our"). Polytonist is a trading name, not a separate incorporated entity. ALOY BOSE is responsible for the personal information processed for the purposes described in this policy, including where applicable as its data controller.

This policy explains how information is handled when you use the Oneslice desktop app, related download website, AI features, account and billing functions, or support channels. It also explains your choices and how to contact us. It does not replace the independent privacy notices of a payment provider, identity provider, support platform, or another service you choose to use.

For privacy, access, correction, export, deletion, complaints, or security enquiries, email hello@tryoneslice.com. Send formal legal notices to polytonistteam@gmail.com. This email contact does not replace a legally required method of serving formal proceedings. You may also contact us through https://dsc.gg/polytonist. Do not post passwords, payment credentials, or sensitive personal information in a public Discord channel.

2. Information you provide

Account and identity information

We process your account identifier, email address, authentication and verification information, and relevant account dates and status. If you use Google sign-in, we receive the identity information supplied through that sign-in, which can include your name, email address, profile image, and provider identifiers. Google sign-in does not, by itself, give Oneslice access to all your Google services or files.

Email/password authentication is handled through Supabase Auth. Your password passes through the sign-in or registration interface and authentication service; we do not provide an operator-facing feature for viewing account passwords or maintain an ordinary plaintext-password field in the Oneslice profile database.

App content and preferences

We process information you enter, generate, or save through Oneslice, including:

• Dictated speech, recognized transcripts, AI requests, generated responses, and action results.
• Dictionary terms, replacement text, definitions where supplied, and entries suggested by AI.
• Scratchpad notes, formatting, drawings, and generated drawing descriptions.
• Reminder text and schedules, timer configuration, and stopwatch state.
• Interaction history and applicable context summaries.
• Settings such as tones, keyboard shortcuts, microphone selection, speech language, processor choice, and contextual-processing preferences.

Scratchpad drawings are not necessarily stored only as pictures. Serialized stroke data can contain the positions, shapes, colours, and other details needed to reconstruct a drawing. Consequently, synced drawings can be accessible through our backend just as synced text can be.

Purchases and support

We process subscription and order identifiers, plan and subscription status, billing-cycle dates, payment-verification results, included and purchased credit balances, and related transaction metadata received from Lemon Squeezy. Payment information submitted directly to Lemon Squeezy is handled through its checkout and payment systems; Oneslice does not operate a payment-card vault.

If you submit feedback, a bug report, an appeal, or a support request, we receive the message and any attachments and metadata you provide. This may include screenshots, recordings, or other material that is not otherwise kept in an ordinary Oneslice media archive. Email and Discord retain their own copies according to their systems and policies.

3. Audio, screen, text-field, and application access

Microphone and voice processing

Oneslice uses the microphone for supported voice features. While its native microphone stream is active, the app can maintain an approximately 0.8-second rolling local audio buffer, including before an active utterance is recorded. This helps avoid cutting off the beginning of speech. It does not mean all idle audio is continuously uploaded to an AI service.

During a voice turn, audio can be streamed directly to OpenAI through a short-lived authenticated connection. A completed recording can also be sent through our backend for a separate prompt-log transcription. Fallback paths can upload a complete recording through the backend for AI processing. Speech can therefore be processed more than once, and the log transcript is not guaranteed to match either your exact words or the final inserted text.

Audio capture, conversion, upload, and processing use temporary memory buffers. We do not operate an ordinary user-facing archive of raw voice recordings. That does not mean raw audio never exists in processing systems, that all memory is securely erased instantly, or that provider monitoring and retention are absent. Transcripts and output can persist separately as described below.

Screen inspection

When Enhanced Assistant uses screen inspection in response to a request, it can capture the full primary display, not only the active window or a selected region. Unrelated visible information can be included. There may not be a separate confirmation prompt for each capture.

Screen images can be held temporarily in app memory and sent directly to OpenAI or relayed through our backend. We do not operate an ordinary screenshot-history archive as part of that feature. Provider retention, temporary processing, and screenshots deliberately submitted to support are separate from that statement. Oneslice does not continuously record your screen as a general background surveillance feature.

Selected text, focused fields, and clipboard access

The app can read selected or focused-field text using Windows accessibility interfaces. A fallback can simulate copying and temporarily read or change clipboard text. It attempts to restore previously captured Unicode text, but restoration does not guarantee preservation of images, rich text, or all other clipboard formats. Depending on the feature, text from the focused field can be retrieved when there is no selection.

