Privacy Policy

1. Who we are

OIOA – One India One App (“OIOA”, “we”, “us”) is operated by [LEGAL ENTITY NAME], a [e.g. Private Limited Company / LLP / Sole Proprietorship] with its registered office at [REGISTERED ADDRESS, CITY, STATE, PIN] ([CIN / registration number, if any]).

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for the personal data described in this policy. You, the person whose data it is, are the Data Principal.

This policy applies to the OIOA app on Android and iOS (the “App”) and to the website at oneindiaoneapp.com (the “Website”), together the “Services”.

2. The laws we follow

We process personal data in accordance with:

• the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified on 13 November 2025, with obligations commencing in phases; we aim to meet them in full now, ahead of their commencement dates);
• the Information Technology Act, 2000, and, for as long as they remain in force, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”); and
• the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“IT Rules”), including their grievance-redressal requirements.

3. Summary

• Calendar calculations happen on your phone. Panchang, muhurat windows, prayer times, Qibla and the community calendars are calculated on your device. Showing you today’s timings does not require sending your location to us.
• We ask for consent before collecting personal data that isn’t needed to run the Services, and you can withdraw consent at any time, as easily as you gave it.
• We do not sell personal data.
• Contacts, location and birth details are optional. The App works without them, with fewer features. OIOA never uploads your address book.
• Children under 18 may use the App only with the verifiable consent of a parent or lawful guardian.
• You have rights to information, correction, erasure, grievance redressal and nomination. Section 10 explains how to use them.

4. What we collect, why, and where it’s processed

Note for review: items marked [confirm] must be checked against how the App is actually built before publication.

We do not knowingly collect financial account details, passwords for other services, biometric data, health records or official identity documents through the Services.

Some of the data above, such as birth details and information about religion or community that may be inferred from your settings, can be sensitive for you. We treat all of it with the same care as sensitive personal data, and we never use your choice of community to profile you for advertising.

5. Lawful basis: consent and legitimate uses

We process personal data on the basis of your consent (DPDP Act, section 6) or, where the law allows, for certain legitimate uses (section 7), such as data you voluntarily provide for a specific purpose, like a feedback form, or where processing is needed to comply with law.

Before we ask for consent, we give you a notice (section 5) describing the data and the purpose. Consent is requested separately for optional features, including location, contacts and notifications, so you can say yes to one and no to another.

Withdrawing consent. You can withdraw consent at any time:

• in your phone’s settings, by turning off a permission (location, contacts, notifications);
• in the App, by deleting a profile, a family member, a group or your account [confirm in-app controls]; or
• by writing to the Grievance Officer (section 11).

Withdrawing consent doesn’t affect processing done before you withdrew it. After withdrawal, we stop the processing and erase the data unless the law requires us to keep it. Some features may stop working.

Consent managers. Where you use a Consent Manager registered with the Data Protection Board of India, we will honour consent given, reviewed or withdrawn through it.

6. Phone contacts: what OIOA does and doesn’t do

OIOA does not upload your address book and does not use it to find or match people.

Contacts permission is used for one optional feature: phone contact export of a Family’s or Group’s shared contact list.

1. You turn on export for a particular Family or Group. It is off by default and is set separately for each one.
2. Your phone asks for Contacts permission. OIOA needs it to add the shared entries and to find the entries it added earlier.
3. OIOA adds the shared contacts to your phone’s Contacts app. Each entry carries an OIOA tag.
4. When a shared contact changes, OIOA replaces its own tagged entry. When a contact is removed from the list, or you leave the Family or Group, OIOA removes its own tagged entry on the next successful sync.
5. Before changing or removing any entry, OIOA checks its tag, so contacts you saved yourself are never read into OIOA, changed or deleted. An incomplete download is never treated as an instruction to delete.
6. If you turn export off, entries already on your phone are left unchanged. You can delete them yourself in your Contacts app.

You can withdraw Contacts permission at any time in your phone’s settings. Shared contact lists themselves contain details of people who have not necessarily signed up to OIOA. Please add someone’s details only where they would be comfortable with your Family or Group having them. We do not use shared contacts for advertising and do not sell them.

7. Advertising

The App may show advertisements through Google AdMob. AdMob may use device identifiers and similar technologies to deliver, limit and measure ads, and, where you have permitted it, to personalise them.

• On iOS, personalised ads require your permission under Apple’s App Tracking Transparency.
• On Android, you can reset or delete your advertising ID, or opt out of ads personalisation, in your device’s Google settings.
• Some card background collections can be unlocked by choosing to watch a rewarded video ad. This is optional; free designs always remain available.
• [confirm] We configure AdMob so that no personalised or behaviourally targeted advertising is shown to users we know to be under 18, as section 9(3) of the DPDP Act requires.
• Ads are never targeted using your choice of community, your birth details, your contacts or your family or group data.

8. Who processes data for us

We use the following processors. Each processes personal data only on our instructions, under contract, and with appropriate security safeguards.

