Privacy

Last updated October 30, 2026

OnConsent sits between your AI apps and your services. You decide, for each action, whether an AI app may do it, must ask you first, or may never do it. This page says what we keep to do that.

What we keep

• Your account. The name you choose, your passkey and device public keys, and the settings you pick. We never see your passkey or your device's private key.
• Your rules. Which services you added and the Allow, Ask or Never setting for each action.
• A record of activity. What an AI app asked for, which service it was for, what you decided and when. The record is chained so changes to it can be detected.
• Requests waiting for you. When an action needs your approval, we hold the request and, after you approve, its result, encrypted, so the AI app can collect it. We do not copy your calendar, email or files into OnConsent in bulk. We only handle what an AI app asks for.
• Sign-in tokens for your services. When you connect a service, the service gives us a token. We store it encrypted and use it only to carry out actions you allow. We never see your password for that service.

What we do not do

• We do not sell your data or share it for advertising.
• We do not use your data to train AI models.
• We do not let people at OnConsent read your held requests or results as part of normal operation.

Google data

If you connect a Google service (Calendar, Gmail, Drive, Docs, Sheets, Slides, Contacts, Tasks, Forms or Meet), OnConsent asks Google only for the permissions that service needs. We use Google data only to carry out the actions you or your AI app request through OnConsent, and to show you what happened. We do not use it for advertising, we do not sell it, and no one reads it except where you ask us to for support, where the law requires it, or for security.

OnConsent's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect any Google service in OnConsent at any time. That deletes the stored token and tells Google to withdraw the permission. You can also remove OnConsent at myaccount.google.com/permissions.

Where it lives and how it is protected

Data is stored on Cloudflare's infrastructure. Held requests, results and tokens are encrypted with a separate key for each person before they are stored. Approvals are signed on your device, so a request cannot be approved without it.

How long we keep it

We keep your account, rules and activity record while your account exists. Removing a service deletes its stored token. You can ask us to delete your account and everything we hold about you by writing to the address below, and we will do it.

Contact

Questions or deletion requests: hello@onconsent.com.