Legal
Privacy Policy
OneStepTwo helps parents and guardians track potty-training routines. This policy explains what information the app and website process, why, where it may be processed, and the choices available to your family.
Who Is Responsible for This Service
Brandon Hogan operates OneStepTwo and is the contact for questions about this policy or personal information. Contact: onesteptwoapp@gmail.com. This policy applies to the OneStepTwo mobile apps and website.
What We Process
Child and family information: a child's nickname, approximate birth date (birth month and year), and family name. We do not ask for a child's full date of birth, legal name, photo, gender, or biometric information.
Health-related routine data and content: potty-training events you or other caregivers log, including their time, type, and optional notes. We also process Sleep and Break availability intervals when those features are used. If you use the Sick and health log features, we also store sick periods (when your child was marked unwell and for how long), temperatures you enter, and symptoms you pick or describe. These records can describe bathroom habits, routines, sleep, or illness, so we describe them as health-related data in our App Store privacy disclosures. They are visible to the members of your family and are deleted when you delete the child profile or your account. Temperatures, symptoms, and notes are never sent to analytics. Notes are optional and may contain other content you choose to enter.
Parent, guardian, and caregiver information: email address, Clerk account and organization identifiers, family membership and role information, invitations, and the family name. If you sign in with Google, your account can also hold the first and last name from your Google Account. Clerk processes sign-in credentials and account identity information, including for Google or Apple sign-in where available, as described below. We use account and family identifiers to control access to the right family's records.
Members of a family can see each other's name (where the account has one), email address, and role in the app's family settings. When you invite someone, we send the email address you enter to Clerk, which emails them the invitation.
Consent and preferences: a record that a parent or guardian confirmed the child-profile consent, including when it was given and, for signed-in profiles, the account identifier that gave it. In guest mode, the local consent record uses a guest marker rather than an account identifier. We also process notification and reminder preferences and related settings.
Device, notification, and diagnostic information: Firebase Cloud Messaging is initialized when the app launches, on both iOS and Android. It and its provider may process device and app information and messaging-registration metadata even before you allow notification alerts. For eligible guardians, the app requests alert permission and registers for remote notifications even if permission is declined, so a token can remain available if alerts are enabled later. When the app sends a token to our backend, we store the Firebase registration token and device platform, linked to your account identifier. We use it for visible alerts and silent synchronization of availability and Sick status changes; a silent synchronization message does not itself display an alert.
A visible alert can include a child's nickname, the first name of the family member who logged an entry, and the kind of entry (for example, that a pee was logged, or that a child is sleeping). When Sick is started, a visible alert identifying the child as unwell is sent to the family's administrators and guardians who have Family updates turned on; it does not include temperatures or symptoms. These alerts are delivered through Firebase Cloud Messaging and, on iPhone, Apple's push notification service, and can appear on the recipient's lock screen depending on their device settings.
We also use Sentry for crash reports, error reports, diagnostic breadcrumbs, and app or device context used to investigate reliability issues, and on our backend for server errors and request-timing traces. Sentry events can be associated with the Clerk user identifier after sign-in. The apps do not send your IP address with these reports. Our backend's request logs record the request path, result, timing, and the account and family identifiers involved. Provider and SDK configuration can affect the diagnostic and performance information processed.
Subscription records: if a family purchases a subscription, we receive and retain the store information needed to verify and maintain the family's entitlement, such as the store platform, product, subscription status, expiry, and the store's purchase identifier. On iPhone, purchases use Apple's StoreKit: we verify the signed transaction Apple provides and receive Apple's App Store Server Notifications about renewals, expiry, and refunds. On Android, purchases use Google Play Billing: the app sends the Google Play purchase token to our backend, we check it with Google Play's developer API, and we receive Google Play's notifications about subscription changes and refunded or voided purchases. Apple and Google handle payment-card and billing details; we do not receive them.
Waitlist information: if you join the waitlist, we store your email address, selected iOS/Android interest, signup timestamp, and an opaque referral code. If you use a referral code, we record the relationship between your signup and the referring waitlist signup. We keep the request IP address in process memory for rate limiting until the service process restarts; it is not stored in the waitlist database.
