Privacy policy

Effective date: September 23, 2026
Last updated: November 6, 2026

This Privacy Policy explains how Cure AI, LLC, a Florida limited liability company doing business as OneStar ("Cure AI", "we", "us" or "our"), handles personal information when you use the OneStar website at onestar.sh, the OneStar app, the API at api.onestar.sh, public report pages and our emails (the "Services"). Cure AI is the controller of the personal information described here, except for answers to feedback forms that a product's makers run on OneStar: the makers control those answers and Cure AI processes them for the makers (Section 5). It should be read with our Terms of Service.

1. The short version

• We keep as little personal information as we can: your email address, an optional name, your workspace and what you do in it.
• OneStar reads public store reviews: Steam reviews from Steam's public API, and App Store and Google Play, Google Maps, Tripadvisor and Trustpilot reviews through DataForSEO, a review data service that receives no information about you. Raw review text is never written to disk, only excerpts of at most 200 characters. Reviewer names and other author fields are never read.
• Contact details such as emails, phone numbers, links and order ids are scrubbed from review text before it is sent to any AI model.
• IP addresses are used only as hashes with a salt that changes every day, except in the session list that lets you see where you are signed in.
• Payments are handled by Polar as Merchant of Record. Card numbers never reach us.
• We use only the cookies needed to sign you in and remember your theme. No advertising cookies. Our marketing pages load the Google Ads tag to measure our own ads, with its cookies switched off, and it never loads on sign in, your reports or the app.
• We do not sell or share personal information for targeted advertising.
• You can export your data as JSON and delete your account at any time from Settings.
• If you answer a feedback form that a product's makers run on OneStar, your answer goes to them and we process it for them. The form stores nothing in your browser and sets no cookies until you answer, and contact details, when a form asks for them, are encrypted and shown only to the makers and to you.

2. Where your data lives

Account and workspace data is stored in a Postgres database hosted by Neon in the United States (AWS us-east-1). The analysis service runs on Fly.io in the United States (Virginia), and the website and sign in run on Vercel. Data is encrypted in transit with TLS and encrypted at rest by our hosting providers.

We store the following:

• Account. Your email address, whether it is verified, an optional display name (from you or from Google if you sign in with it), and, for Google sign in, the Google account identifier that links it. We request only the openid and email scopes from Google.
• Sessions. A record for each signed in browser with its expiry, IP address and browser user agent, so you can review and sign out sessions in Settings. Sessions last up to 30 days.
• Workspace. Your workspace name and the use you picked on the Welcome screen (your own product, competitors or both), and how the account arrived: the landing page, the referring site, any campaign tags, the device type, the signup button used and the day, with no personal details.
• Reports and activity. The products and links you look up, the reports you run and their settings, review excerpts, per review judgments, tracked reports, alerts, questions you ask about reviews and their summaries, custom categories, feedback you give on judgments, and usage counts for your plan. When you use OneStar signed in, from the web app, the iPhone app or a connected assistant, we note when each visit started and ended and how many requests it made, with no pages, addresses or devices.
• Notes on reports. Dated notes you, or an assistant you connected, write on a report, with which of the two wrote each one and the assistant's name. Notes are private to your workspace.
• Connected assistants. For each AI assistant you connect to OneStar over the Model Context Protocol (MCP), such as Claude, Codex or Cursor: the client's name and web address, the permissions and limits you chose, and when it was connected and last used. The sign in service keeps the client's registration, your consent and its tokens. For each request the assistant makes we log the tool it used, the outcome, how long it took, the reviews it reserved, the ids of the reports or runs it touched and a hash of the request, never the text of the request, review text or the results.
• Feedback forms you run. Your forms and their settings, the answers they collect (Section 5), your replies, secret API keys stored only as hashes, and webhook addresses and signing secrets stored encrypted.
• Subscription. Your plan, status, billing interval, renewal date and Polar customer and subscription ids. No card data.
• Email preferences and consents. Your alert and digest settings, and each choice about product update emails with the version of the wording you saw, where you made it, when, and a daily salted hash of the address you made it from.
• Suppressions. A SHA-256 hash of an email address that unsubscribed, bounced or complained, so we do not send to it again. Bounces and spam complaints reported by our email provider, Resend, add the address automatically.
• Audit log. Security relevant actions in your workspace, such as changing a report's visibility or deleting the account, with the time and a daily salted address hash.
• Abuse prevention. Rate limit counters. The API keeps its counters in memory, keyed by a daily salted hash of your IP address, and drops them after a few minutes without requests. Sign in keeps its counters in the database, keyed by a keyed hash (HMAC) of your IP address and the requested path with a key that changes every day, and deletes them after one day. We also keep a keyed hash of each email address a sign in link was sent to, for one day, to limit repeated sends. Beside each sign in link we keep, for one day, a keyed hash of its six digit code and the address encrypted, so the code can sign in the browser that asked and an expired link can send a new one.