Application context

Oneslice can obtain foreground application/process and window-title information to interpret a request, determine the applicable tone, and support insertion into the intended app. Application context can also appear in interaction or diagnostic records. This is not a representation that Oneslice collects your complete browsing history or reads every running application's contents.

Avoid making information available through these features unless you are entitled to process it, including where it concerns other people. This precaution does not waive our own obligations concerning information we receive.

4. Usage, device, security, and diagnostic information

We process account-associated usage information, including turn and word counts, recording durations, timestamps, feature use, quota-reset dates, credit deductions, provider usage and cost information, and productivity statistics such as streaks and calculated time savings. Time-saved figures are estimates based on assumptions about manual work, not independently measured outcomes.

We also process IP addresses, hardware/device identifiers, connection and authentication information, application/runtime context, errors, and performance or latency information where available. Account and ban records can include origin and recent identifiers and relevant notes. These records help operate the Service, investigate abuse, enforce allowances, and understand costs and failures.

Local history and diagnostic output can include transcript text, generated results, actions, application context, and timestamps, rather than only anonymous technical counters. Backend and essential service providers also create operational logs. Oneslice does not currently offer a single setting that turns off every necessary security record, usage measurement, local diagnostic record, and provider log.

5. How we use information

We use information for the following purposes:

• Creating, authenticating, and managing accounts and authorized sessions.
• Recognizing speech, cleaning up and formatting dictation, answering requests, and carrying out supported actions.
• Applying Dictionary entries, tone settings, relevant application context, and enabled history or Scratchpad context.
• Saving and synchronizing app content, settings, timers, reminders, and statistics across supported devices and app windows.
• Captioning Scratchpad drawings and managing context/history where applicable.
• Processing purchases, verifying payment, maintaining plan entitlements, applying usage limits, and accounting for credits and provider costs.
• Providing support, investigating incorrect results or technical faults, and debugging the Service.
• Detecting and reviewing fraud, malicious activity, security incidents, and other prohibited use.
• Handling legal obligations, disputes, privacy requests, and communications necessary to operate the Service.

The operator may inspect customer content for debugging, support, and abuse review. Content stored in readable form in our backend is not inaccessible to us merely because it belongs to your account. We do not currently use customer content to train our own AI models. This is distinct from necessary inference, troubleshooting, and providers' separate processing controls.

6. Legal bases and sensitive information

Where a law requires a legal basis for processing, the basis depends on the purpose and your circumstances. It can include performance of the agreement with you for requested features and account services; legitimate interests in operating, securing, supporting, and preventing abuse of the Service, subject to required balancing and safeguards; compliance with legal obligations; or consent where required for a particular optional use.

Accepting the Terms or acknowledging this policy is not blanket consent to unrelated advertising, public disclosure, or a new purpose that legally requires separate permission. Where consent is the applicable basis, you may withdraw it, without affecting processing lawfully performed before withdrawal.

Your speech, notes, screen, and support material may reveal sensitive information about you or others. We do not require sensitive content simply to register an account. Do not submit it unless the feature is appropriate for your situation and any required legal conditions are satisfied. Availability of an AI feature does not make every sensitive-data use lawful or suitable.

7. AI services and contextual processing

We use OpenAI API services to process relevant audio, text, instructions, images, context, and generated results. Models and routes may differ between features, Standard and Enhanced processing, logging, and fallback handling. A single turn may involve Realtime processing, separate transcription, and other necessary processing rather than only one model call.

Existing Dictionary entries and relevant application information can be supplied as context. Where enabled and available for your plan, recent-interaction indexing and Scratchpad indexing can also supply previous requests/responses, notes, captions, timestamps, or summaries. Context has capacity limits and may be summarized or reduced. Turning an indexing setting off affects subsequent use of that source; it does not automatically erase earlier history, previously transmitted requests, or all active caches.

OpenAI's published API policy states that API data is not used for model training by default unless an account opts in. Its data-controls documentation explains endpoint-specific retention and exceptions. Provider processing and abuse-monitoring retention can apply, and we do not represent Oneslice as operating under a verified blanket zero-data-retention arrangement. Deleting an item inside Oneslice does not by itself recall every provider request already processed.

8. Service providers and other disclosures

Information is disclosed as needed to providers and recipients involved in the purposes above:

• Supabase: account authentication, database storage, synchronization, backend functions, operational records, and relevant request processing.
• OpenAI: AI inference and associated audio, transcription, text, image, and contextual processing.
• Lemon Squeezy: checkout, payment, subscriptions, invoices, tax handling, refunds, disputes, and entitlement verification.
• Google: identity processing when Google sign-in is selected.
• Brevo: delivery of emails we send, including recipient and message information needed for delivery.
• Cloudflare: website hosting and network/security services, including Turnstile on relevant authentication screens.
• Discord and email service infrastructure: communications and attachments sent through those channels.

Some providers process particular information under their own independent responsibilities and notices, especially payment, identity, and communications-platform information. Their retention and international processing may differ from ours. We may also disclose relevant information where legally required, to address a valid legal process, protect rights or safety, or investigate fraud or serious misuse, subject to applicable law.

We do not currently sell customer personal information or disclose customer content to a separate external product-analytics partner as an active analytics-sharing programme. External analytics sharing is a possible future plan, not a current feature. Before introducing a materially different disclosure or purpose, applicable transparency, legal-basis, consent, and objection requirements would need to be satisfied; a future possibility is not present permission to make an undisclosed disclosure.

9. Feedback, testimonials, and public material

Feedback and bug reports can be used to understand and improve Oneslice. We may also use specific feedback in product descriptions, case examples, or testimonials, including attribution where legally permitted.

Our intended contractual basis for feedback reuse is described in the Terms. It does not override privacy rights or replace valid consent where consent or another permission is legally required for publication of a name, email address, profile image, or identifiable feedback. We do not acquire an unrestricted right to publish private Scratchpad content, screenshots, or other account material merely because you use the Service.

Information you choose to post in a public community channel is visible according to that platform's settings and may be copied by other participants. Contact us if you have a concern about how we have used an identifiable statement or attribution. We cannot guarantee removal of copies independently retained by other people or platforms.

10. Website storage, authentication storage, and email plans

Website and app storage

Our current download website is not intended to run an advertising-tracking or optional product-analytics programme and does not currently use our own optional tracking cookies or preference storage. The hosting/network provider can still receive IP addresses and request metadata. Third-party pages or security services you open can use their own technologies.

The desktop app is different: it uses local files and WebView/browser storage for account sessions, application state, settings, and recovery. Authentication and security mechanisms, including Google sign-in and Turnstile where used, also involve their providers. A statement about optional website tracking does not mean no information is stored on your computer or processed during login.

Planned marketing and statistics emails

We do not currently operate the planned recurring marketing and personal-statistics email campaigns. We intend to introduce separate Marketing Emails and Statistics Emails preferences in the app. The proposed default is enabled where legally permitted, and in-app settings are the planned preference-management method; these controls are not described here as already implemented.

Those plans do not permit sending marketing without a lawful basis or prevent an unsubscribe or objection that applicable law requires. Any campaign must meet applicable consent and opt-out requirements before it is introduced, including an appropriate method outside the app where required. An enabled-by-default preference is not, by itself, proof of valid consent. Contact hello@tryoneslice.com to exercise applicable communication or privacy rights.

Essential authentication, security, purchase, billing, and account-service messages are separate from optional campaigns. An optional email preference does not necessarily stop messages necessary to provide or administer your account, and a statistics message containing promotions may be subject to marketing rules.

11. Local storage, cloud synchronization, and backups

Oneslice keeps account-associated local state and recovery files on your computer, including app content, settings, timer/stopwatch state, and history. Applicable content and metrics are also stored or synchronized through Supabase. Devices sharing an account can receive the same synced content. People with access to an unlocked device or its files may be able to access local data.

Offline changes may upload automatically when connectivity returns. Synchronization uses state reconciliation and does not guarantee preservation of every simultaneous edit on different devices. Deleting content on one device does not instantly rewrite an offline device's local files or every previous backup.

The database is backed up for recovery. Backup copies and local recovery files can retain earlier information after active records change or are deleted. Retention and recovery behavior depend on the applicable system configuration; we do not promise instantaneous deletion of all backup copies or universal recovery of lost data. Backups are not directly accessible as a customer-operated archive.

12. Retention, deletion, and account termination

App content is generally kept while needed for your account and requested features, subject to deletion, available storage/history capacity, and plan rules. Some history may be reduced, summarized, or cleared. A downgrade can remove Dictionary entries above the new limit; storage and context availability are not guaranteed to remain unchanged following a plan change.

We do not apply one fixed automatic retention period to every category. In assessing retention, relevant considerations include whether the account remains active; the purpose of the record; support and dispute needs; security and ban enforcement; transaction reconciliation and prevention of duplicate credit use; legal recordkeeping; and the operation of provider logs and backups. Support, billing, and ban-related records do not necessarily expire when an ordinary app item is deleted.

