This Privacy Policy explains how Contorta Development LLC ("Contorta," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use Line One, including our website and application at https://lineone.contorta.dev and related services (collectively, the "Service").
Line One is intended for adults and is not directed to children. By using the Service, you acknowledge the practices described in this Privacy Policy.
1. Who We Are
Contorta Development LLC is the entity responsible for Line One.
Mailing address: 77 W 4800 N Unit A202, Provo, UT 84604, United States
Privacy and support contact: contact@contorta.dev
Depending on the context and applicable law, we may act as a controller or business for account, billing, advertising, security, and product-usage information. When a customer connects communications accounts and uses Line One to process messages, we may process that content on the customer's instructions as a processor or service provider.
2. Information We Collect
2.1 Account and profile information
We collect information used to create, secure, and administer your account, such as your name, email address, authentication identifiers, verification status, user role, workspace membership, account preferences, and account timestamps. Authentication providers may also provide information according to the permissions you grant and their privacy policies.
On supported Android devices, Line One may create a device-migration restore credential through Android Credential Manager. We store the associated public key, security counters, backup status, and an encrypted copy of the still-active Line One session so the correct account can be restored on a replacement device. Google or another device credential provider may store and transfer the restore key according to your device backup settings. Line One clears or revokes this credential when you log out or delete your account.
2.2 Connected account information
When you connect a communications account, we collect the channel type, account label, email address, telephone number, social handle, connection status, and related configuration information. You must have authority to connect each account and process the associated communications.
For Twilio connections, you provide a Twilio Account SID, Auth Token, and telephone number. We verify the credentials, encrypt them for storage, restrict them to backend use, and do not return the credentials to the browser. Disconnecting a Twilio channel triggers deletion of its stored credential record.
2.3 Communications and collaboration content
The Service may process message bodies, subjects, participants, telephone numbers, email addresses, social handles, timestamps, attachments when supported, provider message identifiers, delivery status, internal notes, spam flags, assignments, conversation status, and other message metadata. Workspace members may be able to access shared communications and collaboration information according to their role and the workspace settings.
2.4 Optional AI inputs
If we offer AI-assisted message drafting, classification, summarization, or similar functions, the text and files you choose to submit to those functions may be processed for the requested purpose. Line One does not currently include the former task-decomposition feature.
2.5 Billing and subscription information
Stripe processes eligible web purchases and Google Play Billing processes Android in-app subscriptions. These providers collect payment, billing, tax, and transaction information under their own policies. We do not intend to store complete payment-card details. We may store provider customer, order, purchase-token, and subscription identifiers, plan, subscription status, payer identity, billing mode, seat quantity, transaction status, and related accounting records.
For Team plans, a workspace may use owner-paid billing, in which the workspace owner pays for active users, or individual billing, in which each member pays for their own access. Workspace owners may see membership and entitlement status but should not receive another member's payment-card or bank details.
2.6 Advertising, device, and usage information
Free accounts may receive advertisements through Adsterra on the website and Google AdMob in the Android app. Advertising and related technologies may process IP address, cookie or local-storage identifiers, browser and device information, approximate location, language, page and ad interactions, consent signals, and information used for ad delivery, frequency control, fraud prevention, reporting, measurement, or personalization where permitted.
The Android app also uses Google Firebase Analytics, which collects app-usage events (such as app opens and sessions, screens viewed, and app version) together with an app-instance identifier, device and operating-system information, approximate location derived from IP address, and, where available, the Android advertising ID. We use this to understand how the app is used, measure the performance of ads served through Google AdMob, and improve reliability. Where consent is required (for example in the European Economic Area, the United Kingdom, and Switzerland), this collection follows the choices you make in the consent prompt, which you can change at any time from Advertising privacy choices in Settings. You can also reset or limit your Android advertising ID in your device settings.
We and our providers may also collect security events and limited operational logs needed to protect and operate the Service. Optional automatic crash and diagnostic reporting is disabled unless you expressly enable it. If enabled, Line One may send the error message and stack trace, affected app screen, date and time, app version and build, operating-system version, device manufacturer and model, browser information where applicable, and whether a device is physical or virtual. These automatic reports are designed to exclude message bodies, contacts, passwords, and connected-account credentials. Reports are stored in Line One's restricted backend and may be emailed to our tester-feedback address so we can investigate reliability problems. You can revoke or grant this permission at any time in Settings; revocation stops new automatic reports but does not retroactively delete reports already received.
