Privacy policy

OneLessTool works without an account. Most of what you can do here sends us nothing that identifies you. This page says what we do collect, on the website, the API and the MCP server, and how to get it removed. Questions or requests: Zarif.automates@gmail.com.

The short version

• We don't sell data, show ads, take affiliate fees or let vendors pay for placement.
• Audits you run are not stored unless you save the report.
• The API and MCP server need no key or login, and we don't store what you or your AI assistant send to them.
• Analytics are anonymous: page text and form values are masked, and session recording is off.

What we collect, and why

Browsing the website

When analytics is configured, PostHog records anonymous usage: pages viewed and left, clicks (with on-screen text and element attributes masked), page-speed measurements and a few product events such as “audit completed” with a rounded savings range. Before an event leaves your browser we strip query strings from URLs, except utm_ campaign tags, and remove private report IDs. PostHog keeps an anonymous ID in your browser to count repeat visits. We don't create a profile linked to your name or email. We use this to see which pages help people and where they get stuck. Blocking analytics in your browser doesn't affect the site.

Some things stay in your own browser's storage and are never sent to us unless you act: an unfinished audit, your progress through a workflow checklist, and the campaign tags and referring site from your first visit (sent only if you join the waitlist).

Running and saving an audit

The tools, plans, seats and costs you enter are processed to calculate your report and are not stored. If you choose to save the report, we store what you entered and the report under a random, unguessable link so you can come back to it. Saved reports expire after 180 days. You can separately opt in to a public, de-identified summary of a saved report. You may also tell us what you did after an audit (for example, cancelled or kept a tool, and the monthly saving), which we store without any personal details.

Joining the waitlist

We store your email address, the page and tool you signed up from, your first-visit campaign tags and referring site, and a keyed hash of your network address that we use to stop abuse. We use your email only to tell you about the product you signed up for.

Accounts

Accounts are optional and are not switched on yet. When they are, we store your email, your saved stack and the alerts you turn on. The account privacy page lists every field, how sign-in links and sessions work, and how long each is kept.

The API and MCP server

The REST API and the MCP server at /api/mcp are read-only and need no key or login. We don't store the questions, arguments or results that pass through them. Your network address (or, for IPv6, its /64 network) is used for a 60-second rate-limit window and is not stored by us. When analytics is configured, each MCP tool call sends PostHog an anonymous event with the tool's name, how long it took, whether it succeeded, and the name and version your AI client reported. It never includes your arguments, results, network address or any identifier. Your AI assistant's own provider handles your conversation under its own privacy policy.

Server logs

Our host, Cloudflare, keeps short-lived request logs (such as the address, time and status of a request) that we use to fix errors and stop abuse. They are deleted on Cloudflare's standard log schedule.

Payments

Paid plans are not switched on. If they are, Stripe takes the payment and we keep only the Stripe customer and subscription IDs and the plan status. We never see or store card numbers.

Who processes data for us

• Cloudflare: Hosts the site, API and MCP server; stores saved reports, the waitlist and accounts (D1); applies rate limits; keeps short-lived request logs.
• PostHog: Product analytics for the website, and anonymous MCP tool-call counts, when analytics is configured.
• Resend: Sends sign-in links, alerts and digests you ask for, when email is configured.
• Stripe: Takes payments if paid plans are switched on. We never see or store card numbers.

These providers are based in the United States and may process data there. We don't share data with anyone else unless the law requires it.

How long we keep it

• Audits you don't save: not kept.
• Saved reports: 180 days, then deleted.
• Waitlist entries: until you ask us to remove them.
• Accounts and saved stacks: until you delete them.
• Rate-limit data: a 60-second window for the API and MCP server; one hour for sign-in requests.
• Analytics: anonymous events, kept in PostHog under its retention settings so we can compare usage over time.

Your choices

• Delete an account and everything linked to it from your account page.
• Email Zarif.automates@gmail.com to remove a waitlist entry or a saved report, or to ask what we hold about you. Include the email address or report link concerned. We reply within 45 days.
• Block analytics with your browser's privacy settings or an extension. Everything keeps working.
• Don't share a saved report link you want to keep private: anyone with the link can open it.

Children

OneLessTool is not meant for children under 13, and we don't knowingly collect their data. If you think a child has given us data, email us and we'll delete it.

Changes

If this policy changes, we'll update the date at the top. If a change reduces your privacy, we'll say so on this page before it takes effect.

See also the terms of use and support.