Skip to content
OneArbitrage
Get the app

Privacy Policy

Last updated: October 11, 2026

Introduction

This Privacy Policy describes how OneArbitrage, LLC ("we," "us," or "our") collects, uses, and shares information when you visit our public marketing website (including legal pages and the FAQ), or use our subscription software in the native iOS and Android mobile apps, where you create or sign in to a OneArbitrage account, connect a supported U.S. brokerage account, and run reverse stock split arbitrage ("RSA"). Our principal place of business is 5900 Balcones Drive # 33202, Austin, TX 78731.

For how we use cookies and similar technologies on our sites, see our Cookie Policy. This policy may be updated from time to time; we will revise the "Last updated" date when we make material changes.

Information we collect

Depending on how you interact with us, we may collect the following:

  • Website and device. When you browse our marketing site, our hosting and infrastructure providers may log technical data such as IP address, user agent, and request metadata as part of normal service operation. Our marketing site stores your display theme preference in browser local storage (for example, to remember light or dark mode). We load Google Tag Manager (container id GTM-NVXQV252) on the marketing site, which may load tags such as Google Analytics 4 to understand aggregate traffic and page usage. Google may process device and usage data under its policies. Other tags may be added to the container over time; we describe material measurement tools in this policy and our Cookie Policy. When we run Meta (Facebook/Instagram) advertising, we may use the Meta Pixel on the marketing site to measure ad performance and actions such as starting sign-up; Meta may process device and usage data under its policies. Where required by law, we will obtain consent before non-essential measurement or advertising cookies are used.
  • Authentication (Amazon Cognito). When you sign in or sign up in our mobile apps, we use Amazon Cognito Hosted UI with the Authorization Code flow with PKCE. For that flow, short-lived values (such as the PKCE verifier and OAuth state) may be held in session storage in the system or in-app browser context until sign-in completes. Cognito processes your authentication according to your login method and issues tokens; default requested scopes include openid and email, so we may receive identifiers and email from your identity provider as reflected in those tokens. If you choose a federated login (for example Sign in with Google), that provider processes your login under its policies and shares identifiers with Cognito as part of the flow.
  • Account provisioning. After authentication, our services verify your Cognito ID token and create or update your customer record. We store at least your Cognito subject identifier (sub) and email address, allocate a customer referral code, and may record referral attribution when you arrive with an inviter code (for example from a ?ref= link stored in session storage until first provisioning). Attribution for referrals is applied only when your account is first created, consistent with our product rules.
  • Subscriptions (Stripe). We use Stripe for checkout, recurring subscription billing, payment method updates, and related notices on Android and optional US iOS checkout through Stripe. Stripe collects the payment details you provide to Stripe; we receive identifiers, subscription and invoice metadata, and status information needed to show billing in the app and keep your plan in sync with what Stripe records.
  • Subscriptions (Apple In-App Purchase). On iOS, you may subscribe through Apple In-App Purchase. Apple processes the payment under Apple's terms. We receive signed transaction data and identifiers (for example original transaction id, product id, and renewal or expiration status), including via App Store Server Notifications, so we can unlock the product, show billing status, and handle restore, cancel-at-period-end, and refunds. We do not receive your Apple ID password or the card number on file with Apple.
  • Session with the customer application. In our native iOS and Android apps, we keep sign-in tokens in the device's secure storage (for example, the platform keychain or encrypted keystore) and send authenticated API requests to our customer application backend.
  • Native mobile apps (iOS and Android). Our OneArbitrage apps (bundle identifier com.onearbitrage.customer) connect to the same services described in this policy. Depending on how you use the app, we and our providers may process:
    • Device and app data. Technical data such as device type, operating system version, app version, and network metadata needed to operate the app and diagnose issues.
    • Authentication (system or in-app browser). Sign-in and sign-up open Amazon Cognito Hosted UI in your device's system or in-app browser using OAuth with PKCE. Short-lived OAuth values are handled in that browser context; long-lived tokens are stored in secure storage on the device after sign-in completes.
