Effective 26 August 2026 · Last updated 7 October 2026
This policy explains how the OneSum application ("OneSum", "the app") and the website at onesum.app handle information. It applies to the iPhone, iPad, Android, Mac and Windows versions of the app.
OneSum is developed and operated by OneSum LLC, a single-member limited liability company registered in New Mexico, United States. For any privacy question, or to exercise any right described below, contact admin@onesum.app.
OneSum is a read-only portfolio tracker. It executes no trades, holds no customer funds or securities, processes no payments, and provides no custody, brokerage, or advisory services. Any broker or exchange connection it offers is read-only.
Apart from the diagnostic data described below, we do not collect:
We do not keep your portfolio on our servers. If you allow full diagnostic logs, parts of it appear in those logs, which we keep for 7 days and then delete.
Everything you enter — positions, transactions, dividends, cost basis, currency preferences, and settings — is written to storage on the device itself, inside the app's private container. It is protected by your device's own security, including the device passcode and, on supported hardware, hardware encryption.
If your device is backed up through iCloud Backup, iTunes, or Finder, that backup may include the app's data. Those backups are governed by Apple's privacy policy, not this one, and we have no access to them.
On Android, the app disables participation in system backup, so its data is not copied to Google Drive or to any other Android backup. It stays on the device until you delete the app.
To display current prices, exchange rates, and dividend information, the app requests data from a third-party market data provider over an encrypted connection.
These requests contain only the identifiers needed to look up a price — for example a ticker symbol, an exchange code, or a currency pair. They do not include how many units you hold, what you paid, your portfolio total, or anything identifying you.
As with any internet request, the provider will receive your device's IP address and standard connection metadata. We do not control that provider's retention of connection logs, and their handling of that data is governed by their own privacy policy.
If you have enabled sharing of analytics and diagnostics in your device settings, Apple may provide us with aggregate, anonymised reports about crashes, performance, and general usage. These reports come from Apple already aggregated. They do not identify you, and we cannot connect them to an individual person or device.
You can turn this off at any time on iPhone and iPad under Settings › Privacy & Security › Analytics & Improvements, and on Mac under System Settings › Privacy & Security › Analytics & Improvements.
On Android, if you have enabled sharing of usage and diagnostics with Google, Google Play may provide us with aggregate, anonymised crash, ANR, and performance reports through the Play Console. These arrive already aggregated, do not identify you, and we cannot connect them to an individual person or device. You can turn this off under Settings › Google › Usage & diagnostics.
OneSum sends two kinds of diagnostic data, and they are treated differently.
Crash reports are sent when the app stops unexpectedly, and when it starts and exits. They carry the app version, your device model and operating system version, the country and the UTC offset of your device's time zone, whether the demo is loaded, the place in our code where the app stopped, and counters of errors and warnings. When you accept the Terms of Service in the app, it also sends a record of that acceptance, of the Terms version, and of your choice about full diagnostic logs. None of this carries anything you typed or hold: no ticker symbols, no quantities, no prices.
Full diagnostic logs record what the app did while you used it, so we can find and fix bugs. They can include ticker symbols, quantities, prices, cost basis, cash balances and messages returned by market data servers. They are sent only if you choose to send them. The demo never sends them. When you delete the demo to start your own portfolio, the app shows the Terms of Service and this policy with a separate box for full diagnostic logs; it is not ticked, and nothing of this kind is sent unless you tick it.
If you leave it unticked, the app asks again when you add a second portfolio, or a fourth ticker to a portfolio, at most three times in all. Not now lets you carry on with what you were doing. After the third time it stops asking, and the full logs stay off unless you turn them on yourself in Settings. Declining costs you nothing in the app: no feature is withheld, and nothing is degraded. The same Settings entry turns the logs back off whenever you want, which withdraws your consent from that moment on.
While the full logs are off, the app still records them on your device, and keeps the logs of the last few sessions that went wrong. They stay on your device. If you later choose to send full logs, those kept logs are sent too.
