privacy policy

1. Information We Collect

Account information

When you sign up, we collect an email address and a username. If you sign in with Google, Apple, or Facebook instead of email/password, we receive your name, email address, and profile photo from that provider, to the extent you've made them available to us.

Attempt videos

The core feature of Onlyest is recording video attempts at records ("titles"). When you record and submit an attempt, we collect:

• The video itself, recorded in-app using your device's camera and microphone (Onlyest does not accept uploads from your camera roll — only in-app recordings)
• Metadata about the attempt: the title you're attempting, timestamps, and the grading result

Videos are uploaded to our private storage and, if an attempt passes grading, a highlight clip is published publicly alongside your username and score as part of the title's leaderboard. Videos for failed attempts are not made public.

Public clips are public.Once a highlight clip is published, anyone can view it, and it may be viewed, downloaded, screen-recorded, or cached by others or by search engines. Deleting an attempt or your account removes it from Onlyest, but we can't guarantee removal from copies made elsewhere.

Be mindful of who and what you record. Because passed attempts become public, avoid recording other identifiable people (especially minors) without their consent, and be mindful of sensitive locations or personal details (addresses, license plates, documents) visible in the background.

Content you create

Usernames, display names, avatar photos, dispute submissions, and any other content you choose to add to your profile or an attempt.

Automatically collected information

Standard technical data such as device type, app version, and crash/error logs, collected to keep the Service running and to diagnose problems.

Marketing site analytics

The onlyest.app marketing site uses Google Analytics (GA4) to understand aggregate traffic (e.g. page views, referrers, general device/location info). This applies to the marketing website only, not the mobile app. See "Cookies and Tracking Technologies" below.

2. Cookies and Tracking Technologies

The onlyest.app marketing site uses cookies and similar technologies (via Google Analytics) to measure traffic and understand how visitors use the site. The Onlyest mobile app does not use cookies. You can control cookies through your browser settings; blocking them won't affect your ability to use the marketing site, only our ability to measure your visit.

3. How We Use Information

We use the information we collect to:

• Create and maintain your account
• Grade attempt videos and determine record outcomes (see "AI Grading" below)
• Display leaderboards, titles, and public highlight clips
• Send in-app notifications about your attempts, disputes, and record status
• Investigate disputes filed against a title
• Maintain the security and integrity of the Service (e.g. detecting fraud or abuse)
• Understand aggregate usage of the marketing site

We do not sell your personal information.

4. AI Grading and Third-Party Processing

When you submit an attempt, the raw video is sent to Google's Gemini API to be automatically graded — checking for a verification nonce, moderating content, verifying the feat was actually performed, and extracting a score. This happens for every submitted attempt, pass or fail. The video is transmitted to Google's Gemini Files API for this processing and is subject to Google's own data handling terms for that API. Onlyest's Gemini API usage is on a billed plan, not the free tier — under Google's Gemini API terms, Google does not use content submitted through paid API usage to train or improve its models.

AI grading can be wrong.Automated grading may occasionally misjudge an attempt — passing one that shouldn't have passed, or failing one that should have. If you believe a grading decision was incorrect, you can file a dispute in-app, which flags the title for manual review.

5. How We Share Information

We share information with:

• Other users, in the form of public leaderboards, usernames, badge tiers, and highlight clips for passed attempts
• Service providers who process data on our behalf, currently:
  • Supabase — our database, authentication, file storage, and realtime infrastructure. Account data, attempt records, and video files are stored with Supabase.
  • Google (Gemini API) — for automated grading of attempt videos, as described above.
  • Google, Apple, and Facebook — if you choose to sign in with one of these providers, they act as your identity provider for authentication.
  • Google Analytics — for aggregate marketing site traffic, as described above.
• Law enforcement or other parties if required by law, or to protect the rights, safety, and security of Onlyest, our users, or the public.

We do not share your information with third parties for their own marketing purposes.

6. Data Retention

If you delete your account, we delete or anonymize your personal information within 30 days, except where we're required to retain it (e.g. to resolve an open dispute, or to comply with a legal obligation).

7. International Data Transfers

Onlyest's service providers (Supabase, Google) may process and store information in countries other than the one you live in. By using the Service, you understand that your information may be transferred to and processed in these locations, which may have different data protection laws than your home country.

8. Your Choices and Rights

• Access and correction: you can view and update your profile information in-app.
• Account deletion: contact us at the email below to request deletion of your account and associated personal data.
• Camera, microphone, and photo library permissions:the mobile app requests camera and microphone access to record attempts, and photo library access to save reward stickers. You can manage these permissions in your device settings; without camera/microphone access, you won't be able to record attempts.
• Depending on where you live, you may have additional rights over your personal information (such as the right to access, correct, delete, or export it). Contact us to exercise these rights.

9. State Privacy Rights

If you're a resident of California or another U.S. state with a comprehensive privacy law, you may have the right to know what personal information we've collected about you, access or delete it, correct inaccuracies, and opt out of certain processing. We do not sell personal information, and we do not use or disclose sensitive personal information for purposes other than providing the Service. To exercise these rights, contact us at the email below.

10. Children's Privacy

Onlyest is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Security

We use industry-standard measures to protect your information, including encrypted storage and access controls on our backend. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you in-app.

13. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, USA, without regard to its conflict of law provisions.

14. Contact Us

Questions about this Privacy Policy or your data? Email us at hello@onlyest.app.