Privacy Policy

1. Information We Collect

We collect information you provide directly: account details (name, email), monitor configurations (URLs, selectors), payment information (processed by our payment providers, Dodo Payments, Stripe and Apple), and usage data. We also automatically collect server logs, IP addresses, browser type, and usage analytics.

If you choose Google sign-in, we receive your Google account identifier, verified email address, name, and profile picture. We use this information to authenticate you, connect Google to your existing OnChange account when the email matches, and display your profile. Google sign-in requests only basic profile and email information; it does not grant OnChange access to your Gmail messages, Drive files, or contacts.

2. How We Use Your Information

Your data is used to: operate the monitoring service, send change notifications, process payments, improve our product, provide customer support, and comply with legal obligations. We do not sell personal data to third parties.

3. Data Storage & Security

Monitor data (page snapshots, screenshots, diffs) is stored in S3-compatible object storage. Sensitive credential fields, such as monitor authentication headers and integration secrets, are encrypted at the application layer before storage. Database connections use TLS. Passwords are hashed with industry-standard algorithms. API keys are stored as hashed tokens. We retain change history for 90 days on all plans.

4. Third-Party Services

We use: Dodo Payments, Stripe and Apple for billing, Anthropic Claude API for AI change summaries (diff text is sent for analysis), SMTP providers for email notifications, Playwright for page rendering, and Ahrefs Web Analytics for website traffic measurement. Each provider has their own privacy policy.

Google provides optional account authentication. When you use Google sign-in, Google processes the sign-in request under its Privacy Policy. We do not store Google access or refresh tokens for ongoing access to Google services.

5. Your Rights

You may: access, correct, or delete your account data at any time; export your monitor configurations and change history; request complete account deletion; and opt out of non-essential communications. Contact us at contact@onchange.app.

You can revoke Google sign-in access in your Google Account connections. Revoking access does not delete your OnChange account or its monitoring data. To request deletion of your account and linked Google identity, contact contact@onchange.app.

6. Cookies and public-site measurement

We use essential cookies for authentication sessions and preferences (theme, locale). We do not use tracking cookies or third-party advertising cookies. Analytics are privacy-respecting and cookieless.

Ahrefs Web Analytics separately measures website traffic and interactions. Ahrefs collects page URLs (including query parameters), referrers, browser and device information, approximate location, language and screen size. It uses no cookies and discards raw IP addresses after processing. A daily identifier counts visitors without tracking them across days. See Ahrefs' data collection details and Privacy Policy.

Our first-party public-site measurement counts page views, evidence-download clicks, signup-link clicks and demonstration starts. It stores only catalogued public paths, broad source categories and known campaign labels. Its analytics tables do not store IP addresses, full referrer URLs, query strings, user agents, cookies or visitor identifiers. Counts are events, not unique visitors. These first-party browser observations respect Do Not Track, Global Privacy Control and the preference below. This preference controls our first-party measurement, not the separate Ahrefs script.

We also count new accounts and their first successful monitor check on the server. An account may retain its bounded acquisition categories for up to 90 days before daily cleanup; minimal milestone state remains until account deletion to prevent duplicate counts. Daily aggregates are kept for 400 days before daily cleanup. Essential service and security logs are separate. We do not send these analytics events to a third-party analytics service.

7. GDPR Compliance

For EU users: our legal basis for processing is contract performance (monitoring service) and legitimate interest (product improvement). You have the right to data portability, erasure, and to lodge complaints with your local DPA. Our data processing adheres to GDPR Article 6 and 9 requirements.

8. Changes to This Policy

We may update this policy periodically. Significant changes will be communicated via email and in-app notification at least 30 days before taking effect.

9. iPhone App, Notifications & Saved Content

The OnChange iPhone app uses your existing account, workspace permissions, captured website content and review decisions. Sign in with Apple provides an account identifier and, when you choose to share them, your name and email or Apple private relay address. Provider credentials used for account revocation are encrypted on our server. App access and refresh credentials are stored in the iPhone Keychain and are not shared with widgets.

When you enable notifications, we store an installation identifier, encrypted Apple push token, device label, app and operating-system versions, permission status and notification preferences. Apple processes notification delivery. Generic alerts are the default. Optional previews may include a monitored page name, a short change summary and a temporary image link. You control previews, quiet hours, monitored pages and alerts in app settings, and notification permission in iPhone Settings.

We retain notification delivery results and observed notification opens and actions for up to 30 days to diagnose delivery and avoid duplicate actions. Apple accepting a notification does not establish that it appeared on your screen. Essential request logs and aggregate operation counts help us secure and operate the service. The native app does not include advertising trackers or the public website's analytics script.

For offline reading, the app keeps a protected local cache limited to 50 records, 100 MiB and seven days. Signing out, changing account or workspace, or detecting lost access clears saved content. You can also clear it in Settings. Widgets receive only counts, general monitoring status and the last update time, with no account credentials, page titles or screenshots.

Apple Subscriptions

Apple processes subscriptions purchased in the iPhone app. We receive Apple transaction and subscription identifiers, product, purchase and expiry dates, renewal and refund status, and a random token linking the purchase to your OnChange account. We verify this information with Apple and retain the subscription history while your account exists to provide access, restore purchases and resolve billing problems. We do not receive your payment card details or use purchase history for advertising.

Apple subscription notifications are deduplicated using a notification identifier and processing time, kept for up to 90 days. Purchase history is removed during account deletion. Cancel an Apple subscription in your Apple Account subscription settings to stop future renewal. Deleting your OnChange account does not cancel Apple billing. Apple retains its own transaction records under its policies.

10. Account Deletion

Request deletion from the iPhone app's Settings or the website's account deletion page. Recent sign-in and explicit confirmation are required. We explain any workspaces you own before you proceed. Access ends immediately; recurring web subscription cancellation, identity-provider revocation and data removal continue as a tracked background process. Provider outages can delay completion, and the progress screen reports that honestly.

Eligible personal records and captured objects are removed; shared work belonging to another team is preserved for that team. A private deletion receipt is available for 30 days after completion. Minimal keyed hashes of billing identifiers are kept for 365 days to stop delayed payment events from recreating a deleted account. Payment providers may separately retain transaction records under their own policies and legal obligations. Contact contact@onchange.app if you need help with a pending request.

Contact

For privacy inquiries: contact@onchange.app