3. Reviews and what leaves OneStar

OneStar reads public reviews from the Apple App Store, Google Play and Steam, and reviews of places and companies from Google Maps, Tripadvisor and Trustpilot. App Store and Google Play, Google Maps, Tripadvisor and Trustpilot reviews come from DataForSEO (DataForSEO OU, Estonia), a review data service we pay that supplies public store reviews through its API. Steam reviews come from Steam's public reviews API. App Store search and app details use Apple's public search and lookup APIs. Reviews in a CSV file come from you. Our servers can connect only to an allowlist of hosts: the store hosts, DataForSEO for store reviews, Polar for billing, Resend for email, TypeSafe for the Jev model and Anthropic for the LLM. Requests to the stores and to DataForSEO come from our servers, not from your browser, so they do not receive your IP address or account details.

DataForSEO receives only what it needs to find reviews: store app ids (such as an App Store numeric id or a Google Play package name), the public ids of places and companies (a Google Maps place id, a Tripadvisor page id or a company's website domain), store country and language codes, and the words typed into OneStar's Google Play, place and company search. It receives nothing about you: no email address, no IP address and no account data.

• Author names, profiles and other author fields in store data, including data from DataForSEO, are dropped as the data is parsed and never read, with one exception: for Steam reviews we read the reviewer's playtime when the review was written, a number of hours with no name or account attached, so reports can compare new and long time players.
• Before any text is sent to a model, emails, links, phone numbers and order like ids are replaced with placeholders, and very long reviews are shortened.
• Scrubbed review text is sent to TypeSafe, which runs the Jev model, to be judged. The raw text is never written to disk. OneStar keeps only the id of each request to DataForSEO, so a later read of the same reviews, such as a question about a report or a second report of the same app soon after, reads the results DataForSEO already holds instead of OneStar storing them. Only excerpts of at most 200 characters are stored, together with the judgments.
• On Max reports and on OneStar's own public reports, a large language model (LLM) from Anthropic writes short passages about a report's numbers, such as the Reading and the notes beside each theme, and proposes candidate reasons inside a theme for Jev to judge. It receives the stored excerpts of at most 200 characters (already scrubbed), the counts and labels code computed from them, product names and store descriptions, and, when you use these features, the statement or question you type into Ask, the text you type into the Explorer's search box and a category name you type for a drafted description. For the reply inbox it receives only OneStar's judgments of a review, never its text. It never receives your email address, your account details or review author fields. Anthropic's commercial terms say it may not train models on this content.
• CSV uploads are parsed in memory, held for at most 15 minutes and never written to disk. Columns that look like names, emails, phone numbers, customer ids, order ids or addresses are dropped. The rows then go through the same scrubbing and excerpt rules as store reviews. Please remove personal data you do not need before uploading.
• Questions you ask about reviews, custom category descriptions and product names used for competitor suggestions are also sent to TypeSafe. TypeSafe has committed not to train models on customer data.

Assistants you connect. When you connect an AI assistant over MCP, it can receive, at its request and within the permissions you approved, your reports and their results, stored review excerpts of at most 200 characters, your usage counts and your notes. It can also send OneStar the things you ask it to: a new report, an Ask question, custom category descriptions your own model drafted, or a note. You choose the assistant, and what it receives is handled by that assistant and its provider under their own terms and privacy policy, not ours. We email you each time a new assistant is connected. You can see and disconnect your assistants in Settings, which stops access at its next request; an assistant unused for 90 days is disconnected automatically.