    • Billing (Apple In-App Purchase and Stripe). iOS subscriptions purchased in the app use Apple's StoreKit; purchase confirmation stays in the App Store sheet. Optional US Stripe checkout and the Stripe billing portal still open in the system or in-app browser. Payment card details for Stripe are entered on Stripe's pages; card details for Apple stay with Apple. We receive Apple and Stripe subscription status as described above.
    • Brokerage reconnect (in-app browser). To refresh a Robinhood connection, the app may open Robinhood's login pages in an in-app WebView. After you authenticate with Robinhood, the app reads session tokens Robinhood stores in that WebView (including access and refresh tokens and a user identifier) and transmits them to our servers so RSA can keep running. We do not store your Robinhood password. Some reconnect flows instead open a hosted page on our marketing origin (for example /refresh-tokens) in the system or in-app browser, with a ?from=app flag as described below.
    • Referral deep links. If you open the app from an invite link (for example onearbitrage://join?ref=), we may store the referral code on the device until your customer account is first provisioned, consistent with our web referral rules.
    • Onboarding and product analytics (Meta). On production app builds, we may use the Meta (Facebook) App Events SDK to measure onboarding steps and subscription actions (such as starting checkout) so we can understand funnel performance and ad effectiveness. We also send matching server events to Meta's Conversions API with a shared event identifier so Meta can deduplicate client and server events. Meta may process device and usage data under its policies. On iOS, we may request permission through Apple's App Tracking Transparency prompt before enabling certain advertising measurement; you can decline and still use the app. Where required by law, we will obtain consent before non-essential measurement.
    • Legal pages opened from the app. When the app opens this marketing site for Privacy, Terms, or similar pages, we may receive a ?from=app query parameter and hold a short-lived flag in browser session storage so in-page navigation stays in an app-appropriate layout. This does not change what account data we collect beyond normal site logging.
  • Mobile app, brokerage link, and RSA. After you sign in, we process profile and account identifiers, subscription state (including from Stripe and Apple), referral fields where applicable, brokerage authorization and connection information your broker shares with us for the link you enable (including session refresh tokens captured from an in-app WebView or hosted reconnect flow; we do not ask you to send brokerage passwords by email), and operational data needed to run and display the RSA workflow on accounts you connect. That can include brokerage account identifiers, order and position information, corporate-action and earnings displays, and logs needed to operate automation, consistent with our agreements and in-product notices.
  • Onboarding survey. When you answer in-product onboarding questions, we store your responses (such as why you signed up, self-reported trading experience, which Robinhood account types you use, IRA preferences, and whether you completed RSA education steps) to personalize onboarding and improve the product.
  • Discord community link. If you connect Discord from the app, we receive OAuth identifiers needed to link your Discord account, verify eligibility for subscriber channels, and sync a Customer role in our Discord server when applicable.
  • Push notifications. If you enable push notifications in our mobile apps, we store an Expo push token and your notification preferences to deliver product messages you opt into.
  • Feedback and abuse prevention. When you submit feedback from Settings, we may use Cloudflare Turnstile to reduce spam; Cloudflare may process IP address and device signals under its policies. We store the message you send and associated account context.
  • Referral payouts (Stripe Connect). If you participate in referral payouts through Stripe Connect, Stripe collects payout and tax information required to pay you; we receive status and identifiers needed to administer the program.
  • Communications you send us. If you contact us (for example by email), we receive the content of your message and associated contact details.

How we use information

We use information for purposes such as:

  • Providing, operating, and improving OneArbitrage, including subscription access in our iOS and Android apps, Stripe- and Apple-backed billing, brokerage-linked RSA automation, and referrals;
  • Measuring onboarding and marketing performance (for example through Google Analytics on the marketing site and Meta measurement on the web and in app builds, as described above);
  • Authenticating you and maintaining secure sessions;
  • Processing referrals and understanding how users discover OneArbitrage;
  • Detecting, preventing, and responding to fraud, abuse, or security issues;
  • Communicating with you about the service and responding to requests;
  • Complying with legal obligations and enforcing our terms.

