App One Privacy Policy

App One is a student workspace for calendar, registration planning, coursework, email, and campus tools. It serves students at supported schools — currently MIT, Harvard, CMU, Stanford, and Wellesley — as well as students elsewhere who register under “Others”. App One is an independent project and is not affiliated with or endorsed by any university. This policy explains what information App One stores, why, and the choices you have. It applies to the website at app.app-one.org and to the App One mobile app, which presents the same service.

Information we collect

• Account information. Your username, email address (verified with a one-time code), school affiliation, and optional profile details such as role, entry year, and avatar. Passwords are stored only as salted cryptographic hashes, never as plain text.
• Content you add. Calendar events and tasks, course roadmaps and course preferences, homework uploads and notes, workspace files, chat messages and attachments, and feedback you submit.
• Connected services (optional). If you choose to connect Canvas, Gradescope, Piazza, or a Google / Microsoft email account, App One stores the credentials or OAuth tokens needed for that connection in encrypted form (AES-256-GCM at rest). Inbox messages are read from your provider when you open the email tools and are not stored on App One servers; only lightweight references and your own preferences are kept.
• Voice input (optional). When you tap Voice Input in Academic Assistant, supported browsers may use their own speech recognition service to show a live draft; that processing is controlled by your browser or device provider. When you stop recording, the audio is sent through App One to a third-party AI provider solely to produce the final transcript. App One does not save the audio recording. The transcript is placed in your draft so you can review or edit it before sending.
• Technical records. Sign-in sessions (stored as token hashes), optional push-notification subscriptions, storage-quota and usage records for AI features, and standard service logs. Network delivery and basic aggregate analytics are provided by Cloudflare.

How we use information

• To provide the features you use and keep them in sync across your devices.
• To exchange data with services you explicitly connect (for example, reading your Canvas assignments).
• To send verification codes, password-reset codes, and reminders you turn on.
• To run AI features you invoke (such as answer comparison or the academic assistant): the content you submit for that request is processed by third-party AI model providers on our behalf and is not used by App One for advertising.
• To protect the service against abuse and to debug problems.

App One does not sell personal information and does not show ads.

Sharing and your visibility controls

Your content is private to your account by default or shared only according to the visibility you choose — for example, schedules and answer uploads can be private, friends-only, group, or public, and friend connections require mutual confirmation. Beyond that, information is shared only with service providers who process it for us (hosting, Cloudflare, email delivery, and AI model providers when you use AI features), or if required by law.

Retention and deleting your account

Your data is kept while your account is active. You can delete your account at any time in the app under Profile → Account → Delete account. Deletion is permanent: it removes your account record, content, uploaded files, chat messages, sessions, and stored connection credentials from the live database. Routine backups that may contain your data expire and are replaced on a rolling schedule. One-time verification codes expire on their own within minutes.

Security

All traffic is served over HTTPS. Passwords are hashed, third-party credentials are encrypted at rest, and access to production systems is restricted. No online service can promise perfect security; please report any concern promptly through the in-app Feedback tool.

Children

App One is intended for college and university students and is not directed to children under 13. We do not knowingly collect information from children under 13.

Changes to this policy

If this policy changes materially, the effective date above will be updated and significant changes will be announced in the app.

Contact

Questions or requests about your data — including deletion requests if you can no longer access your account — can be sent through the in-app Feedback tool, or see Support for all contact options.