Store reviews are written by members of the public. Excerpts are used only as evidence for a report. Anyone can ask for an excerpt of their review to be removed by emailing support@onestar.sh with a link to the review or to the OneStar report that shows it. We delete the excerpt and block it from being stored again. Excerpts that no remaining report run uses are deleted automatically 90 days after they were last used.

4. Public reports

Reports are private to your workspace by default. You can share a report by link, which lets anyone with the link see it and asks search engines not to index it, or, on plans that allow it, list it publicly. Public reports can be indexed by search engines and can appear in the OneStar gallery and trending lists. Shared and public pages never show who created the report, what it cost or its internal id.

The title you give a report is public when you publish it: it heads the report page, the gallery card, the product page listing every public report of that app, and the preview image shown when the link is shared. Private notes on a report are never shown. Custom category descriptions stay private unless you choose to share them with the report.

Review excerpts are stored once per public store listing and shared between every report that reads that listing, so two reports of the same app show the same excerpts. This adds no new data about you or the reviewers; it only avoids keeping duplicate copies. Excerpts from CSV uploads belong to your workspace and are never shared.

To rank trending reports, we count views of each public report page per day. The count is a single number per report and day. So that reloading a page does not count twice, the service remembers in memory, for the current day only, a daily salted hash of your address next to the report; it is never written to the database and is discarded at the end of the day. No address, cookie or account identifier is stored with the count, and visits by the report's owner and by known crawlers are not counted. We also keep daily counts of which products are searched for and run, with no user, workspace, address or search text attached, to choose featured reports.

5. Answers to feedback forms

Product makers on paid plans can run forms, polls and NPS questions on OneStar: in their own site or app through the OneStar widget, on a page at onestar.sh/f/, or through a link or QR code. When you answer one, the makers of that product (the "form's owner") control your answer: they decide why it is collected and how it is used, and their privacy policy applies. Cure AI processes it for them under the processing terms in our Terms of Service. A short notice under every form says who sees your answer and whether it may be quoted publicly.

For each answer we store:

• What you wrote and chose. Ratings, choices and written answers. Written answers are stored as written, up to 5,000 characters, apart from any record of who you are.
• Where it came from. The time, how it arrived (the widget, a page, a link, an app, an import or the API) and, when the page provides them, the page path without its query string, the app version, platform, language, the address of the referring site without its path, and short plan and cohort labels the page states (such as "pro" or "2026-10", never checked). Anything else the page sends is dropped.
• An address hash. A keyed hash of your IP address, used only to limit repeated answers on the same day and erased after one day.
• A respondent record. A keyed hash of a random device key, so you can finish a form you started and see replies on the same device. If the form's owner signs you in through their own app, a keyed hash of the id they use for you, the name they pass and up to ten short traits they choose to send, such as plan, platform, app version, country or cohort. If you answer with a OneStar account, a link to it: the form's owner sees only that you have a OneStar account and the name you show, never your email.
• Contact details, only when the form asks. An email address or an identifier the owner names, encrypted at rest, and whether you agreed to hear from the makers about updates, with the wording you saw. Contact details are shown only to the form's owner and to you. They are never sent to an AI model, never put in Slack messages or webhooks and never returned by the owner API.

How often a form loads. Each time the widget or a form page shows a form, OneStar adds one to a daily count for that form, the site it ran on and the place name the owner gave it. The count holds nothing about you: no address, device key or page path, and nothing is stored in your browser for it. Loads from a developer's own computer are not counted.

How often a public page is read. OneStar counts one view per visitor a day of each public report, comparison and form page. The count holds nothing about you; the address used to avoid counting twice is kept in memory for that day only.

What the widget keeps in your browser. The widget stores nothing and sets no cookies until you first interact with a form. Then it keeps, in the browser storage of the site you are on, a random device key and markers that you were asked or already answered a form and that a reply is waiting, so the form does not ask twice and replies can reach you. This storage is needed for the feature you chose to use, and clearing your browser storage removes it. Form pages on onestar.sh work the same way.

Who sees your answer.

