Privacy Policy

Last updated 10 November 2026

1. Who we are

onestar is operated by Luka Kapetanovic, an individual based in Belgrade, Serbia ("onestar", "we", "us"). We are the controller of the personal data described in this policy. You can reach us through the contact form. There is no separate data protection officer: messages go straight to the person who runs the service.

2. What this policy covers

This policy covers onestar.cc and the onestar web app. It applies to people who create an account, people who visit the website or write to us, and people whose public reviews onestar reads. Checkout and payment pages are run by Creem and are covered by Creem's own privacy policy.

3. The data we collect

• Account data. Your email address. If you sign in with Google, also the name and profile picture Google shares with us. We also keep sign-in records: one-time codes (which expire after 15 minutes) and the sessions that keep you signed in. We never ask for or store a password.
• Listings and settings. The App Store, Google Play or Google Maps links and business names you add, whether a listing is yours or a competitor's, your report language, your alert settings, and the country your browser reports, which we use to pick the right store.
• What onestar makes for you. Reports, reply drafts, and what you mark as replied.
• Public reviews. For each listing you track we store its public reviews: the rating, title, text, date, app version, the reviewer's public display name, and any public reply from the owner.
• Google Business Profile, if you connect it. A credential that lets us read the reviews of your locations and post the replies you approve. It is stored encrypted. You can disconnect at any time from the Google page in onestar or from your Google Account's third-party access settings.
• Billing. Payments are handled by Creem. We never see or store your card details. We receive a customer reference, your plan, your subscription status and its renewal date.
• Messages. When you write to us through the contact form: your email address, your message, and whether you were signed in.
• Technical data. Like every website, our hosting providers log requests: IP address, browser type, the page requested and the time. We use these logs for security and to fix problems.
• Waitlist. If you left your email address on our earlier coming-soon page, we hold it to send you one email when onestar opens.

We don't ask for sensitive data such as health information, and we ask you not to send any.

4. Cookies and browser storage

We don't use advertising cookies, analytics cookies, tracking pixels or third-party trackers. To keep you signed in, onestar stores a sign-in token in your browser's local storage until you sign out. Cloudflare, which serves the site, may set a strictly necessary cookie to protect it from abuse.

5. Why we use your data, and our legal bases

• To provide the service: creating your account, signing you in, reading reviews, writing reports and reply drafts, posting replies you approve, and sending the alerts and weekly reports included in paid plans. Legal basis: our contract with you.
• To manage your plan and billing. Legal basis: our contract with you, and legal obligations to keep records.
• To send service emails: sign-in codes, alerts, weekly reports, and notices about changes to the service or these documents. Legal basis: our contract with you. You can switch alert emails off for each listing. We don't send marketing email unless you have agreed to it.
• To keep the service safe and fair: preventing abuse, enforcing plan limits such as the one free report, and finding and fixing faults. Legal basis: our legitimate interests.
• To read public reviews. Legal basis: our legitimate interests and those of the business or developer in understanding public feedback about their own or a competing product.
• To answer your messages and privacy requests. Legal basis: our legitimate interests and our legal obligations.
• To send the waitlist email. Legal basis: your consent, which you can withdraw at any time.

We don't make decisions about you by automated means that have legal or similarly significant effects. We don't use your data to train AI models.

6. How AI is used

Reports and reply drafts are written by an AI model from Anthropic. For this we send Anthropic the name of the listing, the store it is on, and each review's rating, date, title and text. We don't send your email address or the reviewers' names. Review text is written by members of the public and may include personal details its author chose to publish. Under Anthropic's commercial terms, data sent through its API is not used to train its models.

7. Who we share data with

We share personal data only with the providers that run parts of the service for us, and only what each one needs:

• Convex (United States): our database and backend. Holds all account and app data.
• Cloudflare (United States, global network): serves the website and protects it. Processes technical data.
• Resend (United States): sends our emails. Processes your email address and the content of the emails we send you.
• Anthropic (United States): writes reports and reply drafts, as described above.
• DataForSEO: retrieves public Google Maps and Google Play reviews. Receives the listing or business being looked up, never your account details.
• Apple and Google: we request public review data from their stores, and we use Google's services when you sign in with Google or connect your Business Profile.
• Creem: our merchant of record. Creem sells the subscription to you, takes the payment, and handles tax and invoices as an independent controller under its own privacy policy. We give Creem your email address and an internal account reference so your payment can be linked to your account.

We may also disclose data when the law requires it, to establish or defend legal claims, or to a successor if onestar is sold or merged, in which case we will tell you first. We don't sell personal data and we don't share it for advertising.

8. Data from Google

onestar's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to show you your reviews, write your reports and reply drafts, and post the replies you approve. We don't sell it, don't use it for advertising, and don't use it to train generalised AI models. Nobody at onestar reads it unless you ask us to, it is needed for security, or the law requires it.

9. International transfers

We are based in Serbia, and our providers process data in the United States and other countries. Where the law requires a safeguard for such a transfer, we rely on an adequacy decision where one exists, including the EU–US Data Privacy Framework for providers certified under it, or on the standard contractual clauses in our agreements with providers.

10. How long we keep data

• Your account and its content: for as long as your account exists.
• A listing you remove: its stored reviews and reports are deleted straight away. We keep a note that your free report has been used.
• Account deletion: when you ask, we delete your account and its data within 30 days, except what we must keep by law or need to resolve a dispute or prevent abuse.
• Sign-in codes: 15 minutes.
• Messages to support: up to 24 months.
• Billing: we keep your plan and subscription status while your account exists. Creem keeps payment and invoice records for as long as tax law requires.
• Server logs: kept by our hosting providers for a limited time, on their own schedules.
• Waitlist addresses: until the launch email has been sent, or until you ask us to remove yours.

We may delete accounts that have not been used for 24 months, after warning you by email.

11. Security

All connections to onestar are encrypted. There are no passwords to steal: you sign in with a one-time code or with Google. Google Business Profile credentials are encrypted before they are stored, with a key held separately from the database. Access to the systems is limited to the person who runs onestar. No online service can promise perfect security. If a breach affects your personal data, we will tell you and the authorities as the law requires.

12. Your rights

Depending on where you live, you have the right to:

• get a copy of the personal data we hold about you;
• have it corrected or deleted;
• restrict or object to how we use it, in particular where we rely on legitimate interests;
• receive it in a portable format;
• withdraw a consent you have given;
• complain to a data protection authority.

To use any of these rights, write to us through the contact form, signed in or from the email address on your account, so we know the request is yours. We answer within 30 days and never charge for it. We won't treat you differently for using your rights.

In Serbia, the authority is the Commissioner for Information of Public Importance and Personal Data Protection. In the EEA or the United Kingdom, you can complain to the authority where you live or work. If you live in California, you have the rights to know, correct and delete your personal information, and you may use an authorised agent. We don't sell or share personal information as California law defines those terms.

13. If you wrote a review

If you posted a public review of an app or business that an onestar user tracks, we may hold a copy of that review and your public display name, taken from the App Store, Google Play or Google Maps. We use it only to show the review to that user, summarise it together with other reviews, and draft a reply. You can ask us to delete our copy through the contact form. To change or remove the review itself, use the store or map where you posted it.

14. Children

onestar is a tool for businesses and is not meant for anyone under 18. We don't knowingly collect personal data from children. If you believe a child has given us personal data, tell us and we will delete it.

15. Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use your data, we will email account holders at least 14 days before it takes effect.

16. Contact

Questions, requests and complaints about privacy go through the contact form or to support@twobricklabs.com. See also our Terms of Service.