Website Cookies and Browser Storage
Our public website does not use advertising cookies. The website no longer collects waitlist signups or stores new referral codes. Requests to our website and to the app's backend pass through Cloudflare, which protects them from automated abuse and may set a strictly necessary security cookie for that purpose. Cloudflare and our hosting provider, Railway, process standard request information such as IP address and browser details to deliver and protect the service.
Our free printables pages and the printables offer page send anonymous usage events to PostHog, and when you scan a QR code printed on one of our printables, our server records the scan there too, so we can see which printables are useful and where visitors came from: that a page was viewed, that a printable was downloaded, that a printed QR code was scanned (and whether it led to the App Store, Google Play, or our website), that an app-store button was tapped, and the campaign tags in the link you followed, such as where a shared link or printed code came from. Each event carries a random identifier that lasts only while the page is open. These pages set no cookies and store nothing in your browser for this, record no sessions, create no profile, and send nothing about you or your child. PostHog is asked not to derive a location from your connection, and the IP address itself is discarded rather than stored. PostHog processes these events for us in the United States and keeps them for up to one year under our current plan. Because nothing in these events identifies you, there is no separate opt-out, but these pages send nothing if your browser sends a Global Privacy Control or Do Not Track signal. The rest of our website, including the guides, sends no analytics.
Older tab sessions may still contain a referral code or referral-consent choice saved by a previous version of the site. These session-storage entries normally disappear when the tab is closed; your browser's session-restore features may retain them. You can remove them by clearing site data in your browser. Contact us about deleting information already submitted.
Guest Mode and Children's Privacy
OneStepTwo is for parents and guardians, not for children to use by themselves. Before a child profile is created, the app asks the parent or guardian to confirm by checkbox that they are the child's parent or legal guardian and are 18 years of age or older.
In guest mode, the child's profile, consent record, potty events, and related app data are stored locally on the device before an account is created. The local consent record is marked as a guest record rather than linked to a Clerk account. That local data is not backed up to our backend until the guest creates an account and the app successfully migrates the local child, consent record, and activity data to the new family. Uninstalling the app can remove guest-only data. Usage analytics and crash reports, described in this policy, also apply in guest mode; neither is designed to include the child's profile or entries.
Guest users can choose Delete all local data in Settings to erase the local guest records. This does not erase records already migrated to an account, which use the account deletion options below. We do not claim that the checkbox process alone satisfies every parental-consent requirement in every jurisdiction.
Signing In with Google or Apple
Where available in the app, you can choose to create or sign in to your OneStepTwo account with your Google Account or with Sign in with Apple instead of an email address and password: on iOS, with Sign in with Apple or Sign in with Google; on Android, with Sign in with Google. Email and password sign-in remains available on both platforms. Clerk, our authentication provider, handles these sign-ins for us. OneStepTwo's servers never receive your Google or Apple password, sign-in tokens, or authorization codes; our backend identifies your account only by the account identifier Clerk assigns.
What we receive. If you choose to sign in with Google, Google shares your email address, your name, and your profile picture with Clerk, using Google's standard sign-in permissions (openid, email, and profile). We do not request access to anything else in your Google Account, such as your contacts, calendar, files, or email messages. If you choose Sign in with Apple, we request your email address only, not your name. Apple lets you hide your real email address; in that case we receive a private relay address ending in @privaterelay.appleid.com that forwards to your inbox, and we treat it as your account's email address. Through Clerk, we receive the email address associated with the sign-in and whether it is verified. Clerk can save the first and last name from a Google sign-in as your account name. OneStepTwo shows that name to the other members of your family in the app's family settings, and uses your first name in the alerts they receive when you log an entry (for example, "Sam logged a pee"). OneStepTwo does not display or use the profile picture from a Google sign-in.
If you sign in with Google or Apple using the same verified email address as an existing OneStepTwo account, Clerk may link the sign-in to that existing account. If you use a Hide My Email address, another relay address, or an email that doesn't match an existing account, Clerk creates a separate account instead. OneStepTwo does not link accounts by name or by matching raw email text on its own.
