OOne More Thing

Privacy

The short version: the file you download keeps everything on your device and talks to nobody. The web version does the same until you choose to sign in — then one copy of that planner is kept on our server so your devices agree with each other.

Last updated 18 October 2026 · One More Thing (OneMoreThing35), Türkiye · the person responsible for this site is its owner, reachable through a message in the shop you bought from (Etsy · Gumroad).

1. The file you download

• Your planner is saved inside your browser on that device (local storage and, for attachments, IndexedDB). It is never sent anywhere.
• There is no account, no analytics, no tracking pixel, no advertising code and no third-party request. You can open the file with your network turned off and everything works.
• If you switch on the optional weather pill, and only then, your browser asks Open-Meteo for the forecast of the place you typed. That request carries the place and nothing of yours. Leave it off and no request is made.
• The automatic backup file on Chrome and Edge writes to the folder you pick on your own computer. We never see it.
• Clearing your browser data deletes your planner, the same as for any site. Export a backup now and then.

2. The web version at onemorethingapp.com

• Opening it without signing in works like the downloaded file: the data stays in that browser.
• When you create an account we store your email address, a scrambled form of your password (scrypt with a random salt — the password itself is never stored and cannot be read back), the date you joined, and the times and approximate device names of your sessions.
• Signing in inside the app stores one copy of that planner on our server, plus the last five earlier versions so a bad sync can be undone. We do not read it, mine it, or show it to anyone. Up to 8 MB per planner.
• The session is a single cookie (omt_session), HttpOnly, SameSite=Lax, 30 days. It exists to keep you signed in. There are no other cookies and no third-party cookies.
• The web version installs a service worker so the app also opens with no connection. It caches the app itself, not your data.
• Our server keeps ordinary request logs (address, time, path) for a short while to find faults and to stop abuse.

3. Your order

• You buy through Etsy or Gumroad. That shop handles the payment: we never see your card, and what the shop knows about you is covered by the shop's own privacy policy.
• We receive the order number, the name shown on the order, the edition you bought and the amount, so we can hand you your planner, honour a refund and keep our books.
• Those order records are kept as long as the bookkeeping rules require.
• A new order sends a message to the shop owner's own phone over Telegram with the order number, the first name on it and the edition — this is how a one-person shop notices your order at all.
• Opening the web link on your order sheet once links that order number to your account, which is what tells our server you may use the web version. A download never uses up the number.

4. Who else is involved

• Etsy or Gumroad — the shop and the payment.
• Our hosting provider — a single rented Windows server that runs onemorethingapp.com. Nobody else processes your planner.
• Telegram — carries the owner's own order notifications described above.
• Open-Meteo — only if you turn on the weather pill.
• That is the whole list. No analytics service, no advertising network, no AI training, and nothing of yours is sold or shared for anyone else's purposes, ever.

5. Why we are allowed to hold it

Account and planner data: to give you the service you asked for (performance of our contract with you) and, for the optional web copy, your own choice to sign in — you can withdraw it by deleting the account. Order records: our contract and our legal bookkeeping duty. Logs and rate limits: our legitimate interest in keeping the service standing.

6. What you can do about it

• See it. Your account lists what we hold for you.
• Take it. Download a copy of each stored planner from the same page, or export a backup from Settings inside the app. It is plain JSON and it loads back into either copy.
• Delete it. One button on your account deletes the account, the stored planners and their earlier versions. It is immediate and we keep no shadow copy. The data in your own browser, and the file you downloaded, are yours and stay untouched.
• Correct it, object, or complain. Write to us through a message in the shop you bought from (Etsy · Gumroad). Under GDPR and the Turkish KVKK you may also complain to your own supervisory authority.

7. Keeping it safe

Passwords are hashed with scrypt and a per-account salt and compared in constant time; the session cookie cannot be read by scripts; sign-in attempts are rate limited; the site is served over HTTPS only. A one-person shop cannot promise perfection, so we keep as little as possible — that is the real protection here.

8. Children

These planners are made for adults. We do not knowingly keep accounts for children under 16.

9. Changes

If this page changes in a way that matters, the date above changes and the account page says so. The promise at the top — the downloaded file talks to nobody, and nothing else is kept unless you ask for it — is not something we intend to walk back.