Privacy Policy
Last updated July 5, 2026
On The Go (“On The Go”, “we”, “us”) is an agency operating platform provided by Above The Fold. This policy explains what we collect, how we use it, and the choices you have. It covers both agencies that use our studio and the clients they serve through branded portals.
Information we collect
Account data. Names, email addresses and hashed passwords for agency team members and client users. Passwords are stored only as bcrypt hashes and are never readable by us.
Agency and brand content. Content items, captions, media links, reports, meeting notes, campaigns and requests that agencies create for the brands they manage.
Connected social account tokens. When an agency connects a Meta (Facebook and Instagram) or Google (Search Console and Analytics) account for a brand, we receive access and refresh tokens from that provider so we can read the assets the agency selects.
Usage data. Basic activity logs (who did what and when) used to power audit trails inside the studio.
How connected account tokens are stored
Access and refresh tokens are encrypted at rest using AES-256-GCM before they are written to our database. Encrypted token material is never returned through any API response or rendered in any interface. Only the assets you explicitly select (for example a specific Instagram account or GA4 property) are used on your behalf.
Connections live at the agency level. Only members of the agency that created a connection can view, manage or disconnect it. Clients never see or manage provider connections.
How we use information
We use the data above to operate the platform: to authenticate users, scope every agency and client to only their own data, publish and report on the assets an agency manages, and provide support. We do not sell personal data, and we do not use connected-account data for advertising.
Data isolation
Every agency is a separate tenant. Users can only see their own agency’s brands, team, content and connections, and every client can only see the brand they are bound to. These boundaries are enforced on the server for every request.
Disconnecting and deleting your data
You can disconnect any Meta or Google account at any time from the brand’s Connections tab in the studio. Disconnecting deletes the stored encrypted tokens for that connection. To request full deletion of an account and its data, see our Data Deletion page.
Contact
For any privacy question or request, email hello@onthego.agency.
Questions? Email us at hello@onthego.agency.