Privacy Policy

Last updated: 28 September 2026 · OZVAK, a private network for Indian adults

This page is written to be read against the code. Where it says we hold something, we hold it. Where it says nobody routinely looks, that is a description of how the system is built and who has keys, not a promise that nothing can ever be opened. The places where something can be opened are listed, with the reason each one exists.

OZVAK is operated by [OPERATOR LEGAL NAME], published on Google Play as [DEVELOPER NAME AS SHOWN ON GOOGLE PLAY], and is the Data Fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023.

What being private on OZVAK means, exactly

Other members see an alias, your Current, the age band you fall in, and your city. They do not see your email address, your date of birth, your full photo, or your name, because we never ask for your name. A photo opens to one person only when both of you have chosen it.

OZVAK itself knows who you are to the extent of your sign-in address. Privacy here is protection from other members and from the outside world. It is not protection from us, and we are not going to pretend otherwise. A sign-in code proves that you control an inbox at that moment. It proves nothing about your identity, your age, or whether you hold one account or several.

What we collect in the app

Your email address. Held in our authentication system, used to send a six-digit sign-in code and, if you turn them on, the notifications you choose. Never shown to another member.
Your date of birth. Stored as a date. Other members see only the age band it falls in. If a date under 18 is entered, no profile is created, the year that was entered is recorded, and a one-way value derived from the address is locked for 365 days so that address cannot start again. The lock holds the hashed value and two timestamps, and nothing else.
A record that you confirmed you are an adult. The exact sentence you agreed to, when, and on which build. It is a record of what you were shown and accepted. It is not an age check and we do not describe it as one.
Your Current and your profile. What you want right now, the dials you set, the answers you hold, your alias, the short text you write, who you are open to meeting, and your city. Your city is a value you choose from a list. We read no location from your device: the app asks for no location permission and stores no coordinates.
Your photo. Stored in a private bucket. It is not released to anyone until two things are true: an automated check has passed it, and both you and one specific person have chosen to reveal to each other. If the automated check is not running, the photo is not released. See Photos below.
Your messages. See Messages below, because a single line would overstate it.
Intros, Rooms and reveals. Who approached whom, whether it was accepted, when a Room opened, when each side chose to reveal.
Reports and blocks. The category you pick, any detail you type, the message or photo you name, and both account ids.
Notification preferences and a device token, if you turn any notification on. All six are off by default.
Whether you hold a Pass or a Membership, and the receipt events Google Play sends us. We never receive your card, bank or UPI details.
Crash and error reports from the app. See Where your data is processed.
Technical logs. Which account made which request, when, and from which network address. These never contain the text of a message or a photo.

What we collect on this website

If you keep a Current here before the app is open in your city, we store the email address you give and the answers you chose to keep. This website sets no advertising or analytics cookies. If you tick “keep me signed in”, a session is stored in your browser and nowhere else.

Messages

Messages on OZVAK are screened by our systems and are not encrypted in a way that keeps them from our servers. This is a decision we made on purpose, and the reasons are: the product is used on shared devices, where a key stored on the device is a key someone else can find; and screening for threats, scams and abuse has to happen somewhere an abuser does not control. The price of that decision is that the honest sentence is “nobody routinely reads this”, and never “nobody can”.

What happens to a message, in order:

Before it is stored, automated rules check it for contact details, payment handles, links and a short list of blocked phrases. A message that fails is refused and nothing is kept except the rule that refused it and the time.
It is then stored encrypted at rest, under a key held in our server-side vault, and queued. It is not shown to the other person yet.
An automated screen reads it before delivery. Today that screen is rule-based. A machine-learning screen for threats, harassment and abuse is designed to run in Mumbai; when it is switched on, this page will name the processor and the region before it processes a single message.
It is delivered, or it is refused with the rule shown to you. A refused message is visible to you for 7 days and then removed.
A delivered message lives for 90 days, or 30 days after the Room is closed, whichever comes first, and is then removed.

