One Percent — Privacy Policy

Effective date: 26 July 2026 Last updated: 26 July 2026

One Percent ("One Percent", "we", "us") provides a mobile and web application that generates short daily learning curricula using artificial intelligence. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

One Percent is operated from Singapore. If you have any question about this policy or how your data is handled, contact us at [email protected].

1. Summary

You can use One Percent without an account. We create an anonymous identifier so your progress persists on your device.
We collect the topics you ask to learn, and we send that text to an AI model provider to generate your curriculum.
We do not sell your personal data, and our AI providers are not permitted to use it to train their models.
You can delete your account and all associated data from inside the app (Settings → Delete account).
We do not run advertising SDKs and we do not track you across other apps.

2. Data we collect

2.1 Data you provide

Data	When	Why
Email address	If you sign up or sign in	Authenticate you, send one-time sign-in codes, recover your account
Name	Optional, during profile setup	Personalise greetings in the app
Gender	Optional, during profile setup	Product analytics and content relevance
Learning topics you type	Whenever you create a curriculum	Generate your curriculum (see §4 — AI processing)
Support messages	If you contact support	Respond to your request

2.2 Data generated by your use

Data	Purpose
Anonymous user identifier	Persist your progress before you create an account
Curricula, lessons and lesson progress	Deliver the core service and resume where you left off
Streaks, completion counts and minutes learned	Show your progress and streak features
Saved topics	Populate your Library
Reminder time, timezone, notification preferences	Send the daily reminders you asked for
Push notification token	Deliver push notifications
Subscription status, plan, renewal date, store identifiers	Provide paid features and restore purchases

2.3 Data collected automatically

Data	Purpose
Product analytics events (e.g. curriculum generated, lesson completed, streak milestone, trial started)	Understand which features work and improve the product
Diagnostic and crash data	Detect, diagnose and fix faults
IP address (transiently)	Security, abuse prevention and rate limiting

We do not collect precise geolocation, contacts, photos, health data, or advertising identifiers.

3. Legal bases (UK/EU GDPR)

Where the UK or EU GDPR applies to you, we rely on the following bases:

Purpose	Legal basis
Providing the service you requested	Performance of a contract (Art. 6(1)(b))
Sending one-time sign-in codes	Performance of a contract (Art. 6(1)(b))
Push notifications and reminders	Consent (Art. 6(1)(a)) — withdrawable in Settings or your OS
Product analytics and service improvement	Legitimate interests (Art. 6(1)(f))
Security, abuse prevention, rate limiting	Legitimate interests (Art. 6(1)(f))
Billing and fraud prevention for paid plans	Performance of a contract / legal obligation
Optional profile fields (name, gender)	Consent (Art. 6(1)(a))

Where we rely on legitimate interests, we have assessed that our interest in operating and improving a functioning product does not override your rights, in part because analytics data is limited to product events rather than content.

4. Artificial intelligence processing

Generating a curriculum requires sending the topic text you enter to a third-party AI model provider, which returns generated lesson content. You should avoid entering sensitive personal information in the topic field.

Your topic text and generated lessons are processed to produce your curriculum.
We may change or use more than one AI model provider over time, for quality, cost, availability or resilience reasons. The providers we currently use are named in §5, and we keep that list current. Where a change materially affects how your data is handled, we will update this policy and notify you as described in §11.
We engage AI providers only under terms that bind them to process your data solely to deliver the service to us, and that **prohibit using your inputs or outputs to train their models**.
AI-generated educational content can contain errors. It is provided for general learning only and is not professional, medical, legal or financial advice.

5. Sub-processors and disclosure

We share personal data only with service providers acting on our instructions. This list is current as of the "Last updated" date and changes as our providers change — in particular, the AI model provider(s) may be substituted or added to.

Sub-processor	Purpose	Data involved
AI model provider(s) — currently Anthropic, PBC	AI curriculum and lesson generation	Topic text you enter
Railway	Application hosting and database	All service data
PostHog	Product analytics	Pseudonymous user id, product events
Sentry	Error and crash monitoring	Diagnostic data, pseudonymous user id
Resend	Transactional email (sign-in codes, support)	Email address, message content
Expo	Push notification delivery	Push token, notification content
RevenueCat	Subscription management	Pseudonymous user id, purchase records
Apple	App distribution and payment processing	Purchase and billing data (held by Apple)
Google / Apple	Optional social sign-in	Identifier and email from the provider

We may also disclose data where required by law, to enforce our terms, or in connection with a merger or acquisition (in which case we will notify you).

We do not sell personal data, and we do not "share" it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA.

6. International transfers

We are based in Singapore and our providers process data in other countries, including the United States and the European Union. Where personal data is transferred out of the UK/EEA we rely on the European Commission's Standard Contractual Clauses or an applicable adequacy decision. Where personal data is transferred out of Singapore, we take reasonable steps to ensure the recipient provides a standard of protection comparable to the PDPA.

7. Retention

Data	Retention
Account and learning data	While your account is active
Anonymous accounts with no activity	Automatically deleted after 30 days of inactivity
Deleted accounts	Soft-deleted immediately, then permanently purged after 30 days
One-time sign-in codes	The code expires within minutes; the record, including the email it was sent to, is deleted within 7 days
AI usage and cost records	Retained for billing and capacity planning, but de-identified when your account is deleted — the record survives with no link to you
Analytics events	Retained no longer than necessary for the purposes in §2.3, in line with our analytics provider's configured retention period
Records required for tax, accounting or legal defence	As required by law

When an account is deleted, deletion cascades through the database: your profile, every curriculum, day and lesson, your saved topics, your notification history, your sign-in sessions and any linked Google/Apple identities are all removed.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict or object to our processing of your personal data, and to withdraw consent at any time.

Delete everything: Settings → Delete account. This soft-deletes immediately and permanently purges within 30 days.
Correct your profile: Settings → your profile.
Turn off notifications: Settings, or your device's OS settings.
Anything else: email [email protected] and we will respond within the period required by applicable law (30 days under GDPR; 45 days under CCPA; as soon as reasonably possible under the PDPA).

We will not discriminate against you for exercising these rights. If you are in the UK/EEA you may lodge a complaint with your supervisory authority. If you are in Singapore you may lodge a complaint with the Personal Data Protection Commission (PDPC).

9. Singapore (PDPA)

If you are in Singapore, we handle your personal data in accordance with the Personal Data Protection Act 2012 ("PDPA"):

We collect, use and disclose personal data only for the purposes set out in this policy, or as permitted or required by law.
You may withdraw consent for any purpose by contacting us, though this may mean we can no longer provide parts of the service.
You may request access to, or correction of, the personal data we hold about you.
We will notify you and the PDPC of a notifiable data breach within the timeframes required by the PDPA.

Our Data Protection Officer can be reached at [email protected].

10. Children

One Percent is not directed to children under 13 (or under 16 where local law sets a higher age), and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact [email protected] and we will delete it.

11. Security

We maintain technical and organisational measures appropriate to the risk, including:

Encryption in transit (TLS) for all client–server and server–provider traffic.
Encryption at rest for the application database.
Passwordless authentication; one-time codes are stored only as hashes, expire quickly, and are limited in attempts.
Session tokens that are short-lived, rotated on refresh, and revocable.
Storage of authentication material on-device in the platform secure store (iOS Keychain / Android Keystore).
Rate limiting and abuse controls on authentication, content generation and support endpoints.
Least-privilege access to production systems, and vendor review before a new sub-processor is introduced.
Centralised error monitoring and audit logging of security-relevant events.

No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify you and the relevant regulator where required by law and within the applicable deadlines.

12. Changes

We will update this policy as the product changes. Material changes will be notified in-app or by email before they take effect, and the "Last updated" date above will always reflect the current version.

13. Contact

One Percent Singapore [email protected]