Legal
Privacy Policy
OneStepTwo ("we," "us," "our") provides a family potty-training tracking app. This policy explains what information we collect, why, and what rights you and your family have over it.
Who We Are
OneStepTwo can be reached at onesteptwoapp@gmail.com. This policy applies to the OneStepTwo mobile apps and this website.
What We Collect
About your child: a nickname and birth month and year only. We do not collect your child's legal name, full date of birth, gender, photo, or any biometric or health/medical data.
About you and other caregivers: your email address, collected and stored by Clerk, our authentication provider, not by us directly. We only store a reference ID linking your account to your family's data. We do not collect your name or phone number.
Activity data: potty-training events you or other caregivers log (time, type, and any notes you add), your family's invite and role information (e.g. who is a Guardian vs. a Caregiver), and notification preferences.
Consent records: when a parent or guardian creates a child's profile, we record that consent was given, when, and by whom.
Device information: if you enable notifications, we store a device token so we can send them, along with your device's platform (iOS/Android).
If you join our waitlist: just your email address.
Children's Privacy
OneStepTwo is designed for parents and guardians to track their children's potty-training progress — it is not directed at children to use themselves. Before any child profile is created, the parent or guardian must confirm, via a checkbox, that they are the child's parent or legal guardian and are 18 years of age or older.
We collect the absolute minimum information necessary about a child: a nickname and birth month/year. As a parent or guardian, you can review what we hold about your child, refuse further collection, or delete your child's profile — and everything tied to it — at any time from within the app. This approach is designed to meet COPPA (the US Children's Online Privacy Protection Act) requirements for services directed at children under 13.
Why We Process This Information
- To provide the core tracking and milestone features you signed up for.
- Because you (or your child's parent/guardian) consented to it.
- To send you notifications you've opted into.
- Where legally required, to keep a record that consent was given and that erasure requests were honored.
Your Rights
Depending on where you live, you may have rights to:
- Access the information we hold about you and your child.
- Correct inaccurate information.
- Request that we delete your information ("right to erasure").
- Object to certain processing, or withdraw consent at any time.
- Receive a copy of your data in a portable format — we're building a self-serve export tool; until it ships, you can request this by emailing us.
- Lodge a complaint with your local data protection authority.
These rights apply under the GDPR (EU/UK), PIPEDA (Canada), and POPIA (South Africa), among other laws, depending on where you live.
Where Your Data Is Stored
Our servers are currently located in the United States. If you're in the EU, UK, or elsewhere outside the US, your information is transferred to and processed in the US. We rely on standard contractual safeguards for these transfers, and our data-processing partners (like Clerk) maintain their own independent compliance with international data protection laws (Clerk is SOC 2 Type II certified).
How Long We Keep Your Data
We keep your family's activity data until you delete it or close your account — there's no automatic expiration. When your family "graduates" from potty training, we make it easy to delete your account and everything tied to it, permanently. Records that prove we honored a deletion request are kept for 90 days for our own accountability, then removed the next time we process a deletion request.
If you sign up for our waitlist and later want your email removed, please contact us — right now that's a manual process on our end rather than an automatic unsubscribe button, and we're working on making that self-serve.
Security & No Selling
We do not sell your data, and we do not show ads. Authentication data (your name, email, login credentials) is handled by Clerk, an independent, SOC 2 Type II certified provider. We take reasonable technical and organizational measures to protect the data we do hold.
Changes to This Policy
If we make material changes to this policy, we'll update the date above and let you know through the app or by email.
Contact Us
Questions about this policy or your data? Email us at onesteptwoapp@gmail.com.