OneNect privacy policy

Last updated: November 8, 2026

Techno Optics LLC, trading as OneNect, is the controller of the personal data described in this notice, except where you use OneNect through an organization. Where you do, that organization is the controller of the information it puts into OneNect and of the purposes it chooses there, and we act on its instructions. The section headed "If you use OneNect through an organization" explains which is which and how to reach yours.

In short

OneNect is a communication and wellbeing app. Techno Optics LLC builds it and runs it. Organizations run it for the people who belong to them: a workplace, a congregation, a club or a household.

OneNect itself is open: anyone can sign up for a personal account and use it with their family and their friends. OneNect Corp, OneNect Faith and OneNect Estate are joined by invitation, from the organization that runs one. Some screens can be read without signing in, and what is on them depends on the organization whose OneNect you are reading.

We do not sell your personal data, we do not share it with advertisers, and we do not track you across other companies' apps or websites.

If you use OneNect through an organization

Your employer, your church, your club or your household may run OneNect for its members. Where it does, it decides which features are available to you, what it asks you for, who inside it can see what, and how long it keeps things. For that information the organization is the controller and we act on its instructions.

We remain the controller of your account itself: signing in, keeping your session secure, delivering notifications to your device, diagnosing faults, and keeping the service running and safe. Nobody's organization can switch those off, which is why they are ours. We also choose where OneNect is hosted and which providers we use to run it, which the section headed "Who else handles your data" lists.

To ask about the information your organization holds, or to exercise your rights over it, contact your organization. If you write to us instead we will tell you within five working days who to ask, and pass your request on.

What we collect, and why

If you browse without signing in

We do not ask you for anything and we build no profile of you.

Our servers keep the record any web service keeps in order to answer a request and to stay secure: the network address the request came from, and the app or browser version that sent it. Two things go further than that, and we would rather say so than round it down. A screen that orients itself to where you are sends the coordinates your device offers, so that it can answer. If the app hits a fault, an error report is recorded. Legal basis: our legitimate interest in operating a working and secure service.

If you contact us through the app

When you use the "Talk to us" form we collect your name and email address, your topic and message, and the part of the organization's directory your question is about. You can also give us a phone number and the name of your company or organization, both optional, if you would rather be called or you want us to know who you are with. The message reaches the people the organization has chosen to answer that kind of question, by notification, email or text message depending on how each of them asked to be told. Legal basis: your consent, and the organization's legitimate interest in answering an inquiry.

If you sign in

Account and profile. Name, email address, job title or role, department, office or site, profile photo, and language preference. Where an organization provisions you through its own single sign on or directory, those details come from it and it decides what they say. Its legal basis is performance of your contract of employment or membership, or its legitimate interest in operating an application for its members.

We are the controller of the account itself: your credentials, your sign in, and the security of your session, including our ability to sign every device out at once. No organization can switch those off, which is why they are ours rather than its. Legal basis: performance of our terms of use with you, and our legitimate interest in operating a secure service.

Precise location. Only while the app is open, and only if you allow it. We collect your exact coordinates rather than a rounded or approximate position. We do this because a safety alert can be aimed at an area as small as 100 meters across, and because an emergency alert you raise yourself has to tell a responder where you actually are. We use it for three things: to reach you with safety alerts that apply to the site you are at, to pass your position to responders if you raise an emergency alert, and to show relevant local content. We do not track your location in the background, and we do not build a location history: only your most recent position is stored, and each update overwrites the one before it. You can refuse or withdraw this at any time in your device settings, and the app continues to work, though geo targeted safety alerts will not be able to reach you. Legal basis: your consent, and where an organization runs OneNect for you, its legitimate interest in health and safety.

Step counts. If you turn on step counting, we read the daily step total from your device's motion sensor to power your personal goal. We store a daily total, not a movement trace, not a route, and not continuous activity data. This is optional and off until you enable it. Under GDPR this is health data, so our legal basis is your explicit consent, which you can withdraw at any time by turning step counting off.