Who can open a conversation. Nobody, in the ordinary course of running OZVAK. There are three exceptions, and each one leaves a record:

A report. If someone reports a message, the person who handles reports can read the reported message and the conversation behind it, to decide what to do.
A lawful request. Indian law can require us to hand over information to a court or to a lawfully authorised government agency, in some cases within 72 hours of a written request. Where that happens, we produce the minimum the order asks for and record what was produced, to whom, and when. Where the law allows it, we tell you.
A logged emergency opening. Anything not reached through a report or an order can be opened only with a written reason, a named legal basis from a fixed list, and a case reference, written to an append-only record before the read is served. There is no “curiosity” entry on that list.

Photos

Every photo you upload lands in a quarantine area that no member, including you, can be served from. It moves to a servable area only when an automated check has passed it, and the move is refused by the database itself without that pass. It is then shown to one person, once you and that person have each chosen to reveal, and to nobody else. A Room, an Intro, or a conversation on its own opens nothing.

What we cannot do: stop the person you revealed to from photographing their screen. No app can. Sharing a photo you received on OZVAK without the consent of the person in it is a criminal offence in India even though they chose to show it to you, and our Guidelines say so in plain words.

How we use what we hold

To sign you in, with a code sent to your address.
To keep OZVAK for adults, using the date of birth and the confirmation you gave.
To show your Current to people who want something compatible, in your city, and theirs to you.
To open a Room when both of you choose, deliver messages, and open a photo when both of you choose.
To screen messages and photos for the harms listed above.
To act on reports and blocks, and to keep a block working if either of you comes back later.
To honour a Pass or a Membership that Google Play tells us you bought.
To fix crashes and keep the app working.
To meet the retention and disclosure duties Indian law places on us, listed below.

We use your data for these purposes and no others. We do not sell it, share it with advertisers, build an advertising profile from it, or use it to train anything that is shown to other members. Nothing about the combination of your city, who you are, and who you are open to is ever sent to a third party or published, because in a small city that combination can be one person.

Where your data is processed, and who processes it

Naming only the database region would be accurate about the database and misleading about the whole. This is the whole:

Database, authentication, photo storage and message screening: Supabase, in Mumbai, India (the ap-south-1 region of our database provider). Everything listed under What we collect lives here.
Crash and error diagnostics: Functional Software, Inc. (Sentry), on infrastructure in the United States, and not in India. What goes: device and operating system identifiers, app version, the sequence of screens and calls that led to the crash, your network address, and whatever personal data happens to be inside the failing request. The app is configured not to attach your identity to a report and not to record your screen. We say this because it is true, and because pretending an error payload can never contain personal data is the failure mode. We intend to move this processing to the European Union. Until that is done this line names the United States, and on the day it is done this line changes.
Sign-in and notification email: Resend, Inc., on infrastructure outside India. What goes: your address, the code, and the notification text.
Serving the app itself: Base44, on infrastructure outside India. The app you use is built and served on their platform, and their own code runs inside it. On every screen you open it sends them the name of that screen, together with your network address and the ordinary details any web request carries. It does not send them anything you write, who you are talking to, or any answer you gave.
We name them here for two reasons. Their code is part of the page, so we cannot switch this off from our side while the app is served this way. And we treat what reaches them as shared with another company rather than merely handled on our behalf, which is the more cautious of the two readings and the one we would rather be wrong in. Moving the app off their platform is the fix, and it is the reason we intend to.
Performance and error monitoring inside that platform: Datadog, on infrastructure in the United States. This runs because Base44 puts it in the page, not because we asked for it, and like the line above we cannot remove it while the app is served this way. We found it by listing what the page contacts rather than by being told, and we are naming it the day we found it.
What goes, on every session: the screens you open, your network address, errors, and how long things took. What does not go, which we checked rather than assumed: it is configured not to record your screen and not to track what you click.
Push notifications on Android: Expo (650 Industries, Inc.) and Google, on infrastructure outside India. What goes: a device token and the notification text, which is written to say nothing about what the app is on a lock screen.
Purchases: Google Play Billing, under Google's own terms and privacy policy. Google is the merchant of record. We receive the fact and the receipt.

Personal data may therefore be processed outside India. The DPDP Act permits this unless the Central Government notifies a restriction for a particular country. If such a restriction is notified for any country above, we will stop that transfer.