Both kinds carry a random identifier created by the app when it is installed. They do not include your name, email address, an account, advertising identifiers, or your device's name, and file paths are shortened so your user name is not included. We do not store your IP address with them. The identifier is shown in the app's Settings.
We keep diagnostic data for 7 days, then delete it automatically. To delete it sooner, use Delete my diagnostic data in Settings, or email admin@onesum.app with the identifier from Settings, or see how to delete your data. We use it only to find and fix problems in OneSum. We do not sell or share it, and never use it for advertising. It is sent over an encrypted connection and stored with Cloudflare, our hosting provider, in the United States.
The onesum.app website is a static site. It sets no cookies, embeds no advertising or analytics trackers, and asks for no personal information. Our hosting provider processes standard server logs, including IP addresses, for security and to keep the site running.
When you write to admin@onesum.app we receive your email address and whatever you put in the message. We use it only to answer you, and we keep support correspondence no longer than needed to resolve the matter and understand recurring issues.
If you are in the European Economic Area or the United Kingdom, our legal bases under the GDPR are:
| Purpose | Legal basis |
|---|---|
| Fetching market data so the app can show prices | Performance of a contract (Art. 6(1)(b)) — it is the function you asked for |
| Responding to your support email | Legitimate interests (Art. 6(1)(f)) — answering the person who contacted us |
| Crash reports from the app | Legitimate interests (Art. 6(1)(f)) — keeping the app working; they carry no information about you |
| The record that you accepted the Terms of Service | Performance of a contract (Art. 6(1)(b)) — it records the agreement you made with us |
| Full diagnostic logs from the app | Your consent, given in the app (Art. 6(1)(a)) — you can withdraw it at any time in Settings |
| Aggregate diagnostics from Apple and Google | Your consent, given in your device settings (Art. 6(1)(a)) |
| Keeping the website secure | Legitimate interests (Art. 6(1)(f)) |
Under the GDPR, UK GDPR, and comparable laws you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and the right to data portability.
In practice these rights are largely self-service here: apart from the diagnostic data described above, we hold no personal data about you. Your portfolio is on your device, so you can view, correct, export, or erase it directly in the app, and deleting the app removes it entirely. For diagnostic data, use Delete my diagnostic data in Settings, or email us the identifier shown there. For anything held in support email, write to admin@onesum.app and we will act on your request within 30 days.
If you believe we have handled your data improperly, you may lodge a complaint with your national data protection authority.
Under the CCPA and CPRA you have the right to know what personal information is collected, to have it deleted, to correct it, and to opt out of its sale or sharing.
We do not sell or share your personal information, and we never have. The only information we receive from the app is the diagnostic data described above, which we use only to fix bugs, and we do not use your data for cross-context behavioural advertising. Exercising any right under these laws will never result in discriminatory treatment.
OneSum is not directed to children under 13 (or under 16 in jurisdictions where that is the applicable age), and we do not knowingly collect personal information from them. Since the app collects no personal information from anyone, there is nothing we would hold. If you believe a child has provided us personal information through support email, contact us and we will delete it.
Network requests from the app use TLS encryption. Your portfolio data is protected by your device's own encryption and passcode, which is why keeping a passcode enabled and your operating system up to date is the single most effective thing you can do to protect it.
No method of storage or transmission is perfectly secure. Diagnostic data carries no name, email or account, so it is not linked to you, and we hold nothing else of yours on our side.
If you allow full diagnostic logs, and for the crash reports, the data is stored with Cloudflare in the United States. Market data requests and website traffic may be served by infrastructure in other countries, including the United States, under the providers' own safeguards.
If OneSum gains features that change how data is handled — cloud sync, accounts, brokerage connections, or paid subscriptions — this policy will be updated before that version ships, and the "last updated" date above will change. Material changes will also be noted in the app's release notes. Continuing to use the app after an update means you accept the revised policy.
Questions about this policy, or about privacy in OneSum generally:
admin@onesum.app