• The form's owner, in OneStar and through the tools they connect: a Slack channel (excerpts of at most 200 characters with contact details masked), webhooks (ids and counts, no text), their own server through the owner API (answers without contact details), a CSV export (contact details only when the owner asks, and each such export is logged) and AI assistants they connect (form results and recent written answers).
• The public, only when the form says answers may be quoted and the owner shares its results: excerpts of at most 200 characters with contact details removed, never your contact details or account. The owner may hide an excerpt only for a listed reason, and hidden excerpts are counted on the page.
• AI models: written answers, with emails, links, phone numbers and similar details replaced, are sent to TypeSafe for the Jev model to judge, like store reviews. On Max, stored excerpts of answers and counts are sent to Anthropic to write the summary of a report on answers. Neither receives your contact details or who you are.

Replies. If you left an email address, the form's owner can reply to your answer. OneStar sends each reply from its own address through Resend. Replies are about your answer, never marketing, and no address gets more than three a day across OneStar. Each email links to a private conversation page whose address is its key: it works for 90 days after the latest message, is not indexed and sends no referrer. From a reply email or that page you can stop emails, delete your answer, or say you did not send it. Addresses typed into forms are not verified, so someone may have typed yours: "I did not send this" stops OneStar emailing your address and tells the owner without showing it.

Your choices. "Delete my answer" on the conversation page blanks what you wrote, deletes your contact details, removes the answer from the counts and turns the conversation link off. For anything else, such as a copy of your answers or deleting answers you gave without an email, contact the form's owner, who controls them; we help them respond. You can also write to us at support@onestar.sh, and we will pass your request to the owner or act on it where we can.

How long answers are kept. An answer is kept for the history period of the owner's plan when it arrived, 1 year on Pro and 2 years on Max, counted from the answer's date, then deleted with its conversation. Your respondent record and contact details go once no remaining answer uses them. An answer goes sooner when you delete it, or when the owner deletes it, the form or their account.

6. The website, analytics and cookies

The website is hosted on Vercel, which processes standard request information such as IP address, browser and requested page to deliver it and protect it from abuse.

We use Vercel Web Analytics to understand how the website is used in aggregate. It is cookieless. It records page views and a small number of events, such as starting a report, with coarse information like country, browser, operating system and device type. Instead of a cookie, it identifies a visit with a hash of the request that is discarded every day, so it cannot follow you across days or across sites.

Those events carry only coarse labels, such as a plan name, a store or a size range. They never include your email, account or workspace identifiers, review text or what you type into search, and we remove query strings such as sign in links from page addresses before anything is sent.

Our marketing pages, such as the home page, pricing, guides and product pages, load the Google Ads tag so we can see whether visits from our Google ads lead to sign ups. It runs in Google's Consent Mode with advertising and analytics storage denied, so it sets no cookies and is not used to personalize ads. It sends Google the page address with only campaign tags and Google's ad click id kept, the address of the site that sent you there, and the IP address and browser details of the request. It loads only when you arrive from another site, never on sign in, email links, the app, settings or shared reports, and not at all when your browser sends Do Not Track or Global Privacy Control.

The sign in form uses Cloudflare Turnstile, which checks browser signals to tell people from bots.

Cookies and browser storage we use:

We do not use advertising cookies. The Google Ads tag described above is the only advertising script, and it stores nothing in your browser. Because we only use strictly necessary and preference storage, we do not show a cookie banner. You can block or delete cookies in your browser, but you will not be able to sign in without the session cookies.

7. Why we process your information

The table below lists each purpose, the information involved and, for people in the European Economic Area, the United Kingdom and Switzerland, the legal basis under the GDPR.

Where we rely on legitimate interests, we have weighed them against your rights and kept the data minimal, for example by hashing addresses. You can object, as described in Section 13.

8. How we share information

We do not sell personal information and we do not share it for cross context behavioral advertising. We share it only:

• with the service providers listed in Section 12, who process it on our behalf under contracts that limit its use;
• with the public, for reports you choose to share or publish, which do not include your name or email;
• with an AI assistant you connect, which receives what its permissions allow (see Section 3);
• with the owner of a form you answer, and publicly when the form says answers may be quoted (see Section 5);
• when required by law, legal process or a valid government request;
• to protect the rights, safety and property of Cure AI, our users, reviewers or others, and to prevent abuse;
• as part of a merger, acquisition, financing or sale of assets, in which case the information stays subject to this policy or you will be notified;
• with your consent or at your direction.