How we use it. We use information received from Google or Apple sign-in only to sign you in, to identify your OneStepTwo account, and to show your name to the members of your own family as described above. We do not sell it, use it for advertising, use it to train artificial intelligence or machine learning models, or use it to make credit or lending decisions. We do not share it with anyone other than Clerk, which processes it for us to provide sign-in, the members of your family as described above, and the service providers listed below that store or deliver our service's data (including the push-notification services that deliver family alerts), except where the law requires it. OneStepTwo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we store and protect it. Clerk stores your sign-in identity. For account security, Clerk also keeps a record of each signed-in session, including the IP address it came from, the approximate location (city and country) Clerk derives from that IP address, and the device and browser type. This is our authentication provider's security record: the app never requests your device's location, and OneStepTwo does not use this record to locate you or for analytics. Information travels between the app, Clerk, and our servers over encrypted (HTTPS) connections, and access to our backend systems is restricted to the service operator.
How long we keep it and how to remove it. We keep sign-in information while your account exists. Choosing Delete my account in the app's Settings erases your OneStepTwo data as described under Retention, Deletion, and Subscriptions below, and deletes your Clerk account, including the Google or Apple sign-in connection stored there; the app tells you if the Clerk deletion is still finishing. You can also ask us to delete your account by emailing onesteptwoapp@gmail.com; we handle emailed requests by hand, as our account deletion page explains.
Deleting your OneStepTwo account does not remove OneStepTwo from your Google or Apple account's own list of connected apps. To remove that connection yourself: for Apple, open the Settings app on your iPhone, tap your name, tap Sign in with Apple, select OneStepTwo, and tap Delete (or sign in at account.apple.com, open Sign-In & Security, then Sign in with Apple); for Google, open your Google Account's third-party connections page (Security, then "Your connections to third-party apps & services"), select OneStepTwo, and remove the connection. Removing that connection does not by itself delete your OneStepTwo account or data.
When an account is deleted, we keep a minimal deletion record indefinitely: the Clerk account identifier, the identifiers of any families the account administered, and the deletion's status, retry details, and timestamps. It contains none of the family, child, or activity data, which is erased. We keep this record to confirm the deletion completed and to prevent the deleted account's data from being recreated, for example by a retried or delayed request.
Google's and Apple's own privacy policies describe how they process your information when you use their sign-in: Google Privacy Policy and Apple Privacy Policy.
Why We Use This Information
We use information to provide tracking, history, reminders, notifications, family access, milestones, account authentication, subscription access, support, security, and service reliability. We also use diagnostic information to understand how the app operates and to improve reliability.
The legal basis for processing depends on the information and the law that applies where you live. It may include providing the service you request, consent where we ask for it (including the parent or guardian's child-profile confirmation), and legitimate interests in operating a secure and reliable service where that basis is permitted. Some laws may apply additional conditions to health-related or children's information.
Service Providers and International Processing
We use Clerk for authentication and account identity, including handling Google and Apple sign-in where available, as described above, and to send sign-in and invitation emails; Firebase Cloud Messaging (Google) for push messaging, with Apple's push notification service delivering alerts to iPhones; Sentry for crash reporting and diagnostics; PostHog for usage analytics; Apple's App Store (StoreKit) and Google Play Billing for in-app subscriptions; Railway to host the website, application backend, and PostgreSQL database; Cloudflare for DNS and as a network proxy in front of the website and backend; and Discord, where we receive private operational notices such as “trial started · iOS · annual” or “new account · Android · Google”. We also receive an operational notice when onboarding completes on an app installation, including only the platform (iPhone or Android), guest or account path, and server receive time. Those notices carry only the kind of event, the store or platform (iPhone or Android), the plan length, whether it was a trial or test purchase, the guest or account onboarding path, and for a new account how it signed up (Google, Apple, or email): never a name, email address, account or family identifier, or payment detail. To prevent repeat onboarding notices, the app sends a random installation identifier to our backend. We store only its one-way hash, the event kind, platform, onboarding path, and receive time for 90 days. The raw installation identifier is not sent to Discord. This operational notice is separate from Usage analytics and continues when Usage analytics is turned off. We use this operational notice to understand successful onboarding as part of operating the service. These providers process information needed to provide their services under their own terms and privacy practices. We share with each provider only the information it needs to perform its service for us, and we require the providers we share user data with to protect it with the same or equal protection as this policy describes.
Usage Analytics
We collect a small amount of usage data in the mobile apps so we can see which features are used and which are not, how many people use the app, how active they are, and how subscriptions develop over time. When you use the app without an account, this data is not linked to you. When you are signed in, it is linked to your account identifier (the random identifier our sign-in provider, Clerk, assigns), so we can understand how people use the app over time. Signing in also links the usage that app installation recorded earlier, including before you signed in or before you updated to a version that links usage. This is the only purpose it serves. Anonymous events from our printables pages are described under Website Cookies and Browser Storage above.