When you choose Send Feedback or Report a Bug, Line One separately prepares an editable email that may include the app version and build, operating-system version, device manufacturer and model, whether the app is running on a physical device or emulator, and browser information where applicable. You can review, edit, or remove that diagnostic block before sending the email. If you enable Android notifications, we process a Firebase Cloud Messaging device-registration token and notification preferences so notifications can be delivered to your signed-in device. The registration token identifies an app installation for delivery and is not your Twilio credential.
2.7 Support communications
If you contact us, we collect the contents of your request, your contact information, any attachments you provide, and information needed to investigate and respond.
2.8 Optional calendar information
If calendar integrations are offered and you choose to connect one, the Service may access and process calendar account identifiers, calendar names, event titles and descriptions, attendees, organizer information, dates, times, time zones, locations, conferencing links, availability, recurrence information, reminders, attachments when supported, and provider event identifiers. The precise information accessed and actions permitted—such as reading availability or creating, updating, and deleting events—will depend on the permissions you approve with the calendar provider. You may disconnect a calendar integration to stop future access, subject to provider behavior and retention described in this Policy.
2.9 Sensitive information
Communications may incidentally contain health, financial, legal, employment, government-identifier, or other sensitive information. Please do not submit sensitive information unless it is necessary, lawful, and appropriate for your use of the Service. Line One is not represented as a system designed for regulated medical records, payment-card storage, or other specially regulated data unless we expressly agree otherwise in writing.
3. How We Use Information
We use personal information to:
- provide, operate, synchronize, and improve the Service;
- authenticate users and secure accounts;
- send and receive communications through connected providers;
- organize inboxes, assignments, notes, workspaces, and subscriptions;
- provide requested calendar synchronization, scheduling, reminders, and event-management features when enabled;
- provide requested AI-supported features;
- process payments, administer subscriptions, and maintain financial records;
- display and measure advertisements for Free accounts;
- personalize settings and remember user choices;
- provide support and respond to requests;
- monitor reliability, troubleshoot errors, prevent abuse, and protect users and the Service;
- comply with law, enforce agreements, resolve disputes, and establish or defend legal claims; and
- create aggregated or de-identified information that does not reasonably identify an individual.
Where required, we rely on one or more lawful bases, including performance of a contract, legitimate interests, consent, and compliance with legal obligations. The applicable basis depends on the information, purpose, and jurisdiction.
4. AI Processing
If enabled in a future Line One feature, Line One may use Base44's managed InvokeLLM integration configured to use an OpenAI GPT model. Base44 provides the application and managed AI-integration layer, and OpenAI operates the underlying model.
When you use an AI feature, relevant prompts, requested output format, and related context are transmitted through Base44 for processing by the configured OpenAI model. We use the resulting output to provide the requested feature. AI output may be inaccurate or incomplete and should be reviewed before you rely on it.
We do not currently intend to use another underlying model provider without updating our disclosures as appropriate. Provider processing, security, retention, and training practices are governed by our arrangements with Base44 and the applicable provider terms. Avoid submitting sensitive information to optional AI features unless necessary.
6. How We Disclose Information
We may disclose information to:
- Base44, for application hosting, backend services, authentication, storage, integrations, and managed AI calls;
- OpenAI, as the currently configured underlying AI model provider;
- Twilio, to verify credentials and send, receive, route, and report on SMS messages;
- calendar and productivity providers you choose to connect, such as Google or Microsoft, to retrieve, synchronize, create, update, or delete calendar information according to the permissions you grant;
- Stripe and Google Play, to process applicable payments and administer subscriptions;
- Adsterra, Google AdMob, and advertising partners, to serve, secure, measure, and, where permitted, personalize ads for Free accounts;
- Google Firebase Analytics, to measure app usage and ad performance in the Android app;
- Google Firebase Cloud Messaging, to route requested Android push notifications to registered Line One app installations;
- infrastructure, security, analytics, communications, support, and professional-service providers that process information on our behalf;
- workspace owners, administrators, and members according to workspace roles and settings;
- government authorities, courts, litigants, or other parties when required by law or reasonably necessary to protect rights, safety, and security; and
- a buyer, investor, lender, advisor, or successor in connection with a financing, merger, acquisition, reorganization, sale of assets, bankruptcy, or similar transaction.
