Privacy Policy · OneTapAnswer

1The short version

OneTapAnswer is a desktop app that reads the window in front of you when you press a hotkey, asks an AI, and shows you the answer. This page is about the data that makes that possible.

What it reads from your screen never reaches us. It goes from your computer to the AI you chose, and nowhere else.
We hold an account and little else — your email, your name as Google gives it to us, which plan you are on, and a hashed fingerprint for each of your two computers.
We never see a card number. Payment happens on Stripe’s or PayPal’s own pages.
We do not sell anything to anybody, and there is no advertising network in this product or on this website.
You can have all of it deleted by sending one email. See your rights.

The rest of this page is the same thing at more length, because the short version is not a legal document and the long one has to be.

2What we collect

Email and name: From Google when you sign in. We ask Google for nothing else — not your contacts, not your files, not your other Google services.
Which plan you hold: The plan, when it renews, and whether it is active. Written by the payment webhook, not by the app.
Device fingerprints: A one-way hash of your computer's hardware identifiers, so a licence can cover two machines. We cannot turn the hash back into your hardware — that is the point of hashing it.
A count of answers: How many of the 10 free monthly answers you have used, so the count can reset on the 1st. A number, not a record of the questions.
Feedback you send: Only what you type into the Feedback form, plus your email so we can reply.
An email address, if you ask for a link: When a phone visitor asks us to email the download link, we keep the address so the link can be sent and so the same address cannot be used to send hundreds.
Anonymous page counts: Which pages of this website are read, and roughly where from. No cookie, no profile, no cross-site tracking — see cookies and analytics.

That is the complete list. There is no hidden telemetry in the desktop app: no keystroke logging, no browsing history, no list of the applications you run, no location.

3What OTA reads from your screen

This is the clause worth reading carefully, because it is the one the product makes you wonder about.

OTA captures the foreground window only — not the whole screen, not your other applications, not the taskbar, not a second monitor.
It captures only when you press the hotkey. There is no background capture, no interval, no watching.
The capture is held in memory, sent to the AI you chose, and dropped. There is no history and no image cache.
Two engines — ChatGPT and Gemini — can only be handed a file. On those paths OTA writes the image to a private temporary file for the few seconds the answer takes, overwrites it with zeros and deletes it. On the Claude path nothing touches the disk at all.
With Ollama, the picture never leaves your computer, because the model is running on it.

4Why we hold what we hold

Under the GDPR every piece of personal data needs a lawful reason to exist. Ours, in the same order as section 2:

Contract: Your email, plan and device fingerprints exist because you asked us to provide the service, and it cannot be provided without knowing who you are and what you have paid for.
Legal obligation: Payment records and invoices are kept because tax law requires it. This is the one category we cannot delete on request.
Legitimate interests: Anonymous page counts, and the rate limits on the download-link form. Both are needed to run a website that works and is not abused, and neither identifies you.
Consent: Nothing, today — and that is the honest entry rather than an empty one. We hold nothing that needs your permission, because we store nothing non-essential on your device (section 7). If that ever changes, this row is where you will see it, and you will be asked before it runs.

5Who else sees it

These are every outside service that touches your data, what each one does, and where to read its own policy. There are no others, and this list is not a category — it is the complete set.

Supabase: Stores the account: email, plan, device fingerprints, feedback. Their policy.
Google: Signs you in. We receive your email address and name, nothing else. Their policy.
Stripe: Takes card payments. Card numbers go to Stripe, never to us. Their policy.
PayPal: Takes PayPal payments. Same rule: we never see the payment details. Their policy.
Vercel: Serves this website and counts anonymous page views. Their policy.
Cloudflare: Routes email to and from our addresses, and serves the installers. Their policy.
Resend: Sends the emails we send you: download links and support replies. Their policy.

We do not sell personal data, we do not share it for advertising, and we have never received a government request for any of it. If that last sentence ever stops being true, it will be removed from this page rather than quietly left standing.

