Who we are
OnlyTool operates the website onlytool.ai and the product at app.onlytool.ai. We decide how the data described here is handled, and you can reach us about any of it at support@onlytool.ai or on Telegram.
What we collect
Your account. Your email address and a password, which is stored only as an argon2id hash — we cannot read it. Plus the settings you choose in the dashboard.
The creator accounts you connect. To answer fans as a creator, the product signs in to that OnlyFans account on your instruction. We store what is needed to hold that session and to operate the account you asked us to operate.
Content from those accounts. Copies of vault media and their captions, chat history, message metadata, and purchase and earning events. This is what the AI reads to learn a creator's voice and to know what it can offer a fan.
Usage. A count of the messages the AI sends, because that is what we bill.
Website data. Standard server and CDN logs, and the advertising cookies described below.
Fans' messages
Operating a creator's inbox means processing messages written by their fans. We handle that data on the creator's instruction and for no other purpose: we do not sell it, we do not use it to train models for anyone else, and we do not use it to advertise to fans. If you connect a creator account, you are responsible for having the right to do so and for your own obligations to your fans under the platform's terms and your local law.
Why we are allowed to hold it
For everything in the product, because you asked us to run a service that cannot work without it — that is performance of our contract with you. For security, abuse prevention and keeping the service up, our legitimate interest. For advertising cookies, consent where the law requires it.
Cookies and advertising
onlytool.ai loads the Google Ads tag (AW-18163078601). It sets Google
advertising cookies, measures page views, and allows remarketing and click attribution.
Being straight about this: the tag currently loads for every visitor, including visitors in the EEA and the UK, before any consent is asked for. We are changing that. Until we do, you can block it in your browser's cookie settings, or turn off personalised advertising in your Google Ads settings. The product at app.onlytool.ai carries no advertising or analytics tags at all.
Who else touches the data
We keep this list short on purpose. Each of these is a company that processes data on our behalf:
- Amazon Web Services — hosting, file storage and databases (United States).
- Resend — the transactional emails we send you (sign-up, password reset, account notices).
- Google — the advertising tag above, and the Gemini models that generate replies.
- OpenRouter — routes our requests to those models.
- Cal.com — if you book a call with us.
- Telegram — if you contact support there.
Some of these are in the United States, so data reaches the US. We do not sell your data or share it with anyone for their own marketing.
How long we keep it
Account and content data stays while your account is open, because the product needs it to work. Ask us to delete it and we will, along with the account — write to support@onlytool.ai. You can also ask for a copy of what we hold. We answer within 30 days.
Security
Traffic is encrypted in transit and data is encrypted at rest. Passwords are hashed with argon2id. Access to production data is limited to the people who operate the service.
Your rights
You can ask for access to your data, correction of it, deletion of it, a portable copy, or object to a particular use. Write to support@onlytool.ai. If you are in the EEA or the UK and think we have handled your data badly, you can also complain to your local data protection authority.
Changes
When this page changes, the date at the top changes with it. If a change matters to you — a new processor, a new purpose — we will tell you by email rather than leave you to find it.
Contact
support@onlytool.ai reaches a person.