1. Who We Are
Onca (“Onca,” “we,” “us,” or “our”) is an all-in-one online presence platform that you run through your own AI agent, for a launch or for a business already running. The founder’s own AI client (such as Claude Code or Codex) connects to Onca, which gives it playbooks and simple tools to use the founder’s platforms, and gives the founder a dashboard to see what the client did. For any privacy question, or to ask us to delete your data, contact us at privacy@useonca.com.
2. Data We Keep About You
2.1 Your account
- Sign-up: your email address, and your name if you sign in with Google or Apple (plus your profile picture with Google). If you joined our waitlist earlier (the home page no longer takes sign-ups), your email address.
- Projects and settings: your project names, project profile (one-liner, positioning, audience, pricing, links), launch checklist answers, spend caps, time zone and your Settings choices.
- Content you save: posts you or your AI client schedule (text, links, media, time, status and history) and the images and videos you save to your project’s content library, with the details your AI client records about them (prompt, model, notes, source link and cost).
- Onca credits: a ledger of the credits granted to your account and used by priced actions.
2.2 What your AI client does
When your AI client calls an Onca tool, we log that call: the time, which tool, which project, which AI client, the outcome and how long it took, plus the names of the arguments it sent. We do not log the argument values or the results. You see this log in Settings, under AI client activity.
2.3 Technical data
Our servers receive your IP address and browser type with each request. We use them for security and to limit abuse. We use essential cookies to keep you signed in, and one functional cookie on our home page (see 2.4). We do not use advertising or tracking cookies.
2.4 This website
Our home page at useonca.com tests two versions of itself. To keep one visitor on one version, it sets one first-party functional cookie, onca_ab, with a random visitor id and the version shown. It lasts 90 days and is not shared with anyone. The page sends a few first-party events to our own servers (for example, that the page was viewed, whether the page was interacted with, and how fast it loaded). These events carry the random visitor id, the version, the website you came from and any campaign tags in the link. They do not include your IP address or browser type, and we use no third-party analytics or advertising trackers. The home page no longer has a waitlist form; an email address left there earlier is stored with the version that was shown and the visitor id.
2.5 Brand preview on this website
On our home page you can type a website, a Bluesky handle or a few words to see the demo in that brand. What you type is sent to Onca. Onca then reads that site’s public home page and its public images, and looks the site up in Wikidata, Bluesky’s public API and RDAP (the public domain registry). The public text and images are sent to Google Gemini and TypeSafe, which write the demo’s words and choose its logo, colours and photos. Results are cached for 24 hours by site and are never tied to you: we do not store what you typed with your visitor id, IP address or email. Before a brand is read, Cloudflare Turnstile checks that you are a person, which sends Cloudflare technical data about your browser. The brand’s font may load from Google Fonts.
3. Data From Connected Platforms
You connect each platform yourself, and you can disconnect it at any time on the Connections page. Access tokens are stored on our server. They are never shown to your AI client, the dashboard or our logs. Disconnecting deletes the stored tokens. For Google Ads, Meta Ads and Higgsfield we also ask the platform to revoke access where it supports that, but you should also remove Onca in that platform’s own settings.
What Onca reads and keeps, per platform:
- Facebook Page: the Page you pick (name, ID, category and picture) and its access token. Onca publishes the posts you approve, and reads those posts’ reactions, comments, shares, views, reach and clicks.
- Instagram: the professional account linked to your Page (ID, username, picture) and the Page token. Onca publishes the posts you approve, and reads how they did.
- Threads: your Threads username and picture and an access token. Onca publishes the posts you approve, and reads how they did.
- X: your handle, picture and access and refresh tokens. Onca publishes the posts you approve. It reads a post’s numbers only when you approve that read, because X charges for it.
- Bluesky: your handle, account ID, picture and access tokens. Onca publishes the posts you approve.
- TikTok: your TikTok username, open ID, picture and access tokens. Onca publishes the videos you approve, and reads the views, likes, comments and shares of those videos.
- Reddit: your Reddit username, read from your own browser or typed by you. Onca stores no Reddit token. Posts go out from your own browser: Onca fills in the form and you click Post. If you allow it in the extension, Onca reads the score, comment count and view count of the posts you published, from your browser.
- GitHub: the repository you pick (owner and name, ID and installation ID). Onca stores no GitHub token, and it does not read your code.
- Meta Ads and Google Ads: your ad account IDs, names, currency and time zone, and for each campaign its name, spend, impressions, clicks and conversions per day. Onca stores access tokens to read these numbers and to pass the calls you approve.
- Higgsfield: an access token, and a record of the calls your AI client makes through Onca (tool, a summary of the prompt and model, cost, outcome). Results you save go to your content library.
Onca uses data from a platform only to publish the founder’s own posts, to show the founder how they did, and to run the founder’s own connected services for the founder. We use it for nothing else.
Data from TikTok and Meta (Facebook, Instagram and Threads) is used only to publish your own posts and to show you their results. We do not sell it, use it for advertising, build profiles from it or share it with data brokers.
Onca’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Ads data only to show you your own ad results and to run the Google Ads calls you approve. Onca does not use it to train AI models, does not sell it, and no human at Onca reads it unless you ask us for support or the law requires it. Onca passes it to the AI client you chose, so you can see and use your results; what that client does with it is governed by its own terms.
4. The Onca Browser Extension
The extension lets your AI client see and act on a platform page in your own browser, for example to set up an account. Nothing happens until you press Start, and one session uses one tab.
- Onca never types into a password, one-time code or card field, and never clicks a final button such as Sign up, Post or Pay. Those steps are yours.
- While a session runs, the page’s headings, visible text and the labels of its buttons and fields are sent to your AI client so it can decide the next step. Onca does not store or log values typed into fields.
- The session log keeps one line per step (what was done, never a value). It is deleted after 30 days.
- Screenshots are taken only when your AI client asks and you allowed them. Password and code fields are covered first. Onca passes them to your AI client and keeps no copy.
- The extension acts only on the platform sites a session is about.
5. Onca AI (Optional) and Onca Voice
Onca AI is off by default. If you switch it on in Settings, Onca may send the structure of a stuck Reddit posting page (headings, and the labels of its buttons and fields) and the task description to Google’s Gemini API, to find the next step. It never sends passwords, codes or tokens. Onca’s own code, not the model, types your approved post text and clicks nothing final. Each run is paid for in Onca credits. With the switch off, nothing is sent to Gemini.
Onca voice reads text aloud when your AI client asks for a voice sample or a voiceover you approved. Onca sends that text, the style asked for and the voice picked to Google’s Gemini API (on a paid plan: Google does not use it to improve its products and keeps it only for a limited time to detect abuse) to make the audio. The audio is saved in your Library, and sample audio is kept so a repeat costs nothing. Voiceovers are paid for in Onca credits.
For support and quality checks, Onca keeps a record of each voice sample and voiceover, with a copy of the audio, for 90 days. It is deleted with your account.
6. How We Use Your Information
- To run the Service: show your dashboard, connect your platforms and publish the posts you approve at the time you approved.
- To show you what your AI client did and how your posts and ads did.
- To improve Onca for everyone, using anonymised, combined information that does not identify you or your project.
- To enforce your spend caps and count Onca credits.
- To keep the Service secure and prevent abuse.
- To contact you about your account or the Service.
We do not sell your data, and we do not use it for advertising.
7. Who Else Handles Data
We share data only with the parties needed to run Onca:
- Supabase: our database, sign-in and file storage, in the US East (North Virginia, us-east-1) region.
- Amazon Web Services: the server that runs the Onca backend, in North Virginia, United States (us-east-1).
- Vercel: hosts the Onca website and dashboard.
- Sentry: receives error reports, performance traces, our server’s log lines and, only around an error, a screen recording of the dashboard or the iOS app with every text, input and image masked, so we can fix problems. It stores them in the United States for 30 days. Passwords, tokens, sign-in codes, cookies, your email address and your IP address are removed before anything is sent, and a recording never shows what you type.
- Google (Gemini API): only when you switch on Onca AI, for Onca voice samples and voiceovers, and for the brand preview on our home page, as described above.
- TypeSafe: writes the brand preview’s words and picks its images from a site’s public text and images, as described in 2.5.
- Cloudflare (Turnstile): checks that a person, not a bot, asks for a brand preview on our home page, as described in 2.5.
- The platforms you connect: Facebook, Instagram, Threads, X, Bluesky, TikTok, Reddit, GitHub, Meta Ads, Google Ads and Higgsfield receive what is needed to carry out the posts and calls you approve.
- Your AI client: receives what Onca’s tools return to it, such as your schedule, results and the page views of a browser session. What it does with that is governed by its own terms.
- Legal: we may disclose data when the law requires it or to protect our rights.
8. Storage, Security and Retention
Each user can reach only their own data: access is limited by row-level security and by checks on the user in every request. Platform tokens stay on the server. Everything travels over HTTPS.
- Tool-call log: deleted after 90 days.
- Browser session logs: deleted after 30 days.
- Gateway call records (Meta Ads, Google Ads, Higgsfield): deleted after 90 days.
- Profile images your AI client uploads during a browser session: deleted after 24 hours.
- Sign-in links and one-time codes for connecting AI clients expire within minutes.
- Your project profile, content library items and results numbers stay until you delete them or your account. Scheduled posts, including canceled ones and their history, and the Onca credit ledger stay until your account is deleted.
9. Your Rights and Deletion
You can:
- See your data in the dashboard, and ask us for a copy of what we hold about you.
- Correct your data in Settings, or ask us to.
- Disconnect any platform, AI app or browser at any time on the Connections page. This deletes the stored tokens.
- Delete a content library item, or cancel a scheduled post, yourself. A canceled post and its history are kept until your account is deleted.
- Ask us to delete your account and all of its data. Email privacy@useonca.com with the subject “Delete My Data.” We will delete your account, content and personal data within 30 days. You can also revoke Onca’s access inside each platform’s own settings.
10. Children’s Privacy
Onca is not for children under 13. We do not knowingly collect data from children under 13. If we learn that we did, we will delete it.
11. Changes to This Policy
We may update this policy. We will post the new version here with a new date, and for significant changes we will also tell you on the platform or by email. If you keep using the Service after a change, you accept it.