How we share information

We may share information with:

  • Service providers who assist us under contractual terms that limit use to providing services to us, including: Amazon Web Services (hosting and infrastructure), Amazon Cognito (authentication), Stripe (subscriptions and Connect payouts), Apple (In-App Purchase), Google (Tag Manager and Analytics), Meta (Pixel, App Events, and Conversions API), Cloudflare (Turnstile and related security), Expo (push delivery), and Discord (community APIs when you link your account).
  • Legal and safety recipients when we believe disclosure is required by law, legal process, or government request, or to protect rights, safety, and security.
  • Business transfers in connection with a merger, acquisition, or sale of assets, subject to applicable law.

We do not sell your personal information for monetary consideration. We may use analytics and advertising measurement tools (such as Google Analytics and Meta) that could be considered "sharing" for cross-context behavioral advertising under some U.S. state laws. Where those laws apply, you may opt out by emailing privacy@onearbitrage.com with the subject line "Do Not Sell or Share" and enough information for us to verify your request. We are working on additional in-product and website controls for cookie and advertising preferences; until then, you can also use browser controls, platform ad settings, and the choices described in our Cookie Policy.

Cookies and similar technologies

We use cookies and similar technologies on our public marketing website for preferences (such as theme) and flows described in our Cookie Policy. Our native mobile apps use secure device storage rather than browser cookies for sign-in. Details for the marketing site are described in our Cookie Policy.

Retention

We retain information for as long as necessary to provide the services, comply with legal obligations, resolve disputes, and enforce our agreements. Typical periods include:

  • Account and authentication for the life of your account and a limited period after deletion for backups and fraud prevention.
  • Billing records as required for tax, accounting, and payment disputes.
  • Brokerage tokens and trading logs while your link is active and for a limited period afterward unless you delete your account sooner.
  • Onboarding survey answers with your customer profile unless deleted with your account.
  • Marketing analytics in aggregated or de-identified form according to provider retention settings.
  • Unused accounts that never subscribed may be deleted after we email you twice with the deletion date. Signing in before that date keeps the account. We leave the account in place when you have ever subscribed (Stripe or Apple), when you still have an open position, when you already completed the free first trade, or when a referral payout is still unfinished. Deletion removes your login and the personal product data we hold. Your brokerage account stays open. If you had linked Robinhood, we keep a one-way record that this brokerage identity already used the free first trade, without storing the raw brokerage user id. When a referral or reward record still points at the account, we clear your email and other identifiers and keep the amounts.

Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or export personal information, or to opt out of certain processing (such as "sale" or "sharing" under U.S. state laws, where those terms apply). If you are in the European Economic Area, the United Kingdom, or Switzerland, you may have additional rights under applicable data protection law, including the right to lodge a complaint with a supervisory authority.

To exercise privacy rights, contact us at privacy@onearbitrage.com. We may need to verify your request before responding. An authorized agent may submit a request on your behalf where permitted by law if they provide proof of authorization.

To delete your OneArbitrage account and associated product data, open the app, go to Settings, then use Delete account (type DELETE MY ACCOUNT to confirm). Stripe billing stops when deletion completes. If you subscribed through Apple In-App Purchase, cancel that subscription in your Apple ID settings; deleting your OneArbitrage account does not stop App Store charges. You can also email support@onearbitrage.com for other privacy requests or if you need help, as described on our Contact page.

If we email you that an unused account that never subscribed will be deleted, signing in before the date in that email keeps the account. That notice is separate from Delete account in Settings, which you can use at any time.

Children

OneArbitrage is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us and we will take appropriate steps.

International users

We are based in the United States and may process and store information in the United States and other countries where we or our service providers operate. Those countries may have different data protection rules than your country. If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards for cross-border transfers (such as standard contractual clauses) where required. Contact us for more information about transfer mechanisms.

Contact

For questions about this Privacy Policy or our privacy practices, contact OneArbitrage, LLC at privacy@onearbitrage.com. Mailing address: 5900 Balcones Drive # 33202, Austin, TX 78731.