privacy
How Once handles local app data, optional private iCloud sync, photos, messages, and AI photo cleanup.
Once is designed around local-first use with optional private iCloud sync and optional AI photo cleanup. This page explains what the current app handles and where data can leave your device.
Once may store your display name, stable Once ID, profile photo, giveaway cards, archived listings, coarse listing suburb/postcode and filtering coordinates, item categories, item descriptions, item photos saved with listings or inventory, Things Wallet records, Hint items, conversations, blocked conversation state, challenge progress, activity totals, currency preference, onboarding state, and iCloud sync preference.
This data is stored locally on your device. Once also keeps a local encoded snapshot so your app state can recover after restarts.
iCloud sync is optional and can be turned on or off in Settings. When enabled, Once may save a snapshot of your app data to your private iCloud CloudKit database using the iCloud container configured for Once.
The synced snapshot can include profile details, giveaway cards, archived listings, coarse listing suburb/postcode and filtering coordinates, inventory, Hint items, conversations, challenge progress, profile photo data, saved item-photo data, and activity totals. Apple provides the iCloud infrastructure and associates that private storage with your Apple ID. Once does not receive your Apple ID password.
If you use Magic Camera, Once sends the selected photo, item name, category, style choice, and prompt instructions to the configured AI image endpoint. In the current implementation, that endpoint may be a configured proxy or OpenAI's image editing API.
The AI provider may process the image and prompt to create the edited result. Only use this feature with photos you are comfortable sending to the configured provider, and avoid including sensitive personal information, faces, addresses, documents, or private background details in item photos.
Camera or photo-library access is used only when you choose to capture or select a photo. Captured and selected photos are used to support your profile, listing, Things Wallet, and Magic Camera flows.
Once cannot protect copies after you export, screenshot, share, send, or otherwise move photos or item details outside the app.
Conversations, unread state, archived state, blocked state, and messages are part of the app snapshot. They may be local-only when iCloud sync is off, or included in your private iCloud snapshot when iCloud sync is on.
Keep pickup details inside Once where possible. If you move conversations to phone, email, social apps, or other channels, those services control their own privacy and retention.
Once does not sell your personal data. This app does not currently include payment processing, delivery tracking, escrow, or identity verification.
Device-level backups, iCloud backups outside Once's own CloudKit snapshot, screenshots, shared files, and recipient copies are controlled by you, Apple, or the services you choose to use.
You can change your display name, change or remove your profile photo, turn iCloud sync on or off, avoid Magic Camera, decline camera and photo-library access, delete item records, archive conversations, restart onboarding, or delete the app from your device.
Deleting the app can remove local data from the device. Data already synced to iCloud or included in device backups may remain until managed through Apple settings or backup controls.
Once is not intended for children under 13. If you believe a child has used Once in a way that creates privacy or safety concerns, contact help@once.gives.
This privacy page may be updated as Once changes. Material changes will be reflected by updating the date above.
For privacy questions or support, contact help@once.gives.