ONE Privacy Notice

ONE is built to keep as much of your working life on your own computer as it possibly can, and this notice is mostly a list of the few things that have to leave it.

Who we are

Brazn Mngo GmbH, Dr.-Bock-Brücke 7, 31089 Duingen, Germany, represented by its managing director Stefan Michael Kannemann, is the controller for the processing described here. Write to support@braznmngo.com about anything in this document.

What this covers

This notice covers your ONE account, your subscription, and the ONE application you download and run on your own machine. It does not cover what happens when you visit our website, which the website privacy text covers, and it does not cover your own account with the company whose language model you choose to use — that is a separate agreement between you and them.

The app runs on your computer

ONE is a program you install. It works in a folder on your own machine, and almost everything it produces stays there. We do not receive a copy of that folder, we cannot read it, and the application sends nothing to us about how you use it — there is no usage tracking, no analytics and no crash reporting of any kind in the app.

What ONE remembers about you

ONE keeps what it learns about you — your preferences, your goals, facts you have told it, the people you work with, and the lessons it draws from your conversations — as ordinary text files in that folder. You can open them, read them, edit them and delete them with any text editor, without asking us and without telling us. They are yours and they never reach our servers.

Your conversations

Your conversations with ONE are stored by the application on your own computer, inside the app's own storage on that machine. They are not held as text files you can edit by hand, and they are not sent to us.

The language model, which is the important paragraph

ONE cannot think by itself. To answer you, it passes what it is working on to a language model, and it does that through one of three routes you choose and pay for yourself: Anthropic's Claude command-line tool, OpenAI's Codex on your own ChatGPT subscription, or OpenAI's programming interface using an API key you supply. In every case the connection runs on your credentials and your account with that company, under your agreement with them, and the application holds no model credential of ours. So when ONE reads your mail, your tasks or your notes on your behalf, that content goes to the provider you picked, on your own account — we neither hold it nor see it, and what they may do with it is governed by the terms you accepted with them, not by this notice. If you supply an OpenAI API key, the application stores it in your operating system's own credential store and nowhere else.

Your tasks

Your tasks, projects, comments and attachments live on ONE Tasks, a service we run for you as part of the subscription. We process that content to provide the service to you, on the basis that it is needed to perform our contract with you. On the team edition, the content of a shared project is available to the colleagues who share it.

Signing in

You sign in from the application through your browser, and the application keeps the resulting sign-in token in your operating system's credential store — Windows Credential Manager or the macOS keychain — and nowhere else. It is never written into a settings file, a log, an analytics record or a crash report. We keep a record of which devices you have authorised, so that you can revoke one.

Your account and your subscription

To run the subscription we keep a small account record: an identifier for you, an identifier for your organisation, which edition you are on, the language you chose, the dates your trial and subscription started and end, and references to your entry at our payment provider. We also record which version of the terms, the privacy notice and the pricing you accepted, and in which language you accepted them, because we have to be able to show what you agreed to. Your email address is held by the account system that signs you in and is not duplicated into these commercial records. The legal basis is performing our contract with you, and for the acceptance record our obligation and our legitimate interest in being able to prove it.

Payment

Payment is handled by Stripe. Your card details are entered into Stripe's own payment field and never reach our servers; what we keep is Stripe's reference to your customer and subscription entry, so that we can raise and find your invoices. Stripe holds your name and billing address under its own privacy terms.

Email we send you

We send you transactional messages only — invitations, confirmations, and messages about your account. There is no marketing, no bulk sending, no mailing list, and no message we send you is written by a language model. Our mail provider handles the delivery and therefore sees your address and the message. We do not keep a suppression list of addresses.

If you connect Google

If you choose to connect Gmail, you authorise it yourself in Google's own consent screen, and the permission we ask for is send-only — ONE can send a message as you and cannot read your mailbox. The resulting authorisation is stored in your operating system's credential store on your own machine. The application identifies itself to Google using a registration that belongs to us, alongside the authorisation that belongs to you.

Bug reports

Two kinds. A report the application raises by itself about its own failure is assembled entirely from fixed values we chose — a failure code, which part of the product failed, at which step, the version, timestamps and a count — and it can carry nothing from your work at all, not even your name. A report you ask ONE to file carries the kind of report, a title, your own words, your name as reporter, and the minimum context needed to understand it; it never carries the text of your mail, messages or documents, other people's names, or any password or key. Both are filed into a shared feedback project that other people using ONE can also see, so please do not put anything confidential into one. Automatic reports are on by default and you can turn them off at any time by telling ONE to stop sending them.

Updates

The application checks for a new version when it starts and once an hour after that, which necessarily tells the update server your IP address and which version you are running. It sends nothing else and no identifier of you.

The team edition

On the team edition, your colleagues can see that a task in a shared project was written by a teammate's assistant. Your organisation's administrator manages seats and settings, and cannot read, search, export or recover anything in your private space. If your membership ends, your private space becomes inaccessible — to you and to your administrator alike — because that same boundary is what made it private.

Who else is involved

Our servers run at Hetzner. Payment runs through Stripe, transactional mail through our mail provider, and software distribution and our development infrastructure through GitHub. Each of them acts on our instructions under a data processing agreement. Nobody else receives your data, we sell nothing to anyone, and there is no advertising in ONE.

Outside the EU

The language model you choose is a US company, and you reach it on your own account, so that transfer is yours rather than ours. Of our own providers, Stripe, our mail provider and GitHub may process data outside the EU; where they do, the transfer rests on the European Commission's standard contractual clauses or an adequacy decision. Hetzner runs the servers holding your tasks and account records.

How long we keep things

We keep your account and task data for as long as you have an account. When you delete your account, we delete what the servers hold — with one exception the law requires: invoices and the records that identify who they were issued to must be kept, so a minimised record survives, carrying your identifiers, the edition, the payment references, what you accepted, the subscription dates and the address the invoice was issued to. That record is cleared in turn once the statutory retention period has run. We use ten years, which is the period German commercial and tax law sets for accounting records.

Deleting your account

You delete your account from within the product. We record the request before anything else happens, close the account, revoke the credentials on your devices, tell you by email that the deletion is running, and only then destroy your data — and the sequence stops rather than continues if any step fails, so a deletion that could not complete is one we can find and finish. If you are the administrator of an organisation that has other members, you must hand it over to a named successor first.

Your rights

You can ask us what we hold about you and get a copy of it, have it corrected, have it deleted, have its use restricted, object to processing we base on our legitimate interest, and receive what you gave us in a machine-readable form so you can take it elsewhere. Where we rely on your consent you can withdraw it at any time, which does not affect what we did before you withdrew it. Write to support@braznmngo.com; we answer within one month.

Complaining

If you think we have handled your data wrongly you can complain to a data protection supervisory authority, in particular the one for Lower Saxony — Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover — or the authority where you live or work.

No automated decisions

Nothing here makes a decision about you automatically that has a legal or similarly significant effect on you. ONE drafts and suggests; you decide.

Changes

If we change this notice we will tell you and ask you to accept the new version, and we record which version you accepted so that both of us can see what applied when.