Privacy Policy for Onus
Last updated: 29 August 2026
1. Introduction
This privacy policy explains how Brunyee Software Studio (“we”, “us”, “our”) collects, uses, and protects your personal data when you use Onus (the “Service”), a website accessible to users in the United Kingdom.
We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who We Are
Onus is owned and operated by Brunyee Software Studio.
If you have any questions about this policy or how we handle your data, contact us at:
Email: contact@brunyeestudio.com
3. Information We Collect
We collect the following categories of information:
3.1 Account Information
- Email address — collected when you sign in via Google Sign-In. We do not collect passwords, as authentication is handled entirely by Google.
We do not collect any special category (sensitive) data, such as data relating to health, race, religion, sexual orientation, or biometric data.
3.2 Usage Data
Information about how you interact with the Service, such as pages visited, features used, and session duration.
3.3 Location Data
Approximate location data (typically derived from your IP address), used for analytics purposes only. We do not collect precise GPS location.
3.4 Device Information
Information about the device and browser you use to access Onus, such as device type, operating system, and browser type.
We do not use cookies or similar tracking technologies to collect this information.
4. How We Use Your Information
We use the information we collect to:
- Authenticate you and provide access to your account
- Operate, maintain, and improve the Service
- Understand how users interact with Onus through analytics
- Detect, prevent, and address technical issues
We do not use your email address for marketing, newsletters, or any purpose other than authentication.
5. Legal Basis for Processing
Under UK GDPR, we rely on the following legal bases:
| Data | Purpose | Legal Basis |
|---|---|---|
| Email address | Authentication and account access | Performance of a contract (Article 6(1)(b)) |
| Usage data, location data, device information | Analytics and service improvement | Legitimate interests (Article 6(1)(f)) |
Where we rely on legitimate interests, we have considered that this processing is proportionate, has a minimal privacy impact, and is something you would reasonably expect given your use of the Service.
6. Sharing Your Information
We share limited information with the following third parties, who act as independent data controllers or processors for their own purposes:
- Google (Sign-In) — used to authenticate your account. Google processes your sign-in information in accordance with the Google Privacy Policy.
- Google Analytics — used to collect usage, location, and device data for analytics purposes.
- PostHog — used to collect usage, location, and device data for analytics purposes.
We do not sell your personal data to third parties, and we do not share it for advertising purposes.
7. International Data Transfers
Onus itself is hosted on servers located in the United Kingdom.
However, some of our third-party analytics providers (Google Analytics and PostHog) may transfer data outside the UK, including to the United States, as part of their own infrastructure. Where this occurs, those providers are responsible for ensuring appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or adequacy-based mechanisms, in accordance with UK GDPR.
8. Data Retention
We retain your personal data only for as long as your account remains active.
If you delete your account, your email address and associated account data are deleted immediately and are not retained by us.
Usage, location, and device data collected via analytics tools is retained according to the default retention settings of those tools, which you may wish to configure separately.
9. Data Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Authentication is handled by Google, which maintains its own industry-standard security practices.
10. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data (the “right to be forgotten”)
- Restrict processing of your data in certain circumstances
- Object to processing based on legitimate interests
- Data portability — receive your data in a structured, machine-readable format
To exercise any of these rights, contact us at contact@brunyeestudio.com. Since we hold minimal data, most requests can be actioned by deleting your account directly within the Service.
11. Children's Privacy
Onus is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us so we can delete it.
12. Changes to This Policy
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated “Last updated” date.
13. Complaints
If you have concerns about how we handle your personal data, please contact us first at contact@brunyeestudio.com so we can try to resolve the issue.
You also have the right to lodge a complaint with the UK's data protection regulator:
Information Commissioner's Office (ICO)
Website: https://ico.org.uk
Helpline: 0303 123 1113
14. Contact Us
If you have any questions about this privacy policy, please contact:
Brunyee Software Studio
Email: contact@brunyeestudio.com