Privacy & Terms

1. Data we collect

We collect only what is necessary to provide and improve OnRail:

• Account data — your email address, display name, and authentication tokens created when you sign in via email or Google OAuth.
• User content — tasks, journal entries, canvas notes, system definitions, and any other content you create inside OnRail. This data belongs to you.
• Usage data — product events (e.g. "task created", "onboarding completed") sent to our analytics provider PostHog to help us understand how the product is used. These events are tied to your account ID, not your browser. No cookies or fingerprinting are involved.
• Calendar data — if you connect a calendar (Google Calendar or CalDAV), we store OAuth tokens and sync calendar events into your workspace. We do not read calendar data beyond what you explicitly sync.
• Billing data — if you subscribe to a paid plan, Stripe processes your payment. We receive a Stripe customer ID and subscription status; we never see or store your card number or payment details.
• Technical data — server logs may include your IP address and user-agent for security and debugging purposes. These are retained for up to 30 days.

2. Legal basis for processing (GDPR)

If you are in the European Economic Area (EEA), we process your data under the following legal bases:

• Contract performance (Art. 6(1)(b)) — account data, user content, and calendar data are processed to deliver the service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — usage analytics and server logs help us improve the product and maintain security, in a way that does not override your fundamental rights.
• Legal obligation (Art. 6(1)(c)) — billing records may be retained to comply with tax and accounting laws.

3. How we use your data

• To provide, maintain, and improve OnRail.
• To send transactional emails (login links, billing receipts, account notifications).
• To analyse product usage at an aggregate level and identify areas for improvement.
• To investigate security incidents or abuse.
• To comply with legal obligations.

We will never sell your data, use it for advertising, or share it with third parties for their own marketing purposes.

4. Third-party processors

We use the following sub-processors, each bound by appropriate data processing agreements:

• Hetzner — cloud infrastructure and servers (EU-based).
• Backblaze B2 — file and attachment storage (EU region).
• Stripe — payment processing. Stripe's privacy policy applies to payment data.
• PostHog — server-side product analytics (EU cloud). No cookies or browser-level data collection.
• Resend — transactional email delivery.
• Google — if you use Google OAuth or Google Calendar integration, Google's privacy policy also applies to that interaction.

5. Data retention

We retain your data for as long as your account is active. When you delete your account:

• There is a 30-day grace period during which you can reactivate your account by logging back in.
• After 30 days, all personal data — tasks, journal entries, canvas notes, and account details — is permanently and irreversibly deleted.
• Billing records required by law may be retained for up to 7 years.
• Server logs are retained for up to 30 days.

6. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — delete your account and all associated data.
• Portability — export your data in a machine-readable format (available from Settings → Data).
• Objection — object to processing carried out under legitimate interests.
• Restriction — request that we limit how we use your data in certain circumstances.

To exercise any of these rights, email privacy@onrail.app. We will respond within 30 days. If you are in the EEA and believe we have mishandled your data, you have the right to lodge a complaint with your local data protection authority.

7. Cookies

We use a single, strictly necessary session cookie (_onrailapp_key) to keep you signed in. We do not use advertising, analytics, or third-party tracking cookies. See our Cookie Policy for the full details.

8. Children's privacy

OnRail is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a minor has created an account, contact us at privacy@onrail.app and we will delete the account promptly.

9. Changes to this policy

We may update this policy from time to time. When we make material changes, we will notify you by email at least 14 days before the changes take effect. The date at the top of this page always reflects the most recent revision. Continued use of OnRail after the effective date constitutes acceptance of the updated policy.

10. Contact

Privacy questions or requests? Email privacy@onrail.app. We aim to respond within 5 business days.

1. Acceptance

These Terms of Service ("Terms") constitute a legally binding agreement between you and Dalfrom ("we", "us") governing your use of the OnRail application and website at onrail.app (the "Service"). These Terms apply alongside our Privacy Policy and Cookie Policy, which are incorporated by reference.

2. Eligibility

You must be at least 16 years old to use OnRail. By creating an account, you represent that you meet this requirement and have the legal capacity to enter into this agreement.

3. Account registration & security

You are responsible for maintaining the security of your account. You must not share your login credentials with others. Each account is for individual use only — shared or team accounts are not supported at this time. You must provide accurate information when creating your account and keep it up to date. We reserve the right to suspend or terminate accounts that provide false information or violate these Terms. Notify us immediately at support@onrail.app if you suspect unauthorized access to your account.