If you belong to more than one organization in OneNect, you turn step counting on separately in each one, and each sees your daily totals only while it is on there. Your phone counts one walk, and we file the same daily total in every workspace where step counting is on, and in no other. A workspace receives days from when you turned it on there, not the days before. A daily total that includes a reading from your phone's health record is filed only in workspaces where you have also allowed that reading.

Withdrawing in a workspace deletes the daily totals held for that workspace: we do not merely stop adding to them. A workspace where step counting is still on keeps its own, because you are still consenting to that one. When step counting is off in every workspace, we hold no daily totals for you at all. Your calendar goes back to holding no reading for those days, your figure stops appearing on any challenge or club board, and if you had agreed to show your figure to a step club that agreement ends with it. A score already recorded in a challenge that has finished stays as that challenge's result, because it is a record of a competition rather than a reading of your walking.

Reading today's total from your phone's health record. Your phone keeps a health record of your walking: Apple Health on an iPhone, Health Connect on an Android phone. Reading today's daily total out of that record is a separate choice from step counting, asked for on its own, and off until you turn it on yourself. That includes everybody who turned step counting on before this existed: agreeing to one has never been agreeing to the other, and nobody is opted in by default.

It is worth having if you wear an Apple Watch or a fitness band, or if your phone spends the day on a desk. That walking is recorded by the watch rather than by the phone, so without this your figure here can be far lower than the one your own Health app shows. We read one number per day, the total, and nothing else: never a route, a location, a time of day, a workout, or any other measurement the record holds. We never write anything to your health record.

Leaving it off does not stop your steps. Your phone keeps counting with its own motion sensor exactly as it does now, and your calendar, your streaks, and any challenge or club board carry on. The only difference is that walking your phone did not see is not added in.

Under GDPR this is health data, so our legal basis is your explicit consent, which you can withdraw at any time under Devices & activity in your profile, and the reading stops at once. Unlike step counting, withdrawing this one does not delete the daily totals already recorded. Each of those is a single figure your phone and your health record contributed to together, and there is no way to take only the record's part back out; those days are also held under your step counting consent, which is still live. Your figure goes back to what your phone counts on its own, and if you want the days deleted as well, turning step counting off deletes all of them.

Showing your step figure to other people. Turning step counting on does not show your figure to anybody. Publishing it to colleagues is a separate choice, and there are two ways to make it, each asked for on its own:

• Joining a step challenge. The people in that challenge see your daily total and your position in it.
• Agreeing to show your figure to a step club you are in. The members of that club, and nobody else, see your daily total and your position on that club's board. This is asked per club: agreeing in one club says nothing about any other, and it does not publish you to the wider company. You can change the answer at any time on the club's own screen, and leaving the club ends it.

Neither choice is retroactive. We publish only the days you walked from the moment you agreed onwards; days walked before that stay private. If you decline, or have not been asked yet, you still appear in the club's member list with your name and photo, as you already do, and carry no step figure. Under GDPR this is health data, so our legal basis for publishing it is your explicit consent.

Where the challenge or the club belongs to an organization running OneNect, publishing your figure to it is a disclosure to that organization, which becomes the controller of what it receives from that point and decides what it does with it. That is a different event from us reading your health record, which stays ours, and it is why the two are asked for separately.

Reading your step record while you are not using the app. The choices above say WHAT we read. This one is about WHEN, and it is asked separately because it is a real change rather than a detail.

If you allow it, the app can read the daily step total out of your phone's health record while the app is closed or in the background. Nothing else changes. It is still one number per day, the daily total, and still nothing else: no route, no location, no time of day, no workout or activity type, no heart rate, and no other measurement your record may hold. It is still only your own record, still kept no longer, and still shown to nobody unless you have separately chosen to publish your figure.

