ForOne Privacy Policy

Last updated: September 16, 2026

Personal information is presented in this Policy as a journey. It is gathered the moment the application is first opened, then employed, shared, stored and finally deleted; each of the five stages is set out in turn below — what occurs there, who handles the data, and how long it is kept. The application is published under the developer name DevByDesign and operated by the legal entity ShineOn Window Cleaning LLC. This Policy should be read in full before an account is registered, a sign-in is performed, or the application is used in any manner; should any stage described here be unacceptable to you, use of the application must cease.

Section I — Scope of this Policy and the principles applied

The ForOne mobile client and the web services supporting it (referred to collectively as the "Application", "we", "us" or "our") are governed by this Policy. Personal information is handled by us under the principles of lawfulness, fairness, necessity, transparency and security, and only insofar as it bears a direct connection to a specific function.

Services run independently by third parties fall outside the coverage of this Policy. Where the Application directs you to a third-party page, or invokes a function supplied by a third party, your information passes into that party's hands under its own privacy policy, which should be read first.

This Policy is taken to have been read and understood once use of the Application continues. Registration and use must be avoided where any part proves unacceptable.

Section II — Stage one: the information gathered from you

Nothing beyond what delivering the corresponding function requires is gathered, and nothing beyond that scope is requested. Four categories are involved:

1. Account information. The email address, nickname, avatar, gender, date of birth and region you submit at registration or profile completion are received by us, along with any further profile content edited or added afterwards. Without such information an account cannot be established, and other users have no means of recognising you.
2. Device information. To support different handset models, locate malfunctions and identify anomalous devices, we record device environment data such as the device model name, system version number, screen size and pixel density, and available storage capacity.
3. Usage behaviour. Records are kept, while the Application is in use, of the devices switched between at registration and sign-in, how often profiles are edited, how many photographs are uploaded and at what times, and the sending and read status of messages. From such data a problem scene can be reconstructed and platform order maintained.
4. Payment information. Payment for membership benefits is completed entirely through the official Google Play Billing channel, and what reaches us is confined to the necessary receipt: order number, transaction status and the item purchased. Bank card numbers, payment passwords and payment verification codes are neither accessed nor stored by us.

Section III — Stage two: why this information is used

Every use of the information gathered is accounted for by the five purposes below; no use outside those stated in this Policy is made of it:

1. Function operation. This purpose keeps registration, sign-in, profile display, matching and chat running as core capabilities.
2. Service optimisation. Bottlenecks are traced from usage behaviour and malfunction data, and product experience together with recommendation quality improves in consequence.
3. Security protection. Fraud, spam, malicious registration and account takeover are identified here, and account security and platform order are preserved by it.
4. Customer support. Enquiries, complaints and appeals receive their answer here, and fault reports together with reporting tickets are handled here.
5. Legal compliance. Obligations arising under applicable laws, regulations and regulatory requirements are discharged through this purpose, which also governs our cooperation with lawfully conducted investigations.

Section IV — Stage three: the third parties to whom information flows

No sale, rental or other trading of your personal information takes place. Application functions are supported through integrations with third-party SDKs / services, among them AppsFlyer (attribution analytics), Amplitude (behavioural analytics), Branch (deep linking and referral tracking) and Braze (messaging); advertising services and statistical tools may likewise be employed. Processing by these third-party SDKs / services is confined to what their respective functions require, and each remains bound by its own privacy policy. Only in the circumstances listed below does your personal information leave our control:

1. your separate consent or explicit authorisation has been given;
2. entrusted partners need information within the minimum necessary scope so that payment, push notifications, statistical analysis and other essential functions can be completed, equivalent confidentiality obligations being imposed on them;
3. laws, regulations, judicial authorities or regulators compel disclosure;
4. the personal safety of users, platform security or significant public interest must be protected;
5. a merger, acquisition, reorganisation or asset transfer carries the information along with the relevant business, the recipient being required to observe protection standards no lower than those of this Policy.

Section V — Stage four: how information is stored and safeguarded

Industry-standard security measures stand behind the protection of your personal information:

• In transit: the entire link runs under TLS/SSL encryption, so interception or alteration of data in transit is prevented;
• At rest: AES-256 encryption is applied to sensitive fields before they reach disk, and keys are kept apart from business data;
• Access: role-based access control (RBAC) is in force, holding the data reach of internal personnel within the least-privilege boundary;
• Audit: access logs are kept and examined at intervals, and any anomalous access raises an immediate alert.

Beyond that foundation, at least one security assessment and penetration test is conducted each year, personal information protection training reaches every member of staff, and a data security incident response procedure stands ready so that any anomaly is located, contained and reported without delay.

Section VI — Stage five: when information is cleared

No longer than the reasonable period needed to fulfil service purposes is your personal information kept. On expiry of that period, or once the law no longer requires continued storage, the relevant data is deleted, anonymised or de-identified by us. Where account closure is applied for, the specific scope of deletion and the exceptions to retention are described on the ForOne Account Deletion page.

Section VII — The five data rights you may exercise

Control over your personal information remains entirely in your hands. Through the in-app settings entry or the support email, the rights below may be exercised in accordance with law:

1. Access. The account profile and related records held by us are open to your viewing and confirmation.
2. Rectification. Inaccurate personal information can be corrected, completed or brought up to date.
3. Erasure. You may ask for your personal information to be deleted, or file for account closure through the account closure entry ; on completion of closure the relevant data is handled under this Policy and applicable law.
4. Withdrawal of consent. Consent given earlier for a specific processing matter can be withdrawn at any time, with processing already completed beforehand unaffected.
5. Obtaining a copy. On request, a structured copy of your personal information will be supplied to you.

Questions, objections and complaints about that processing are equally welcome beyond the five rights. Once your identity is verified, a reply follows within a reasonable period.

Section VIII — Adults only: the age 18 threshold and minors' information

Adults aged 18 or above are the only users to whom the Application is offered; minors are not served by it, and no active gathering of minors' personal information takes place. Should an incorrect age entry, a fraudulent registration or some other unforeseen cause bring such information into our possession, its deletion follows confirmation, together with restriction of the account concerned from further use. More on child safety appears in the ForOne Child Safety Standards.

Section IX — Revision of this Policy and how notice is given

Where product functions, service models, laws and regulations or regulatory requirements change, this Policy is revised accordingly, the updated version is published in the Application or on the official website, and the date at the top is refreshed. Should a change affect your material rights, advance notice is given by pop-up prompt, in-app notification or another prominent means, and your consent may be sought afresh where necessary.

Section X — How to contact us

Questions, comments or complaints concerning this Policy, the processing of personal information or the exercise of rights may be raised with us as follows: