privacy policy

1. Information We Collect

Account information

When you sign up, we collect an email address and a username. If you sign in with Google or Apple instead of email/password, we receive your name, email address, and profile photo from that provider, to the extent you've made them available to us.

Attempt videos

The core feature of Onlyest is recording video attempts at records ("titles"). When you record and submit an attempt, we collect:

• The video itself, recorded in-app using your device's camera and microphone (Onlyest does not accept uploads from your camera roll — only in-app recordings)
• Metadata about the attempt: the title you're attempting, timestamps, and the grading result

Videos are uploaded to our private storage and, if an attempt passes grading, a highlight clip is published publicly alongside your username and score as part of the title's leaderboard. Videos for failed attempts are not made public.

Public clips are public.Once a highlight clip is published, anyone can view it, and it may be viewed, downloaded, screen-recorded, or cached by others or by search engines. Deleting an attempt or your account removes it from Onlyest, but we can't guarantee removal from copies made elsewhere.

Be mindful of who and what you record. Because passed attempts become public, avoid recording other identifiable people (especially minors) without their consent, and be mindful of sensitive locations or personal details (addresses, license plates, documents) visible in the background.

Content you create

Usernames, display names, avatar photos, dispute submissions, and any other content you choose to add to your profile or an attempt.

Automatically collected information

Standard technical data such as device type, app version, and crash/error logs, collected to keep the Service running and to diagnose problems.

Marketing site analytics

The onlyest.app marketing site uses Google Analytics (GA4) to understand aggregate traffic (e.g. page views, referrers, general device/location info). This applies to the marketing website only, not the mobile app. See "Cookies and Tracking Technologies" below.

2. Cookies and Tracking Technologies

The onlyest.app marketing site uses cookies and similar technologies (via Google Analytics) to measure traffic and understand how visitors use the site. The Onlyest mobile app does not use cookies. You can control cookies through your browser settings; blocking them won't affect your ability to use the marketing site, only our ability to measure your visit.

3. How We Use Information

We use the information we collect to:

• Create and maintain your account
• Grade attempt videos and determine record outcomes (see "AI Grading" below)
• Display leaderboards, titles, and public highlight clips
• Send in-app notifications about your attempts, disputes, and record status
• Investigate disputes filed against a title
• Maintain the security and integrity of the Service (e.g. detecting fraud or abuse)
• Understand aggregate usage of the marketing site

We do not sell your personal information.

4. AI Grading and Third-Party Processing

Only after you explicitly allow AI processing in the app, Onlyest may send data to Google's Gemini API for automated title matching, attempt grading and safety checks, and reward-sticker creation. Depending on the feature, this can include a proposed or submitted title, candidate title names, your submitted raw video and its audio, the on-screen proof code, the interpreted feat, and sticker-style preferences. Attempt grading checks the proof code, moderates content, verifies the feat, and extracts a score for every submitted attempt, pass or fail.

Videos are transmitted through Google's Gemini Files API and this processing is subject to Google's data handling terms for that API. Onlyest's Gemini API usage is on a billed plan, not the free tier — under Google's Gemini API terms, Google does not use content submitted through paid API usage to train or improve its models.

You can decline or withdraw later under Settings → AI Processing Permission. If you decline or withdraw, Onlyest will not send new content to Gemini, but features that require AI processing—including recording and grading attempts—will be unavailable until you allow it again. Withdrawal does not undo processing that already occurred.

AI grading can be wrong.Automated grading may occasionally misjudge an attempt — passing one that shouldn't have passed, or failing one that should have. If you believe a grading decision was incorrect, you can file a dispute in-app, which flags the title for manual review.

5. How We Share Information

We share information with:

• Other users, in the form of public leaderboards, usernames, badge tiers, and highlight clips for passed attempts
• Service providers who process data on our behalf, currently:
  • Supabase — our database, authentication, file storage, and realtime infrastructure. Account data, attempt records, and video files are stored with Supabase.
  • Google (Gemini API) — for automated grading of attempt videos, as described above.
  • Google and Apple — if you choose to sign in with one of these providers, they act as your identity provider for authentication.
  • Google Analytics — for aggregate marketing site traffic, as described above.
• Law enforcement or other parties if required by law, or to protect the rights, safety, and security of Onlyest, our users, or the public.

We do not share your information with third parties for their own marketing purposes.

6. Data Retention

A dispute must be filed before the raw video's ordinary deletion deadline: within 7 days after a failed attempt is graded or within 21 days after a passed attempt is graded. Filing a dispute before that deadline pauses deletion under the disputed-video rule above.

When you request account deletion in the app, your account is immediately frozen and scheduled for permanent deletion seven days later. You can cancel the request by signing back in and choosing Restore my account before the deadline. During the grace period, existing public records remain visible, but no new account activity is allowed. At final deletion, we remove your profile, authentication account, videos, notifications, and sticker collection. Shared title and score history may remain under “Deleted user,” and any title you currently hold becomes vacant. Backup copies may persist for up to 30 days. We may retain limited information for fraud prevention, an open dispute, legal compliance, or another legitimate obligation.

7. International Data Transfers

Onlyest's service providers (Supabase, Google) may process and store information in countries other than the one you live in. By using the Service, you understand that your information may be transferred to and processed in these locations, which may have different data protection laws than your home country.

8. Your Choices and Rights

• Access and correction: you can view and update your profile information in-app.
• Account deletion: use Settings → Delete Account in the mobile app. The account is frozen immediately and permanently deleted after a 7-day grace period unless you sign back in and restore it.
• AI processing: review, allow, or withdraw permission under Settings → AI Processing Permission. The server blocks new Gemini processing when current permission is not active.
• Camera, microphone, and photo library permissions:the mobile app requests camera and microphone access to record attempts, and photo library access to save reward stickers. You can manage these permissions in your device settings; without camera/microphone access, you won't be able to record attempts.
• Depending on where you live, you may have additional rights over your personal information (such as the right to access, correct, delete, or export it). Contact us to exercise these rights.

9. State Privacy Rights

If you're a resident of California or another U.S. state with a comprehensive privacy law, you may have the right to know what personal information we've collected about you, access or delete it, correct inaccuracies, and opt out of certain processing. We do not sell personal information, and we do not use or disclose sensitive personal information for purposes other than providing the Service. To exercise these rights, contact us at the email below.

10. Children's Privacy

Onlyest is an adults-only service and is not directed at anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

11. Security

We use industry-standard measures to protect your information, including encrypted storage and access controls on our backend. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you in-app.

13. Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, USA, without regard to its conflict of law provisions.

14. Contact Us

Questions about this Privacy Policy or your data? Email us at hello@onlyest.app.