We ask for this because a step count that is only correct while you have the app open is not much use. Your phone counts all day; without this, your figure only catches up when you happen to look at it, which is why a figure on a club board can be hours behind what your phone knows.

On an Android phone this is a permission Health Connect asks you for in its own screen, separate from the one that lets us read your steps at all. On an iPhone it is part of the health permission you grant Apple Health. On both, you can withdraw it there at any time without turning step counting off, and the app falls back to reading your figure while you are using it.

Being explicit about the trade, because it is your data and the honest answer matters more than the feature: allowing this means the app looks at your health record at moments when you are not looking at your phone. We think that is worth it for a figure that is right rather than stale, and it is why it is a separate choice you can decline and still use everything else.

Step history already in your phone's health record. Separately, and only if you turn it on yourself, the app can read daily step totals out of the health record your phone keeps: Apple Health on an iPhone, Health Connect on an Android phone. That record is not only this phone's own counting. It can include days from before you installed OneNect, and days recorded by an Apple Watch, a fitness band or another health or fitness app you use, because these stores aggregate what every device and app signed into them has written. So a day we import may be a day this phone never counted, and may have been measured by a device we have no relationship with.

This is a second choice, not part of turning step counting on: counting your steps from today onwards and reading what was already recorded in the past are different things, and we ask for them separately. We read one number per day, the daily total, and nothing else - no route, no location, no time of day, no workout or activity type, no heart rate, and no other health measurement your record may hold. We do not read which device or app recorded a day, beyond storing which health store the figure came from. We read back as far as the start of the previous calendar year and no further, matching how long we keep step totals at all. On Android, Health Connect normally limits an app to the last 30 days unless Google has separately approved deeper access, so less is usually available there. A day your record holds nothing for is left blank rather than recorded as a zero.

Imported days are shown only to you: they do not earn points, do not count towards streaks, awards or any leaderboard, and do not change where you or anyone else stands. Under GDPR this is health data, so our legal basis is your explicit consent, which you can withdraw at any time in your profile. Withdrawing deletes the days that were imported: we do not merely stop adding to them. Days the app counted itself are not affected, and declining or withdrawing leaves the rest of the app working exactly as it did.

Emergency contacts. If you add them, we store the names and phone numbers of other people: an emergency contact whose name and number you type in, and up to four people for your Code Red circle, some chosen from the colleagues you work with in OneNect and some added by name and mobile number. These people have not given us their details; you have. We use them to tell them when you raise a Code Red and when it ends, by text message to the number you gave us. When a Code Red goes out we copy each contact's name and number onto a record of who it reached, so that the same people are told it has ended even if you change your list in between; that record is a safety alert delivery record, kept as the section "How long we keep it" says. Your emergency contact's name and number are not shown to administrators. They are shown to a colleague answering your Code Red only if you have turned on sharing your medical details in an emergency. You can change or remove them in the app at any time. Legal basis: your consent, and where an organization runs OneNect for you, its legitimate interest in health and safety.

Photos and videos. Only files you choose. The app reads nothing from your photo library until you pick something to attach to a post, a volunteer log or your profile picture.

Voice clips on a walkie talkie channel. The microphone opens only while you are holding the talk button on a walkie talkie channel, and only if you allow it. What you say is sent to us as a short audio clip and stored so that the people in that channel can hear it. A clip is set to expire 24 hours after it is sent. The app does not record at any other time and does not record in the background. Audio is also part of a video if you record one to attach to a post. Legal basis: your consent, given when you allow the microphone and hold the button.

Your phone's own calendars. Only if you turn it on, and only the calendars you pick. OneNect can show events from calendars already on your phone, such as an iCloud, Google or Outlook calendar, beside your OneNect calendar, and can warn you before you book something that clashes with one of them. This happens on your phone and nowhere else. No event from those calendars is sent to us: no title, time, place, attendee or note from them reaches our servers, and we do not store any of it. We never add, change or delete anything in your phone's calendars. If you accept a different time to avoid a clash, the only thing sent to us is the new time of the OneNect plan you are saving. Which of your phone's calendars you picked is remembered on that phone only; which of OneNect's own sources you show is a setting kept with your account. You can turn this off at any time in Settings, or withdraw calendar access in your device settings, and the rest of the app carries on as before.