4. Acceptable use

You agree to use OnRail only for lawful purposes and in a manner consistent with these Terms. You must not:

• Attempt to probe, scan, or test the vulnerability of our systems.
• Attempt to reverse-engineer, decompile, or disassemble the Service.
• Use automated means to access the Service in a way that degrades performance for other users.
• Use the Service to store, transmit, or distribute illegal, harmful, or offensive content.
• Impersonate any person or entity, or misrepresent your affiliation with any person or entity.
• Violate any applicable local, national, or international law or regulation.

5. Your content

You retain full ownership of all content you create in OnRail — your tasks, journal entries, notes, and other data. By using the Service, you grant us a limited, non-exclusive, royalty-free license to store, process, and display your content solely as needed to provide the Service to you. We do not use your content to train AI models, share it with third parties, or use it for any purpose other than operating the Service on your behalf.

6. Intellectual property

OnRail, including its software, design, trademarks, and brand assets, is our intellectual property. Nothing in these Terms grants you a right to use our trademarks, logos, or other brand elements without prior written consent. You may not copy, modify, distribute, sell, or lease any part of the Service without explicit written permission.

7. Subscriptions & billing

OnRail offers both a free tier and paid plans. Paid plans are billed monthly or annually in advance via Stripe. All prices are shown in USD and exclusive of local taxes unless stated otherwise. By subscribing, you authorise us to charge your payment method on a recurring basis until you cancel.

• Cancellation — you may cancel at any time from Settings → Billing. Your subscription remains active until the end of the current billing period; no refund is issued for the unused portion of a paid period, except as provided below.
• 30-day money-back guarantee — if you subscribe for the first time and are not satisfied, contact us within 30 days of your initial charge and we will issue a full refund, no questions asked.
• Price changes — we will give you at least 30 days' notice before increasing prices on your current plan. Continued use after the price change takes effect constitutes acceptance.
• Failed payments — if a payment fails, we will notify you and attempt to collect again. After repeated failures, your account may be downgraded to the free tier.

8. Termination

You may delete your account at any time from Settings → Data. We may suspend or terminate your account if you materially breach these Terms, with or without notice. Upon termination:

• Your access to the Service ends immediately.
• Your data is retained for 30 days, then permanently deleted, as described in our Privacy Policy.
• If we terminate for reasons other than your breach, we will provide a pro-rata refund for any unused prepaid subscription period.

9. Service availability

We aim to keep OnRail available at all times but cannot guarantee uninterrupted service. Planned maintenance will be communicated via our status page at onrail.app/status when possible. We are not liable for any loss arising from downtime, outages, or data unavailability, except in cases of gross negligence on our part.

10. Disclaimer of warranties

The Service is provided "as is" and "as available" without warranties of any kind, whether express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, or non-infringement. We do not warrant that the Service will be error-free, uninterrupted, or free of harmful components.

11. Limitation of liability

To the maximum extent permitted by applicable law, we shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including loss of data, loss of profits, or loss of business, arising from your use of or inability to use the Service, even if we have been advised of the possibility of such damages. Our total aggregate liability for any claim arising out of or relating to these Terms shall not exceed the greater of (a) the amount you paid us in the 12 months preceding the claim, or (b) €100 EUR.

12. Indemnification

You agree to indemnify and hold us harmless from any claims, losses, liabilities, damages, costs, and expenses (including reasonable legal fees) arising from your violation of these Terms, your use of the Service, or your violation of any third-party rights.

13. Governing law & disputes

These Terms are governed by and construed in accordance with the laws of Italy, without regard to its conflict-of-law principles. Any disputes arising under these Terms shall be resolved by the courts of Italy. If you are a consumer resident in the EEA, you retain the benefit of any mandatory consumer protection laws applicable in your country of residence.

14. Changes to these terms

We reserve the right to modify these Terms at any time. When we make material changes, we will notify you by email at least 14 days before the new terms take effect. Continued use of OnRail after the effective date constitutes acceptance of the revised Terms. If you do not agree to the changes, you must stop using the Service and may delete your account before the effective date.

15. Contact

Questions about these Terms? Email hello@onrail.app.