6How long we keep it

Your account (email, name, plan): Until you ask us to delete it. We do that within 30 days, and it removes the row rather than flagging it.
Device fingerprints: While the device is one of your two. Removing it in Settings → Account deletes the record immediately.
Payment records and invoices: Seven years. Tax law requires this and it outlives account deletion.
Feedback you send us: Until the conversation is closed, then two years.
What OTA reads from your screen: Not kept. It never reaches our servers at all.

7Cookies, analytics, and why there is no banner

This website sets no advertising cookies, no tracking cookies and no third-party cookies. Here is everything it puts in your browser, which is the complete list:

Your sign-in: Only if you signed in here. Held by Supabase so you stay signed in — without it you would be signed out on every page.
Your theme choice: Light or dark, if you pressed the switch. Stored on your device and never sent anywhere.
Whether you asked for the link: If this browser has already asked us to email the download link, so the page can say so rather than ask twice.
A referral code: For thirty days, and only if you arrived on somebody's affiliate link — so the person who recommended OTA is credited if you buy. It identifies them, not you.

Analytics are Vercel Web Analytics. It counts page views and where they came from. It sets no cookie and reads none, stores nothing on your device, builds no profile of you, and cannot follow you to any other website.

If you would rather not be counted at all, any content blocker stops it, and nothing on this site or in the app behaves differently. You can also clear everything in the list above from your browser’s own settings at any time; the only thing you lose is being signed in.

This is a promise about what we do not do, and it binds. If we ever add something that stores anything non-essential, or that follows you off this site — a second analytics vendor, an advertising pixel, a session recorder — then the question goes back in front of you before it runs, and account holders are emailed first (see section 13).

8Your rights, and how to use them

Wherever you live, you can ask us to do any of the following, and we will do it within 30 days:

Tell you what we hold about you, in a readable file.
Correct it if it is wrong.
Delete all of it. This removes your account row rather than flagging it. Payment records survive, because tax law requires them to — that is the only exception, and it is not our choice.
Export it in a machine-readable format you can take elsewhere.
Object to anything held on legitimate interests — including the anonymous page counts, which any content blocker also stops outright with nothing on the site breaking.

Email support@onetapanswer.com from the address on the account. We do not charge for any of this, and we will not ask you why.

One address, not a privacy@ alias that forwards to the same inbox — support@onetapanswer.com is read by the person who wrote this page.

9If you are in the EU or the UK

You have every right in section 8, and they are rights rather than favours. Two additions:

You can complain to a regulator. In the EU that is your national data protection authority; in the UK it is the Information Commissioner’s Office. You do not have to come to us first, though we would rather you did.
Your data is processed outside the EU/UK. Supabase, Vercel, Stripe, PayPal, Cloudflare and Resend are US-headquartered. Each operates under the standard contractual clauses or an adequacy framework; their policies, linked in section 5, set out which.

10If you are in California

You have the right to know what personal information is collected, to delete it, to correct it, and not to be discriminated against for asking. Sections 2, 6 and 8 are the answers, and they are the same answers everybody else gets.

We have not sold or shared personal information in the twelve months before the date at the top of this page, and we do not intend to. There is therefore no “Do Not Sell My Personal Information” link, because there is nothing for it to switch off.

11Children

OTA is not for children. You must be 16, or the age of digital consent where you live if that is higher, to hold an account. We do not knowingly collect anything from anybody younger; if you believe we have, write to support@onetapanswer.com and it will be deleted.

12Security

Every connection is encrypted in transit. Your session is sealed to the machine it was created on, so a stolen token is not a usable token elsewhere. The database enforces row-level security, which means an account can read its own rows and no others — this is enforced by Postgres rather than by application code that could be bypassed.

No system is perfect. If you find a way to reach somebody else’s data, write to support@onetapanswer.com and you will get a reply from a person, not a ticket number.

13Changes to this policy

When this page changes, the date at the top changes with it. If a change materially reduces your privacy — a new processor, a new category of data, a longer retention — we will email account holders before it takes effect rather than relying on you to re-read the page.

Questions about any of this go to support@onetapanswer.com. The Terms of Service cover the rest of the relationship, and the docs explain the screen-reading mechanism in more detail.