Content you create. Posts, comments, messages, IT and legal requests, volunteer logs, event responses and similar.

Searching. When you type in the search box, or type @ to mention someone, the words you typed are sent to our servers so that they can return matches. Legal basis: performance of our terms of use with you.

Prayer requests and service notes. In a church's OneNect you can post a prayer request, and you can keep notes of your own under each service. Either can reveal your religious beliefs, and a prayer request often says something about your health or your family as well, so we treat both as special category data under GDPR. A prayer request is a post under your name. It is seen by the members of your church you address it to, either the whole congregation or your own ministry, and by the church's administrators who moderate its posts, and it does not leave that church's workspace. You can delete it at any time. Your service notes are yours alone: no screen in OneNect shows them to anybody else, including the minister and the church's administrators, and you can delete them at any time. The church is the controller of what is posted in its workspace, and of the fact that you belong to it, which can itself reveal your religion. Its legal basis for this is your explicit consent, or its legitimate activities as a religious body with its own members.

Ingredient checks. When you scan a product's barcode, we keep a record of the check: the product, the barcode, which of your scan profiles you checked it for (you, a family member, a pet or animals you look after), the verdict, the reasons for it and the ingredient list it was based on, and when you checked. Because a verdict is judged against that profile's allergies, dietary needs and conditions, this record can reveal health information about you and the people and animals you scan for. Only you can see it, in the workspace where you made it. You can delete any entry, or your whole history, from the app at any time.

Personal budgets. In OneNect Personal you can keep a budget: its name, currency and period, the categories you divide it into with an optional limit for each, and the amounts you enter against them, each with a day and an optional note. It is a record you keep by hand. OneNect does not connect to your bank, does not ask for a card or account number, does not read a balance from anywhere and does not move money. A budget is seen by you alone, in the workspace where you made it, and no organization or other person can see it. You can delete an entry, a category or a whole budget at any time. Legal basis: performance of our terms of use with you.

Vehicles in an Estate. A household running OneNect Estate can keep a catalog of the cars, aircraft and boats it uses: what each is called, its registration, tail number or berth, the property where it is normally kept, a photograph, and details such as make, model, year, seats and when its service is due. The location and other details embedded in a photograph are removed when it is uploaded. A vehicle carries no position and no record of where it has been, so the catalog cannot be used to follow whoever drives it. A vehicle is seen by the members of the household who may see the property it is kept at. The household is the controller of this catalog.

Shipping addresses. If you request branded promotional items or printed material through the app, we keep the delivery addresses you save in your address book, including the recipient name, street address, city, region, postal code and country, so that the items can be shipped and so you do not have to type an address twice. Where a request is placed for an event or on somebody else's behalf, we also keep that recipient's name, phone number and email address and the date it is needed by. Nothing in the app is sold or paid for, so we never collect a payment card, billing address or bank detail.

Requests you place for promotional items. What you asked for, how many, the delivery address you chose, and the status history of the request. Nothing here is a purchase: the items are goods the organization supplies free of charge, no payment is taken and no price is charged to you. The request is visible to the colleagues who fulfill and approve it, together with your name and email address, and the internal cost of the goods is attributed to a department for the organization's own budgeting. The organization is the controller of this, and its legal basis is its legitimate interest in running a supply and fulfillment process for its members.

Activity totals for points and leaderboards. If you take part in the wellness, volunteering and recognition features, we count what you have done across the app, for example how many volunteer hours you have logged, posts and comments you have made, kudos you have sent, polls you have voted in and requests you have placed. These counts drive your points balance, your level and the achievements you unlock, and where you have joined a leaderboard your name and score are visible to other participants. This is not used to evaluate your performance at work. The organization running the program is the controller of it, and its legal basis is its legitimate interest in running the program, together with your choice to take part.

Device information for notifications. A push notification token that identifies your device to Apple's or Google's notification service, plus the device name and platform, so that alerts reach you and so you can see which of your devices is counting your steps. When your phone registers for notifications we also record which version of the app it runs: the version and build number, the runtime version, the identifier of the update it has installed, and its release channel. This is linked to your account and is used to support the app, so that we can tell which version you have when something goes wrong and whether an update has reached your device. You can see it in your list of devices, and administrators can see it beside your devices in the console. It is deleted with the device record. Legal basis: our legitimate interest in a working, supported application.

Diagnostics. If the app crashes or hits an error we collect a technical report through Sentry: the error, a stack trace, the app version, the device model and operating system version. This is used to fix faults. Legal basis: our legitimate interest in a working, secure application.

If you invite someone to your family

When you invite someone to your family by email, we send the invitation to that address and keep only a one-way fingerprint of it, so that the invitation opens only for the person who signs in with that address. The address itself is not kept on the invitation and is not shown to anyone. If you invite one of your connections instead, the invitation is tied to their account and no address is used. An invitation works once and expires after seven days, or sooner if you cancel it.

When someone accepts, they join your family group. The members of a family group see each other's names and photographs, the family's posts, messages, plans and photographs, and the names and photographs of the children the family keeps profiles for. Nothing in a family group appears in a workspace feed, in search, or to anyone outside the family.

Safety alerts

An organization running OneNect can send urgent safety alerts to its members, including alerts that take over the screen and sound an alarm. This is for reaching people quickly when there is an emergency such as severe weather or an incident on a site. An alert is sent to the people assigned to the affected site, and to anyone whose most recent position falls inside the affected area.

The organization decides that an alert is sent, what it says, and which site or area it reaches. It relies on its legitimate interest in protecting health and safety, and in some cases on a vital interest under GDPR Article 6(1)(d). We build and operate the delivery: the geofence, the take-over-screen behavior and the channels an alert travels over are ours. Where an alert reaches you because your most recent position falls inside the affected area, that use of your position is part of that delivery.

Who else handles your data

We use the providers below. Each is bound by contract to handle data only on our instructions. Where an organization is the controller, these are our sub-processors for it, engaged under our agreement with that organization. We publish changes to this list on this page and tell customer organizations before a new provider starts, so that an organization can object.

An organization may also connect services of its own using its own credentials. Those are not on the list above, because we do not choose them, and where an organization has connected one the data goes to the account it holds with that provider. The two most common are an IT service desk, Techottic or ServiceNow, and a store or giving platform the organization already runs. Your organization can tell you which it uses.

When you report an IT problem, the ticket carries your name, email address, site and department to whichever service desk your organization uses, so a technician knows who is affected and can reply to you. Nothing else about you is sent with it.

We do not sell personal data. We do not share it for advertising. We do not use it to train machine learning models.

International transfers

Techno Optics LLC is established in the United States, and OneNect and its data are operated from there. Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, together with encryption in transit and at rest. Where an organization is the controller, the clauses that apply are the ones in our agreement with that organization.

OneNect's data and its backups are held today in the platform's own cloud in the United States: the database, file storage and backups with Supabase, and the application with Fly.io. An organization cannot choose a different location in the console. Where an organization needs its data held somewhere else, that is arranged with the OneNect team, and until it is, the data stays where this section says.