If we add or change a processor, we’ll update this table.

9. Retention and erasure

We keep personal data only as long as it’s needed for the purpose it was collected for, or as the law requires, then erase it. In particular:

• When you withdraw consent or delete data, we erase it within [30] days, except where the law requires us to keep it.
• When you delete your account, we erase your account data and the content you created within [30] days, and from backups within [90] days [confirm backup policy].
• Inactive accounts. If an account has not been used for [three years], we will tell you at least 48 hours before erasing it, so you can keep it by signing in.
• Logs that the DPDP Rules require us to retain are kept for at least one year, then erased unless another law requires longer.

10. Your rights as a Data Principal

Under the DPDP Act you have the right to:

• Information (section 11): a summary of the personal data we process about you, the processing activities, and the identities of others with whom it has been shared, with a description of what was shared.
• Correction, completion, updating and erasure (section 12): to correct inaccurate or misleading data, complete incomplete data, update data, and erase data no longer needed, unless the law requires us to keep it.
• Grievance redressal (section 13): to have a complaint about our handling of your data resolved by us, and if you’re not satisfied, to complain to the Data Protection Board of India.
• Nomination (section 14): to nominate another person to exercise your rights if you die or become incapable of doing so.

How to make a request. Write to the Grievance Officer at [grievance@oneindiaoneapp.com], or use the in-App option [confirm]. Tell us which right you want to use, and give enough detail for us to find your data, such as your OIOA-ID or sign-in phone number or email. We may need to verify your identity before acting. We will acknowledge your request within 24 hours and respond within 15 days.

Your duties (section 15) include not providing false information, not impersonating anyone, and not filing frivolous complaints.

11. Grievance Officer

In accordance with the IT Rules and the DPDP Act, our Grievance Officer is:

Designation: Grievance Officer
Email: [grievance@oneindiaoneapp.com]
Address: [LEGAL ENTITY NAME], [REGISTERED ADDRESS, CITY, STATE, PIN]

Complaints are acknowledged within 24 hours and resolved within 15 days of receipt. See the grievance redressal page for the full process.

12. Children

The Services are intended for adults. A child (anyone under 18) may use the App only with the verifiable consent of a parent or lawful guardian, as section 9 of the DPDP Act and rule 10 of the DPDP Rules require.

• When we know or have reason to believe a user is under 18, we take reasonable steps to verify that the person giving consent is an adult parent or lawful guardian, using reliable details we already hold, details provided voluntarily, or a virtual token issued by an authorised entity. [confirm age-gate and verification flow]
• We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.
• We do not process children’s data in a way likely to cause any detrimental effect on their well-being.

If you believe a child has provided data without valid consent, please contact the Grievance Officer and we will erase it.

The same verifiable-consent requirement applies to persons with disabilities who have a lawful guardian.

13. Security safeguards

We take reasonable security safeguards to prevent personal data breaches, including:

• Encryption of data in transit (TLS) and at rest within our processors’ infrastructure;
• Access control: only authorised personnel who need data for their work can access it, under confidentiality obligations;
• Security rules restricting each user’s data to that user and the people they choose to share with;
• Logging and monitoring to detect and investigate unauthorised access;
• Data minimisation: calculating on your device wherever possible, so less data leaves it;
• Regular review of these measures, documented in an information security policy as the SPDI Rules require [confirm document exists].

No system is completely secure. If you believe your account has been compromised, please contact us immediately.

14. Personal data breaches

If a personal data breach occurs, we will:

• inform each affected Data Principal without delay, in plain language, describing the breach, its likely consequences, what we’re doing about it, safety measures you can take, and how to contact us; and
• inform the Data Protection Board of India without delay, and give it a detailed report within 72 hours of becoming aware of the breach (or any longer period the Board allows), as the DPDP Rules require.

15. Cross-border transfer

Some of our processors store or process data on servers outside India. The DPDP Act permits transfer of personal data outside India except to countries the Central Government restricts by notification. We will not transfer personal data to any restricted country, and we will follow any conditions the Rules set for such transfers. The Website’s request form is processed in Google Cloud’s Mumbai region (asia-south1). [confirm Firestore region for App data]

16. The Website

The Website does not use cookies or similar tracking technologies by default. If we enable privacy-friendly, cookieless analytics, it will measure visits in aggregate without identifying you. See the cookie notice. If you submit the request or feedback form, see section 4 for how that data is handled.

17. Changes to this policy

We may update this policy as the Services or the law change. We’ll show the date of the latest version at the top of this page and keep a version history below. For material changes, we’ll tell you in the App before they take effect and, where the law requires, ask for your consent again.

18. Contact

Questions about this policy: [contact@oneindiaoneapp.com]. Requests and complaints: the Grievance Officer at [grievance@oneindiaoneapp.com].

Related: Terms of Use, Disclaimer, shared contacts, explained plainly and offline use.