Privacy policy

This policy explains how OneForUno processes personal data when you browse, sign in, vote, submit projects, sponsor a project or contact us. Optional analytics require your permission; essential website features and security checks operate separately.

Who is responsible

The controller of this website is Florin Paraschivescu, operating OneForUno as an individual. For privacy questions or to exercise your rights, email contact@onefor.uno. You can make a privacy request by email without accepting analytics or using the contact form.

What we collect

• Your email address, to sign you in with one-time codes and to tell you about your projects (sent, approved, needs changes).
• Your username and profile picture (the picture is optional). They are shown on your projects; your email never is. Each username links to a profile page that is private by default (it shows only the username and picture). If you turn it public you can add a short text, and the page then also shows when you joined and your live projects. You can turn it off again at any time, and the text is removed from view at once.
• Your votes: which project you voted for in each weekly round (including votes you withdrew or moved), so each person votes once per week. A guest vote is tied to a random id in a cookie rather than a name or email. This identifier is pseudonymous, and security checks can also process technical data.
• Your projects: everything you write and upload. Photos are cleaned of hidden data (such as GPS location) when uploaded. Private documents are seen only by you and our reviewers.
• Contact messages: your name, email and message, so we can answer.
• Your IP address, to protect the site: limiting sign-in codes, votes and messages, and stopping abuse. It is not stored with your votes. For the security checks before a vote we keep only a scrambled (hashed) form of it, as a counter of attempts, for one hour.
• Security-check data: the answers to the challenges are kept only in a scrambled form, and after two days each check loses everything that points to a person or a connection. Only anonymous counts (how many checks were started, passed or failed in a week) are kept, for 90 days, to spot abuse. The pass that unlocks your vote of a week stays with the round.
• Page views of each project, counted per day without any personal detail. To avoid counting the same visit twice, the IP address is kept in memory for half an hour and never stored.
• Optional analytics: after acceptance, Google Tag Manager loads Google Analytics 4. Analytics can process page visits, interactions, device/browser details and approximate location derived from an IP address to help us understand website use, as explained in our cookie policy.
• Operational logs: technical errors and request information used to investigate failures and abuse. An IP address or pseudonymous identifier can be personal data even when no name is attached.

What is public by nature

Approved projects are public, including their pictures, public documents, donation wallet and any contact email or phone the owner chose to show. Donations happen on the Solana blockchain, which is public: anyone can see transfers to and from a wallet. We do not control that information and cannot remove it.

Cookies

Essential cookies keep you signed in, remember a requested guest vote, protect forms and save your privacy choice. Security providers may use cookies during their checks. Optional analytics are off until you explicitly accept; refusing them does not prevent you from using the website. Advertising consent remains denied. Read the cookie inventory and provider details, change your preferences or withdraw consent at any time.

Why we process data

• Providing the service (GDPR Article 6(1)(b)): managing your account, requested voting and project features, sponsorship requests and related service messages. Required fields are needed to provide the feature you request; profile pictures and optional public contact details are your choice.
• Legitimate interests (Article 6(1)(f)): protecting the website and fair voting, preventing fraud, reviewing content, answering enquiries, diagnosing errors and counting aggregate project views. These interests are operating a reliable service and protecting users; you may object to processing based on them.
• Consent (Article 6(1)(a)): optional analytics. You can refuse or withdraw this consent just as you can give it. Withdrawal does not affect the lawfulness of earlier processing.
• Legal obligations (Article 6(1)(c)), where applicable: retaining records that applicable law requires or responding to lawful requests. This does not make every retained record necessary indefinitely.

Services we rely on

• Cloudflare Turnstile is the last of the five security checks before a vote. It is subject to Cloudflare's Privacy Policy.
• Google reCAPTCHA protects the contact form, sending a project for review and the vote security checks from bots. Its script loads for a requested protected action. It can process IP addresses, browser/device information and interaction signals and may set a security cookie. It is subject to Google's Privacy Policy and Terms.
• Google Tag Manager and Google Analytics 4: the GTM container and Analytics load only after analytics consent. This consent is separate from reCAPTCHA security checks. Google's privacy policy explains its processing.
• Email delivery: our mail provider sends the sign-in codes and project emails.
• Solana network: we read the public balance of project wallets to show progress, and public transactions to verify sponsorship payments.

Recipients and international processing

Website hosting, security and email providers process the data needed for their services. Our reviewers and administrators can access information needed to review content, support users and investigate abuse. Public project and sponsor information is available to visitors. Google and Cloudflare operate internationally, so their services may process data outside the European Economic Area. You can contact us for the applicable recipients, processing locations and transfer safeguards, including a copy of relevant safeguards where available. Refusing analytics prevents optional GTM processing; it does not stop requested security checks or public blockchain processing.

How long we keep it

Sign-in codes expire after a few minutes and are then deleted. Security challenge attempts use a one-hour window; challenge records are deleted after two days, and what is left of a check is an anonymous count kept for 90 days. Project view deduplication uses IP addresses in memory for 30 minutes. Contact messages are kept for answering and following up on the enquiry. Your browser's privacy choice is kept for 180 days; optional cookie lifetimes are listed in the cookie policy.

Deleting an account, project or sponsor profile removes it from public view immediately. The owner can restore eligible content within 30 days. This is a restoration period, not automatic permanent erasure. After it ends, the current application retains the underlying records and uploaded files; administrators can restore accounts and sponsor profiles in supported cases. A deleted account's email and username are released. Round results and sponsorship payment records remain part of the site's history. You may request erasure and ask which records still need to be retained and for what reason.

Your rights

You can delete your account yourself at any time from your profile page. It leaves the site at once, with your projects and sponsor profiles, and you can restore it within 30 days by signing in. After that your email and username are released; the records are kept, out of public view and accessible only to our administrators, so payments, round results and abuse cases stay auditable. Sponsorships you made remain in the projects' totals, shown as anonymous. Account deletion and withdrawal of analytics consent are separate actions. You can also request access and a copy of your personal data, correction, erasure, restriction of processing, portability where applicable, or object to processing based on legitimate interests. Rights are subject to the applicable legal conditions; blockchain records are outside our control. Write to contact@onefor.uno or use the contact form.

We normally respond within one month of receiving a request. Where permitted, complex or numerous requests may take up to two additional months; we will explain an extension within the first month. We may ask for proportionate information to verify your identity. You can complain to a supervisory authority, including the authority in your place of residence, work or the alleged infringement. The controller is based in Romania; its supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Automated security checks

Bot checks and attempt limits can block a form submission or vote. The website does not use analytics to make decisions with legal or similarly significant effects about you. If you believe a security check has blocked you incorrectly, email us so we can review the issue.

Changes

If this policy changes, the date at the top changes too; important changes will be announced on the site. See also our terms of use.