What this page covers
Last updated: August 25, 2026.
You.one is built to help regular people make progress in real life. This page is meant to tell you, directly, what data the product uses today and where it can go.
It is a truth-first summary of how the product works right now, not a promise about future changes.
What you share with You.one
When you use You.one, you may share what you type, tap, or submit. That can include the situation you want help with, answers you choose, freeform notes, feedback, your name, or your saved location.
If you put something into You.one, assume it may be processed to run the experience.
What we may store in your browser
Some product state is stored locally in your browser so You.one can feel continuous, even though parts of the experience may also be sent to our backend or service providers when needed.
- your name and saved home location
- appearance and product preferences
- where you left off, saved answers, and screens you can return to
- session or visit IDs that help keep a visit together
What may go to our systems and service providers
To generate the next useful step, prompts, answers, and recent context from your visit may be sent to AI providers such as OpenAI, xAI, and Groq, depending on which route is enabled at the time.
To understand quality, reliability, and whether the product is actually helping, You.one may send telemetry and diagnostics to our systems and, when enabled, tools such as PostHog, Google Analytics, Vercel Analytics or hosting logs, and Sentry. That can include cookies or session IDs, pages viewed, buttons pressed, forms submitted, campaign and referral information, device and rough geography data, conversion events, error data, screen or route metadata, and in some cases transcript snapshots or request details used for debugging.
If replay tooling is enabled, session replay may also be active. That setup is meant for product learning and debugging, and public form inputs should be masked rather than sent in readable form.
If you create or use an account-backed experience, authentication and account data may go through Clerk. If you search for or confirm a location, those requests may go through Google Maps. If you send feedback or a privacy request, delivery may go through SendGrid, and operational follow-up may use tools such as Vercel Blob or Trello when they are enabled. If you leave an optional tip, payment may go through either Stripe or Venmo depending on your choice.
We do not currently sell personal information or use it for targeted advertising. Google Signals and ads personalization are not part of the default You.one analytics setup.
We do not use your conversations or inputs to train a You.one model. Outside AI providers may temporarily process or retain API requests under their own business/API data policies, including for safety, abuse monitoring, reliability, and legal reasons.
Google account connection
Connecting Google is optional. When you choose Connect Google, You.one may request access to the Google products shown in the consent screen, including Gmail, Drive, Calendar, Contacts, and Tasks. You can grant only some requested access; You.one treats that as a valid partial connection and shows which products are connected, declined, unavailable, still syncing, or need attention.
The connection lets Ava stay oriented to the email, files, meetings, contacts, and changes you authorize so you do not have to explain the same context repeatedly. It does not give Ava unlimited authority. Reading connected content does not by itself authorize Ava to send, publish, buy, permanently delete provider content, or take another consequential external action.
For Gmail, You.one stores account-scoped mailbox metadata across the authorized mailbox, including message and thread identifiers, dates, sender and recipient headers, subject, labels, snippets, attachment metadata, provider state, and deletion records. By default, it also stores normalized message bodies and encrypted raw-message references for the most recent 24 months. Older message bodies and attachment content are retrieved and cached when you or Ava need them for an authorized feature.
For Drive and other connected Google products, You.one stores the provider identifiers, metadata, change history, and content needed for synchronization, search, retrieval, and the features you use. Google remains the canonical source for Google files and records.
Connection credentials and tokens are encrypted in a private credential vault and are kept separate from mirrored source content. You.one does not place passwords, one-time codes, cookies, OAuth tokens, or authorization headers in the Board, Activity, search documents, model context, or ordinary application logs.
Source synchronization, parsing, and indexing do not run a frontier generative model across your mailbox. When an Ava feature needs connected content, only relevant authorized evidence is retrieved for that interaction or background task. You.one may send that selected evidence to approved AI service providers to provide the feature for you. Google user data is not sold, used for advertising, or used to train generalized models across users.
You.one's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
How we use data
- run the guided experience
- remember your settings and resume progress
- improve quality, safety, speed, and reliability
- learn where people get stuck and what actually helps
- process feedback and optional payments
- synchronize and retrieve content from services you choose to connect
- help Ava understand authorized context and provide features for you
The goal is to be practical, clear, and helpful, not to collect data for its own sake.
Privacy controls today
You.one has account-backed saved experiences today, but it does not yet have a full self-serve privacy dashboard.
That means privacy controls are manual for now. You can ask us to review, correct, or delete information connected to you, but we may need enough detail to find the relevant records, and some records may be limited by provider retention limits, security or legal retention, logs, backups, or records we do not fully control.
For California residents
If you are in California, you can ask us to tell you what we have connected to you, correct it, delete what we control, or stop any sale or targeted-advertising share if that ever applies.
For now, send a privacy request. These requests are handled manually for now, with possible provider retention limits.
Your choices and cautions
You can clear local You.one data by clearing this site's browser storage and cookies. You can also choose not to submit feedback or payment details.
You can ask us to review, correct, or delete information connected to you by sending a privacy request. Because this is manual today, include the email, account, browser/session details, or other context we can use to find the relevant records.
You can disconnect Google at any time. Disconnecting revokes the connection, stops new synchronization, and begins the applicable deletion process for the mirrored source data You.one controls. Disconnecting You.one never deletes the original email, file, calendar, contact, task, or other content from Google.
If something is highly sensitive, share as little as possible. You.one is an AI-powered product. It can be useful, but it can also be wrong. It is not an emergency service, crisis service, or a substitute for a qualified professional.
If you have a privacy question, send a privacy request. For other feedback, contact us.