Q.01Is Onelo a Supabase alternative?
No — Onelo isn't a database. Supabase hands you an empty Postgres plus auth primitives, then leaves you to build the login screen, the password-reset flow and the email wiring — on every platform, one at a time. Onelo gives you ready-made modules (auth, paywall, waitlist, feature flags) you drop in: a hosted, branded sign-in and reset page you never build, the same SDK on web, iOS, Android, Flutter, RN and Electron, and social sign-in that works the second you toggle it on.
Q.02I already use Lovable / Bolt / Cursor. How does Onelo fit?
Your AI builder generated the UI and frontend logic. It probably stubbed out "sign in" and "pay now" buttons with placeholders. Onelo replaces those stubs with real auth, real Stripe checkout, real feature flags — without you writing any backend. Drop in the Onelo SDK for your platform, paste the API key, and the stubs become real.
Q.03Is the free tier actually free?
Yes. 1 app, 5 000 MAU, 500 waitlist entries, 7-day retention. No credit card, no trial countdown — it stays free as long as you stay under those limits. We make money on a transaction fee on actual sales, so if you earn nothing, you pay nothing.
Q.04Why do you take a cut of my sales?
Because the alternative is charging you upfront, before you've earned a cent. We keep the free tier generous and only make money when you do: 7% on Free, dropping to 2% on Pro and 1% on Business as you scale. For example, once you're doing ~€580/mo in sales the 7% Free fee passes the €29 Pro price — so moving up pays for itself. You upgrade when you're winning, not when we feel like charging you.
Q.05What happens when I hit my MAU cap?
Each plan has a hard monthly-active-user cap — 5 000 on Free, 25 000 on Pro, 100 000 on Business — and we'll email you as you get close. When you actually hit it, the users already active keep working, but new sign-ups are blocked until you upgrade. We'd rather tell you that straight than pretend there's no limit and surprise you later.
Q.06How do I actually get paid? Who handles VAT?
You do — directly. Onelo never holds your money: payments run through your own Stripe account (Stripe Connect), so you're the merchant of record and Stripe pays you out on your own schedule. We take the platform fee per sale (7% / 2% / 1%) and never touch the rest. VAT and sales tax are legally yours to remit — but we hand you the tooling (VAT calculation, VIES checks, OSS thresholds, invoice export) so you have the numbers. We are deliberately not a Merchant of Record like Lemon Squeezy or Paddle — your Stripe, your money, your control.
Q.07Do I need to host a backend?
No. Onelo runs the API. You install one SDK in your app (web, iOS, Android, Flutter, RN, Electron — same package). Hosted auth pages, paywall checkout, waitlist forms — all served by us.
Q.08Is it secure? Where is my data?
Passwords are bcrypt-hashed (cost 12) — never stored in plain text. On iOS/macOS, Android, React Native and Electron your users' tokens live in the OS secure store (Keychain / EncryptedSharedPreferences / safeStorage); on the web they're in localStorage, same as Supabase's and Firebase's web SDKs — we won't pretend that's hardware-encrypted. Data is hosted in the EU (Supabase on AWS, Paris region). Sessions rotate with reuse-detection, IPs are stored hashed — never raw — and every tenant is isolated by row-level security.
Q.09Who owns my data — can I export it and leave?
You do. Per our terms you keep all rights to your content and your end-users' data — you're the controller, Onelo is only the processor. You can export your waitlist, form submissions, transactions and consent records as CSV from the dashboard today. Straight talk: there's no one-click "export everything" or end-user-list export yet — if you're leaving and want all your data back, we return it on request (a contractual promise, not yet a button). We're building the self-serve version.
Q.10Why no SSO / SAML / enterprise plan?
We're built for solo devs and indie teams, not enterprise procurement. If you need SAML and SLAs, you're not our customer (yet) — and that's fine. We'd rather be the best tool for indie devs than a mediocre tool for everyone.
Q.11Who's behind Onelo — will it still be here in a year?
One person: Adrian Magiera, a solo developer in Wrocław, Poland — no company behind it, and our legal docs say so plainly. Fair thing to ask about anything handling your auth and payments. Two honest answers to the "what if it disappears" fear: the client SDKs are open source on GitHub, so they don't vanish if we do; and payments run through your own Stripe, so your revenue never depends on us staying alive. The backend is closed-source and hosted by us — that part, you're trusting us with.
Q.12Can I cancel anytime? Refunds?
Cancel any time, no hoops — the free tier is the trial, so you try before you ever pay. Because of that we don't refund paid time you've already used: you cancel and keep access until the period ends. No lock-in contracts.
Q.13How long does it actually take to integrate?
The wiring is the easy part — the rest is just reading docs. You install the SDK for your platform, paste your API key, and drop in the hosted sign-in: no backend to stand up, no login screen to build, no OAuth keys to register. The same package works on web, iOS, Android, Flutter, RN and Electron. We won't pretend it's "one line" — you'll wire a few things and read some docs — but you are not building auth flows or payment plumbing from scratch, and that's where the days normally go.
Q.14If I leave, can I take my users with me?
Straight talk, because this is the real fear with any auth provider — they're your users, it's your app, and you should be able to walk out with them. Today you can export your waitlist, form submissions, transactions and consent records as CSV from the dashboard. Full end-user account export is being built right now — a one-click export of your user list, with password hashes available through a separately secured, audited flow so your users can keep their existing passwords instead of all being forced to reset. It isn't shipped yet, so we won't pretend the button is there today — but it's in active development, not a vague someday. Two things already true that kill the lock-in: the client SDKs are open source on GitHub, and your paying customers live in your own Stripe account — that relationship is yours no matter what happens to us.
Q.15If your backend goes down, are my users locked out of my app?
Fair question — auth is a hard dependency, so we won't hand-wave it. Sessions are short-lived JWTs held in the device's secure store, so a brief outage doesn't kick anyone out: an already-signed-in user keeps working off their cached token. The honest limit: access tokens last about 15 minutes and renewing one needs our API, so a prolonged outage will eventually log active users out at refresh time, and new sign-ins are blocked until we're back. We don't publish a status page yet and we're a small team being upfront about that trade-off rather than promising an SLA we can't back.