Privacy Policy

This policy explains what information WriteOnce ("we", "us") collects when you use writeonce.one and the WriteOnce app, how we use it, who processes it for us, and the rights you have over it. It applies to the website, the dashboard and every feature of the Service. Contact us anytime at [email protected].

Account details: your name, email address and password (stored only as a secure hash), or your Google profile (name, email, avatar) if you sign in with Google. Profile settings: your timezone, default platforms and plan. Content: the posts, captions, drafts, images and videos you create or upload. Feedback: the name, email and message you send through the feedback form.

When you connect a social account, the connection happens through our publishing partner, upload-post, on their hosted page. upload-post holds the OAuth tokens needed to publish. WriteOnce never stores your platform passwords or tokens. What we store is the account metadata needed to show your dashboard: the platform, username, display name, profile picture and connection status, plus your last used Facebook Page or Pinterest board.

We use cookies only to keep you signed in (session cookies set by our authentication system). We do not run advertising trackers or third party analytics scripts on WriteOnce. Our hosting and infrastructure providers keep standard server logs, such as IP address and request time, to operate and secure the service.

We use your information to operate the Service: publish and schedule your posts, store your media, and show analytics for your connected accounts. We also use it to keep your account secure and prevent abuse, to process subscriptions through Polar, to send transactional email (sign-in links, verification, password resets, account deletion confirmations), and to respond to your feedback. We do not sell your data, and we do not send marketing email.

These providers process data on our behalf, only as needed to run the Service:

Images and videos you upload are stored in Cloudflare R2 under keys scoped to your account. Uploaded media is served from a public URL so that social platforms can fetch it for publishing, so treat anything you upload as content you intend to publish. You can delete media from your library at any time, which removes the file from storage.

We keep your data for as long as your account exists. When you delete your account (confirmed by email), we delete your posts, drafts, media, social account records, feedback and your publishing profile at upload-post. upload-post deletes profile data within 30 days of termination under its own policy. Payment records are retained by Polar as required by law.

You can view and edit your account details in settings, delete your content, disconnect any social account, and delete your whole account without contacting support. Depending on where you live (for example under the GDPR), you also have rights to access, correct, delete and port your data, and to object to or restrict processing. To exercise any of these, use your settings or email [email protected]. You can also revoke platform access directly in each platform's security settings; for YouTube, use your Google account security settings.

All traffic is encrypted in transit with TLS. Passwords are hashed, never stored in plain text. Media uploads use short lived signed URLs scoped to your account, and platform credentials are held by upload-post rather than on our servers. No system is perfectly secure, so we encourage a strong, unique password.

WriteOnce is not directed to children under 13 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

We will update this policy as the Service changes and note the date of the latest revision at the top of this page. If a change is material, we will give notice by email or in the app. Questions or requests: [email protected].