We may disclose aggregated or de-identified information where permitted by law. We do not authorize service providers to use customer communications for their own unrelated purposes.
Some privacy laws define certain personalized advertising disclosures as a "sale," "sharing," or use for "targeted advertising," even when no money is exchanged. Where those laws apply, we will provide required notices and opt-out methods.
7. Workspaces and Other Users
Information placed in a Team workspace may be visible to authorized workspace members. Workspace owners and administrators may manage membership, roles, assignments, connected accounts, billing settings, and access to shared content. Members should understand that workspace administrators may retain control of shared workspace content after a member leaves.
If you use Line One on behalf of an organization, that organization may control the workspace and associated information. Direct requests concerning organization-controlled data to the workspace owner first; we will assist as appropriate under our agreement and applicable law.
8. International Data Transfers
We are based in the United States and use providers that may process information in the United States and other countries. These locations may have data-protection laws different from those where you live. Where required, we use appropriate contractual or other safeguards for international transfers. You may contact us for more information about applicable safeguards.
9. Data Retention
We retain information for the period reasonably necessary to provide the Service, fulfill the purposes described above, comply with legal and accounting obligations, resolve disputes, enforce agreements, and protect the Service. Our current operational targets are:
- messages and account content: while the account is active, until deleted by an authorized user, or as controlled by the applicable workspace;
- disconnected Twilio credentials: deletion when the channel is disconnected;
- Android restore credentials and encrypted restorable sessions: until logout, account deletion, revocation, replacement, or expiration of the underlying session;
- closed-account personal content: deletion or de-identification within approximately 30 days, unless retained by an organization-controlled workspace or required for a legal reason;
- backups: expiration through normal backup cycles, targeted within 90 days;
- ordinary diagnostic logs: approximately 90 days;
- security and access logs: approximately 12 months;
- support correspondence: approximately 24 months after resolution;
- consent and privacy-choice records: approximately five years or the applicable limitation period; and
- billing, transaction, and tax-supporting records: generally up to seven years, or longer where required by tax rules, audits, disputes, chargebacks, contracts, or legal holds.
Retention periods are targets and may vary based on data type, provider functionality, legal requirements, technical constraints, and the status of disputes or legal holds. Deletion from active systems may not immediately remove information from encrypted backups, provider systems, or records we must retain by law.
10. Security
We use administrative, technical, and organizational safeguards designed to protect information. These include authentication, access controls, user-ownership restrictions, row-level authorization, encryption in transit, encryption of stored Twilio credentials and restorable sessions, signed restore challenges, strict Android signing-origin verification, backend-only credential handling, secret management, logging, and provider security controls.
No system is completely secure. You are responsible for protecting your credentials, using appropriate access controls, and promptly notifying us of suspected unauthorized use. Do not share Twilio Auth Tokens or other provider credentials through messages or support requests unless we specifically provide a secure method.
11. Your Choices and Privacy Rights
Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, or objection; withdraw consent; opt out of targeted advertising or certain sales or sharing; and appeal a denied request. These rights may be subject to exceptions and verification requirements.
You may also:
- update certain account information through the Service;
- disconnect a connected channel;
- disconnect a connected calendar or other optional integration;
- manage workspace membership and billing according to your role;
- adjust available cookie and advertising choices;
- avoid optional AI features; and
- enable or disable optional crash and diagnostic reporting in Settings;
- request account closure in the app under Settings, at https://lineone.contorta.dev/delete-account, or by emailing contact@contorta.dev.
Please describe your request and identify the account involved. We may request information needed to verify your identity and authority. Authorized agents may submit requests where permitted by law, subject to verification. We will not discriminate against you for exercising applicable privacy rights.
12. Children's Privacy
The Service is intended for adults and is not directed to children under 13 or to persons under the minimum age required by local law to consent to online data processing. We do not knowingly collect personal information from children through the Service. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.
13. Third-Party Services and Links
The Service connects to or links to third-party services. Their processing is governed by their own terms and privacy policies. We are not responsible for third-party services you choose to connect, and you should review their policies before authorizing access.
14. Changes to This Privacy Policy
We may update this Privacy Policy to reflect product, provider, legal, or operational changes. We will post the revised version with a new "Last updated" date. When required, we will provide additional notice or request consent before a material change takes effect.
15. Contact Us
For privacy questions, support, or requests, contact:
Contorta Development LLC
77 W 4800 N Unit A202
Provo, UT 84604
United States