9. International transfers

Cure AI is based in the United States, and our main providers process data in the United States. If you use the Services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those of your country. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses and the United Kingdom addendum included in our providers' data processing terms, or the EU US Data Privacy Framework where a provider is certified.

10. How long we keep information

When you delete your account in Settings, we first cancel any subscription with Polar and delete your customer record at Polar, then delete your workspace, reports, notes, tracked reports, alerts, questions, feedback, forms and their answers, respondent and contact records, connected assistants, visit times, usage records, subscription record, preferences and consents in one step, and then delete your user account and sessions. Deletion is immediate in the live database and complete in backups within 7 days. Polar, as Merchant of Record, keeps the order and tax records it is legally required to keep.

11. Security

• All traffic uses HTTPS. Sign in cookies are HttpOnly, SameSite and Secure.
• Sign in links and codes expire after an hour, work once and are stored only as hashes. Five wrong codes turn a code off.
• The API trusts only short lived signed tokens from the website, and every workspace read and write is tied to the verified token.
• Reports have unguessable 128 bit ids, and another workspace's data returns not found.
• Our servers may connect only to allowlisted hosts, and secrets are kept only in the server environment.
• Pages use a strict content security policy, routes are rate limited, and CSV exports escape formula prefixes.

No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you and the authorities as required by law. To report a security issue, email support@onestar.sh.

12. Third party services

These providers work for us. Each has its own privacy policy, linked below. All of them except DataForSEO process personal information for us. DataForSEO is a service provider that supplies public store reviews. It receives only store app ids, country and language codes and search keywords, and no personal information about you. The public stores and sites we read reviews from (Apple, Valve, Google, Tripadvisor and Trustpilot) are sources of public data, not processors of your information.

13. Your rights and choices

Everyone. From Settings you can see and update your name, review and sign out sessions, change alert, digest and update emails, export your workspace as a JSON file (your forms and their answers included, with respondents' contact addresses left out) and delete your account. Every alert, digest and update email has a one click unsubscribe link, and sign in and security emails are sent only when needed. You can also email us at support@onestar.sh to access, correct or delete your information, and we will respond within 30 days. We may need to verify that the request comes from the account holder.

EEA, UK and Switzerland. You have the right to access, rectify, erase, restrict and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting earlier processing. You also have the right to lodge a complaint with your local data protection authority. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing; the AI models in OneStar judge and describe reviews, not users.

California. If you are a California resident, the California Consumer Privacy Act, as amended, gives you the right to know what personal information we collect, use and disclose, to access and delete it, to correct it, and not to be discriminated against for using these rights. In the past 12 months we have collected identifiers (email, name, account ids, hashed or session IP addresses), commercial information (plan and subscription status), internet activity (use of the Services, aggregate analytics and ad measurement on marketing pages) and inferences only about reviews, not about you, for the purposes in Section 7, and disclosed them to the service providers in Section 12 for business purposes. We do not sell or share personal information as those terms are defined, and for answers to a form a product's makers run we act as their service provider, and we do not use or disclose sensitive personal information for purposes that require a right to limit. You or an authorized agent can make a request by emailing support@onestar.sh.

Other United States states. Residents of states with similar privacy laws have similar rights, and you can use them the same way. If we deny a request, you can appeal by replying to our response.

Do Not Track and Global Privacy Control. We do not track you across sites. When your browser sends a Do Not Track or Global Privacy Control signal, the Google Ads tag does not load. We also treat a Global Privacy Control signal as a valid opt out of sale and sharing, which we already do not do.

14. Children

The Services are not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has given us personal information, contact us at support@onestar.sh and we will delete it.

15. Changes to this policy

We may update this policy as the Services change. We will post the new version here with a new "Last updated" date and, for material changes, notify account holders by email or in the app before they take effect.

16. Contact

For privacy questions or requests, contact: