What we collect, and what we don't

When you use OnceTool, we collect the following in the contexts described:

• The video IDs you hover — to query YouTube Data API v3, enforce the daily free quota, and cache results. We do not know or store the title, content, or channel of those videos.
• Device token (UUID) — a random ID stored in extension storage and on our backend, used solely to identify "the same machine" for free-quota limiting. Not an identity.
• IP address — combined with the device token for dual-bucket rate limiting to prevent abuse. Deleted after 7 days.
• Logged-in user data (OnceAccount SSO) — email, display name, avatar URL. We only have these if you choose to sign in.
• Payment data (via PayPal) — we never touch your card; PayPal handles payment and returns only the success status and order ID to us.
• Page-view logs — which tool.oncehit.net pages you open, how long you stay, where you scroll and click. Used to find UX problems. Not used to track you across other sites.

• Which YouTube videos you watch (unless you actively hover and trigger our badge)
• Your Google account, YouTube subscriptions, or comment history
• Other tabs in your browser, your cookies, your bookmarks
• Passwords (handled by OnceAccount), credit card data (handled by PayPal)

To run the service, OnceTool communicates with these third parties:

• Google YouTube Data API v3 — we use the official API to fetch video like counts. Calls go out as the OnceTool service account; your Google identity is not forwarded.
• OnceAccount (family SSO) — handles login and password reset. The OnceAccount privacy policy also applies.
• PayPal — handles card processing and payments. Your card details never pass through our servers.
• Mailgun or equivalent — used to send license keys, password resets, and purchase confirmations.

We do not use Google Analytics, Facebook Pixel, TikTok Pixel, or any other ad tracker.

• once_locale — remembers your language choice (1 year). Not a tracking cookie.
• token (localStorage, not a cookie) — JWT for logged-in users. Cleared on sign-out.

That's it. No third-party cookies. No ad cookies.

• Hover logs: auto-deleted after 90 days
• Page-view logs: auto-deleted after 180 days
• IP rate-limit records: auto-deleted after 7 days
• Purchase records: kept for 5 years per tax-law requirements (accounting, not marketing)
• Account data: when you delete your OnceAccount, your OnceTool data is removed within 30 days. The grace period gives you a window to recover if you deleted by accident.

You can at any time:

• View or edit your personal data via OnceAccount settings
• Email [email protected] to request a full export of your data
• Email us to request complete deletion of your account and all associated data
• Ask any privacy-related question (replies within 7 business days)

OnceTool is not intended for users under 13. We do not knowingly collect personal data from children. If you discover that we have inadvertently collected such data, please contact us and we will delete it immediately.

If this policy changes, we update the "Last updated" date on this page. Material changes (such as new collection categories) will also be emailed to users with accounts. Continued use of OnceTool means you accept the updated policy.

For any privacy-related question, email [email protected]. We reply within 7 business days.