How long we keep it

• Account and profile data: while your account is active, then removed within 90 days of it being closed, unless we must keep it longer by law.
• Step totals: daily totals are kept for the current and previous calendar year, then deleted. This applies to imported days as well, and it is also the limit on how far back we will read: we do not import days we would have to delete on arrival. Both are additionally deleted as soon as you withdraw the consent they were collected under, whenever that is: turning step counting off in a workspace deletes the days held for that workspace, and turning the history import off deletes the days imported there. Days held for another workspace where you still allow step counting are kept until you turn it off there too. Turning off the reading of today's total from your health record is the one exception: it stops the reading at once but keeps the days already recorded, because each is a single merged figure the motion sensor contributed to as well and those days are still held under your step counting consent. Turning step counting off deletes them.
• Location: only your most recent position is kept, and it is overwritten each time it updates.
• Content you create: until you delete it or your account is closed. This includes prayer requests and service notes.
• Ingredient check history: until you delete it, delete your account, or the organization's workspace is closed and purged.
• Personal budgets: until you delete them, or until your last OneNect account is closed. If the workspace a budget is kept in closes, the budget moves to another of your own workspaces rather than being deleted with it.
• Shipping addresses: until you delete the address or your account is closed.
• Promotional item requests and their status history: 7 years, because the internal cost of the goods is attributed to a department and belongs in the organization's accounting record.
• Activity totals for points and leaderboards: while your account is active.
• Diagnostic reports: 90 days.
• Safety alert delivery records: 3 years, because we may need to show who was notified during an incident.

Your rights

Depending on where you live you may have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent at any time.

If you are in the EEA, the UK or Switzerland these rights come from GDPR or UK GDPR. If you are in Brazil they come from the LGPD. If you are in California they come from the CCPA as amended by the CPRA, and we confirm that we have not sold or shared personal information in the preceding twelve months.

To exercise these rights over the data we control, write to contact@technooptics.com. We answer within one month, and tell you if we need longer, which the law allows in limited cases. If you are in California we answer within 45 days.

For data your organization controls, ask your organization. If you write to us we will identify the right contact and pass your request on within five working days.

If you are in the EEA, the UK or Switzerland you also have the right to complain to your local supervisory authority.

Children

OneNect is not directed at children under 13, and a child under 13 cannot hold a OneNect account. We do not knowingly collect data from a child under 13 through an account of their own.

A parent or guardian may keep a profile of their own child in OneNect Personal or OneNect Estate: a name, a photograph, a birthday, routines, who to call and, if the parent chooses, care information such as allergies. That profile is the parent's record about their child. The child does not sign in and has no credentials. The profile is seen by the parent, by the members of the parent's family group (who see the child's name, photograph and relation only), in an Estate by the household's staff as the household decides, and by a carer only when the parent hands them a carer card. The parent can change or delete it at any time.

We decide whether somebody is 13 or over from the birthday the person inviting them has entered. Someone aged 13 or over may be invited to join a family with an account of their own. From then on their profile in that family is theirs to edit, and the person who invited them can no longer change it. When they accept, the allergies, dietary needs and conditions the parent kept on that profile are moved into their own health settings, for them to keep or delete, and any sealed medical note the parent wrote is deleted. Anyone in a family group may leave it at any time, and their profile in that family is deleted when they do.

Anyone taking part in volunteering or wellness activities through an organization running OneNect should be 13 or older, or should use the app with a parent or guardian.

Security

Data is encrypted in transit using HTTPS and at rest by our storage providers. Access to production data is limited to staff who need it. Sensitive values are encrypted with a dedicated key. We keep an audit trail of administrative actions.

Changes

If we change this policy we will update the date at the top and, where the change is significant, tell you in the app.

Contact

Techno Optics LLC, trading as OneNect

contact@technooptics.com

EEA availability and representative. Techno Optics LLC has no establishment in the European Economic Area. Pending appointment of a representative under GDPR Article 27, OneNect is NOT offered in EEA territories, and the app is withheld from those App Store and Google Play regions. Article 3(2) turns on offering a service to people in the Union, so withholding it is a lawful alternative to appointing a representative. If we later offer OneNect in the EEA, we will designate a representative under Article 27 and name them here before doing so. An organization running OneNect from outside the Union has to make the same assessment for itself, for the data it controls.