When a completed account-deletion or termination process removes the main account, associated active account content and linked records are deleted according to the database relationships. Account-linked in-app feedback can be deleted in that process. Separate email/Discord correspondence, retained transaction or anti-replay records, ban records, and backup copies may remain. Ban records can include account identity, email, hardware/IP information, and a note explaining the decision.

The app attempts local account cleanup on handled deletion/termination flows, but we cannot remotely guarantee secure erasure of every file or copy on every offline device. Account deletion also does not automatically delete information held independently by another platform or erase previously processed AI requests. Where a deletion request cannot be completed, contact support rather than assuming all records or billing have ended.

Termination can make active app content unrecoverable. Nevertheless, it does not eliminate privacy rights that apply to information still held. If a record must be retained for a legitimate or legal reason, applicable rights and exceptions continue to govern that retention.

13. International processing

We operate from India and serve international users. Our current Supabase project is hosted in the ap-south-1 region. This is not a promise that all information stays in that region: AI, hosting/security, identity, payment, email, support, operational logging, and other provider processing can occur in other countries.

Those countries' protections may differ from those where you live. International processing remains subject to applicable transfer restrictions and safeguards. This policy does not represent that a specific regulatory certification, adequacy decision, bespoke transfer agreement, or customer-selected regional AI configuration has been obtained for every transfer. Contact us for information relevant to your request or jurisdiction.

14. Security and human access

We use authentication, account-based access controls, server-side checks, and encrypted production network connections in operating the Service. Our hosting provider describes infrastructure encryption for database storage and backups. These measures reduce risk but cannot guarantee that unauthorized access, data loss, or disclosure will never occur.

Oneslice is not end-to-end encrypted. Our backend and AI providers need readable information to perform relevant features, and the operator can access stored content for the purposes described here. Local JSON, history, and recovery files do not have a separate Oneslice application-layer encryption guarantee; device-level protection depends in part on your operating system and configuration.

Keep your devices and credentials secure, use caution when sharing an account, and report suspected exposure to hello@tryoneslice.com. Do not send sensitive incident evidence through a public support channel. Necessary incident communications and any legally required notification are separate from optional marketing preferences.

15. Your choices and privacy rights

You can manage applicable content and settings in the app, stop invoking screen/voice features, control microphone access through available Windows/device settings, and disable supported recent-interaction or Scratchpad indexing. Not every necessary processing activity has an independent opt-out; some features cannot work without the information needed to provide them.

Depending on applicable law and circumstances, you may have rights to access your personal information; correct inaccuracies; obtain an export or portable copy; request deletion or restriction; object to certain processing, including direct marketing; withdraw consent; and complain to a competent privacy authority. These rights are subject to applicable conditions and lawful exceptions, not solely to our discretion.

Send requests to hello@tryoneslice.com. We can manually assemble an export of relevant database information. You can also initiate account deletion through the app or ask support for assistance. We may need proportionate information to verify identity and protect another person's information. We respond subject to the timeframes required by applicable law; the absence of a separate voluntary service deadline does not remove statutory deadlines.

Disabling a feature or withdrawing consent does not automatically reverse prior lawful processing, cancel a paid subscription, or require deletion of records that may lawfully be retained. If you cannot access the app, you may still contact us to exercise applicable rights.

16. Children and teenagers

Oneslice is intended for users aged 13 and older, subject to higher local requirements and any necessary parental or guardian permission. We do not currently provide a separate parental dashboard, dedicated parental-consent workflow, or an age-verification system beyond the registration arrangements. A requirement in the Terms does not establish that every child-data requirement has been satisfied.

The app uses provider-trained AI behavior and provider-side safety protections, not a custom Oneslice-trained safety model. These systems can fail, restrict content, or produce inappropriate results; they are not a guarantee of a child-safe or unfiltered experience.

If you believe we have received information from a person below the applicable permitted age or without required permission, contact hello@tryoneslice.com. Applicable law may require us to restrict processing or delete information. Providing this contact route does not substitute for safeguards or parental-consent arrangements required before processing begins.

17. Changes to this policy

We may update this policy and publish the revised version with a new effective date. Please check it periodically. We do not undertake to send a separate email or in-app announcement for every revision unless required by law or another applicable commitment.

If a material change, new purpose, or new disclosure requires additional notice, consent, or another legal step, those requirements apply before the relevant processing is introduced. Publishing an updated policy does not itself supply legally required consent or retroactively authorize a new use of your information.

18. Contact

Responsible operator: ALOY BOSE, doing business as Polytonist
Operating country: India
Privacy, support, billing, and complaints: hello@tryoneslice.com
Formal legal notices: polytonistteam@gmail.com
Discord: https://dsc.gg/polytonist