Privacy Policy

This policy explains what information onStart (“we”, “us”) collects when you use onstart.app and the sites published with it, why we collect it, and the choices you have. Questions: hello@onstart.app.

Information we collect

• Account information. Your email address and name. If you sign in with Google, we receive your name, email address and profile picture, never your Google password. If you sign up with an email and password, your password is stored only as a secure hash.
• Your projects. The app details, images, page content and Legal Setup answers you add, and the custom domains you connect.
• Billing information. Payments are handled by Paddle, our reseller and merchant of record. Paddle collects your payment details; we receive your subscription status, plan and billing period, never your full card number.
• Support requests. The messages and screenshots you send us through Support in the app, and our replies. Screenshots are stored privately and only you and our team can see them.
• Notifications. The notifications we show you in the app. If you turn on browser notifications, we store a notification token for that browser so we can send them, and which kinds of notifications you want.
• Activity. When you last had onStart open, so our team can see who is online when helping with support. We don't track what you do inside the app.
• Technical information. Our hosting provider records standard request data, such as IP address, browser type and the pages requested, to deliver the service and keep it secure. When you sign up or sign in with a password, Cloudflare Turnstile checks that you are not a bot.
• Messages. If you email us, we keep the message and your address so we can reply.

How we use information

• to provide onStart: your account, editor, published sites, domains and downloads
• to process your subscription and show your billing status
• to keep the service secure and prevent abuse, such as phishing sites
• to answer your questions and support requests
• to send you emails you need, such as confirming your address or resetting your password
• to notify you about your account, subscription, sites and support replies, in the app and, if you allow it, in your browser
• to comply with the law

We do not sell your personal information and we do not use it for advertising.

Sites you publish

Sites published with onStart are yours. You decide their content, including the privacy policy and terms you publish for your own app, and you are responsible for them. Published sites set no cookies and include no analytics or advertising from us. When someone visits a site, our hosting provider handles the request and its technical data as described above.

Our team's access

A small number of people on the onStart team can see your account details, subscription status, projects and drafts. We use this access only to answer your support requests, to fix problems and to keep the service safe, for example by taking a phishing site offline.

Service providers

We share information only with providers that help us run onStart, under their own privacy terms:

• Supabase, for the database, sign-in and file storage, including support screenshots, in Frankfurt, Germany.
• Vercel, for hosting onstart.app and published sites, including a global content delivery network.
• Paddle, for payments, taxes and invoices, as merchant of record.
• Google, for signing in with your Google account, for sending account emails through Google Workspace, and for browser notifications through Firebase Cloud Messaging.
• Cloudflare, for Turnstile, which protects the sign-up and sign-in forms from bots.

Some of these providers process information outside your country, including in the United States. Where the law requires it, they do so under safeguards such as the European Commission's standard contractual clauses.

We may also disclose information when the law requires it, or to protect our users and the service.

Cookies

onstart.app uses only necessary cookies: one set that keeps you signed in, one that remembers your light or dark theme, and one that remembers your language. If you turn on browser notifications, your browser also stores the notification token. During checkout, Paddle may set cookies it needs to process your payment, and Cloudflare Turnstile may use similar technology to tell people from bots. We use no analytics or advertising cookies.

How long we keep information

We keep your information while your account exists. When you delete your account in Settings, we delete your profile, projects, published sites, uploaded files, connected domains, support requests and their screenshots, notifications and notification tokens. Paddle keeps billing records for as long as tax law requires, and our hosting provider keeps request logs for a short time for security.

Your rights

You can access and change most of your information in the app, choose which notifications you get or turn them off in Settings, and delete your account at any time in Settings. You can also ask us to access, correct, export or delete your personal information, or object to how we use it, by emailing hello@onstart.app. If you are in the EU or UK, you may also complain to your data protection authority.

Security

We use encryption in transit, access controls and row-level security on our database. No system is completely secure, so we cannot guarantee absolute security.

Children

onStart is for app developers and is not directed at children under 16.

Changes

We may update this policy. We will change the date above, and for significant changes we will let you know by email or in the app.