What we collect: that the app was opened, that a log was created, which tab was viewed, which of a small fixed set of features was used, whether onboarding completed and by which route, that an account was created, that the subscription screen was viewed, and that a purchase completed. Each is recorded against a random identifier generated for the app installation, together with basic technical details the analytics software adds: app version, operating system and version, device type, language, and time zone. While you are signed in, these events are also associated with your account identifier, and our server adds subscription events it receives from the App Store or Google Play about your family's subscription (for example started, renewed, cancelled, a billing problem, recovered, expired, or refunded), with the plan length, the store, and whether it was a trial. The account identifier is the only thing about you that is sent: never your name or email address.
What we never collect for analytics: your name, your email address, your advertising identifier, or anything at all about your child (no nickname, no birth details, no notes, no temperatures or symptoms, and no record of what kind of potty event you logged; we only see that a log was created or that a feature, such as Sick status or a health log, was used). We do not track you across other apps or websites, and we never sell or share this data. Current versions of the app ask PostHog not to derive a location from your connection (earlier versions recorded an approximate country), and the IP address itself is discarded rather than stored. PostHog processes this data for us in the United States and keeps it for up to one year under our current plan.
Turning it off: Settings → Usage analytics. Turning it off stops usage analytics entirely, including the subscription events our server would otherwise add. While you are signed in, your choice is also saved to your account, so it applies when you sign in on another device. Crash reports still send, so we can fix problems that affect you; those are a separate system described above. Deleting your account asks PostHog to delete the analytics data linked to your account identifier (see Retention, Deletion, and Subscriptions below), including earlier usage from an installation you signed in on. Usage from an installation that was never signed in is not linked to anyone, so it can't be found or deleted per person; it is kept for up to one year.
Our current architecture uses U.S. hosting for the backend and database. If you use the service from outside the United States, your information may be transferred to and processed in the United States and in other locations where our providers operate. We do not state in this policy that any particular transfer safeguard, certification, or contract has been executed; provider and legal requirements can vary by transfer and location.
Our App Store privacy details identify Name, Email Address, Health, Other User Content, User ID, Device ID, Purchases, Crash Data, Performance Data, Other Diagnostic Data, and Other Data as linked to the user and used for App Functionality, and Product Interaction (the usage analytics above) as linked to the user and used for Analytics. User ID and Device ID are also used for Analytics. Our Google Play Data safety section describes the same collection in Google's categories. None of this data is used for tracking across other companies' apps or websites, and none is sold.
Retention, Deletion, and Subscriptions
We keep family data while it is needed to provide the service or until the applicable deletion action is completed. A child deletion hard-deletes that child's server-side child record, consent record, potty events, availability sessions, sick periods, health entries (temperatures and symptoms), related notification records, and preferences. The app then attempts corresponding local deletion; if local cleanup is interrupted, the app may require a retry.
A caregiver who leaves one family loses that family's access. The service removes the membership through Clerk first and then makes a best-effort cleanup of that member's family-role and notification/reminder preference records for that family; it does not by itself delete the person's Clerk account, other family memberships, or all device tokens.
Event, availability, sick period, and health entry records retain the account identifiers used to log, create, start, update, or delete them. Availability-notification outbox rows also retain recipient account identifiers so the service can check eligibility and deliver or cancel a scheduled message. These identifiers are used for App Functionality and are not automatically removed merely because a member leaves a family; they remain with the relevant family data until that data is deleted under its applicable retention path.
Deleting an account processes every family the account belongs to. For a family administered by that account, the backend deletes its child data, preferences, device tokens, entitlement record, pending invitations, and family-role records. For other families, the backend removes that account's local family-role and preference records and any pending invitation for that account's own email address in that family. It also deletes the account's device tokens and routine preference. Entries the account logged in a family it does not administer stay with that family, together with the account identifier that logged them, because they are part of that family's records; they are deleted when the family deletes those entries, the child's profile, or the family account. The same deletion removes the account's analytics opt-out record and its link to any family's subscription, and records a request for PostHog to delete the analytics person and events linked to the account identifier; that request is made after the deletion commits and retried automatically. After the backend deletion commits, we request that Clerk delete each organization the account administered and the Clerk user. These requests are retried automatically, and if they still can't complete we are alerted and finish them ourselves. Clerk memberships are removed once those requests succeed.
Pending family invitations retain the invited email address, family identifier, selected role, and creation time until the service later reconciles the person after they join. Account deletion removes them as described above. Otherwise, an unaccepted invitation can remain while the family exists, including when a member is removed from, or leaves, the family before their invitation was reconciled; the app does not currently offer a way to cancel one. Invitations left behind in families that were deleted before September 28, 2026 are removed by a separate manual cleanup. An invitation left for a caregiver who deleted their account before that date, in a family that still exists, can remain while that family exists. We do not publish a fixed retention period for these pending invitation records.
The app keeps a local copy of family records on the device, in a separate local database for each family opened on that device. Signing out, leaving a family, or deleting your account in the app deletes the local records of the family in use at the time. If more than one family has been opened on the device, local copies of the others are not currently removed and can remain until the app is uninstalled. If your device's own backups (such as iCloud or Google backups) are turned on, they can include the app's local data, and restoring a backup can restore it; those backups are controlled by your device settings, not by us.
If your session ends outside the app, for example because it was revoked or expired or because your account was deleted on another device, the next time the app runs on this device it deletes that family's local records, except entries (potty-training events and Sleep or Break records) logged or changed on this device that had not yet been uploaded. Those can be kept on the device, together with the child profile and consent record they belong to, and the app tells you when this happens. If you sign in again with the same account, the kept entries upload. If anyone else signs in to that family on the device first, the kept entries are deleted before that person can use them. Otherwise they are kept for 30 days and deleted the next time the app is opened after that. If the app already knows the account was deleted, because it was deleted on this device or our service reported the deletion to the app, nothing is kept.
Deleting a single potty event or availability session can leave a deletion marker (sometimes called a tombstone) while devices synchronize the deletion. These markers are part of the synchronization process and are distinct from an account or child erasure, which uses hard deletion. We do not publish a fixed retention period for synchronization tombstones, provider-side records, diagnostic data, or operational backups because those periods depend on the provider, configuration, and operational need. Deleting an account does not delete crash and diagnostic events already sent to Sentry, backend request logs kept by our hosting provider, or usage analytics already sent to PostHog; these are kept until the provider's retention period for them ends. Apple and Google keep their own records of purchases made through their stores under their own policies.
We retain a limited erasure-audit record to document child, account, or membership deletion. It becomes eligible for purge after 90 days, but is removed only opportunistically when a later child or account deletion request runs, so it may remain longer than 90 days. The audit record is separate from the family activity data that the deletion flow removes.
Waitlist entries remain until we remove them following a request to onesteptwoapp@gmail.com; this is currently a manual process.
Deleting app data or an account does not cancel a subscription bought through the App Store or Google Play; the store keeps billing the person who bought it until it is cancelled. To stop future charges, cancel it in the store: on iPhone, open Settings, tap your name, tap Subscriptions, select OneStepTwo, and tap Cancel Subscription; on Android, open the Google Play Store app, tap your profile icon, tap Payments & subscriptions, then Subscriptions, select OneStepTwo, and tap Cancel subscription (or visit play.google.com/store/account/subscriptions).
Your Choices and Rights
Depending on where you live, you may have rights to request access, correction, deletion, restriction or objection to some processing, portability, or to complain to a data protection authority. These rights and any exceptions vary by jurisdiction. To make a request or ask about your information, email onesteptwoapp@gmail.com.
You can withdraw consent or stop processing at any time: turn off usage analytics in Settings, turn off notifications in the app or your device settings, delete a child's profile and records, choose Delete my account in Settings (or, in guest mode, Delete all local data), or remove OneStepTwo's Google or Apple sign-in connection as described above. You can also email us to request deletion of your data. Our account deletion page gives the steps, including how to ask for deletion if you no longer have the app or can't sign in.
Security, No Selling, and Changes
We do not sell personal information, show ads, or use the information described here for cross-app or cross-website advertising tracking. We use measures intended to protect the information we hold, but no service can guarantee absolute security.
If we make material changes to this policy, we will update the date above and may notify you through the app or by email.
Contact Us
Questions about this policy or your data? Email onesteptwoapp@gmail.com.