How long we keep things

Every period below is a value in our configuration, not a guess, and it is the same value the deletion routine reads. While your account is active:

Your profile, Current, photo, answers and preferences: for as long as the account exists.
Messages: 90 days, or 30 days after a Room closes.
Refused messages: 7 days, visible to the sender only.
Reports, the records around them, and trust events: 365 days.
Blocks: for as long as either account exists, and beyond, so that a block keeps working.
Technical logs: 180 days. From 13 May 2027, Indian data protection rules require one year, and this line will say one year from that date.
Purchase ledger rows: 8 years, because tax law says so.

When you delete your account

You can delete from Settings in the app, or from this website, and both run the same routine. It is not “gone in one action”, because Indian law does not allow that, and the honest description is in three parts.

What goes, now

Your Current is withdrawn, pending Intros are withdrawn, your Rooms are closed, your photo record, answers, preferences and date of birth are deleted, your profile is blanked, your Pass or Membership entitlement is switched off, and every message you sent is replaced with a tombstone on both sides. The person you were talking to keeps the shape of the Room with “Message deleted” where your words were, and no longer sees your alias, photo or age.

What we must keep, and for how long

A sealed registration record for 180 days: your account id, your sign-in address, the day the account was created, the day it was deleted, the region value on the account, and the record of the adult confirmation you gave. Rule 3(1)(h) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 requires it. No product screen can read it.
Your account row, marked deleted, and your sign-in address in our authentication system for 365 days, after which both are removed by a scheduled job. This is longer than the sealed record above, and it exists because of an unresolved reading of DPDP Rule 8(3), which requires personal data and logs of processing to be kept for one year “even if X deletes her account”. If counsel lands on the narrower reading, this period shortens and this line changes.
The photo file itself, until a separate storage process removes it. Your photo record is deleted in the same request as everything else, and from that moment no member and no screen can be served the file. The file is not removed by the database: our storage layer refuses deletions made from inside the database, so a worker that goes through the storage provider's own interface lists files that no longer belong to any account and removes them. We do not print a date for that removal, because the code does not keep one, and we will not print a schedule until that worker is running on one.
Any report that names your account, on either side, sealed for 365 days, so that evidence someone filed is not erased by the person it was filed about closing their account.
The originals of the messages you sent, sealed for 30 days. This exists for one reason: so that a person you spoke with can still report something you said after you leave, and so that a lawful request can be answered. It has no product read path; it can be opened only against a specific report or a legal process, and every opening is recorded. The length of this period is under review by counsel and may change.
Blocks you made or received, so a person you blocked stays blocked if you both come back.
Purchase ledger rows, for the tax period above. They hold the provider, the event, the amount and the account id, and no payment instrument.
Technical logs, to their own expiry above.
If you were removed for breaking the rules, the record of that removal, keyed to a one-way value derived from your sign-in address, so that the removal holds if the same address returns. If you were not removed, no such record exists.

What we cannot reach

Anything anyone saved to their own device: a screenshot, a photo of the screen, text copied out. If something of yours is being shared without your consent, do not delete first. Report it, because reporting is what lets us act, and deleting first tombstones the evidence you would need.

Your rights

Access. Ask what we hold about your account, and which processors above have received any of it.
Correction. Edit your Current, profile and preferences in the app at any time. Your date of birth can be corrected a limited number of times, because it is the age gate.
Erasure. Delete your account yourself, subject to the retentions above.
Withdraw consent. Turn off any notification, or delete your account, at any time. Withdrawing consent does not affect what was lawfully done before.
Nominate. The DPDP Act lets you nominate someone to exercise these rights if you die or cannot act. Because of what this product is, we will not hand a nominee your Rooms or your messages by default; we will act on the nomination to delete. This is our reading and it is under legal review.
Grievance. Raise it with our Grievance Officer first, on the Grievance page. The Act requires you to give us that chance before approaching the Data Protection Board, and we acknowledge within 24 hours and resolve within 7 days.

Consent, and the basis for processing

We process your personal data on the basis of the consent you give when you create an account and each time you turn a feature on, for the purposes listed on this page and no others, and we collect only what those purposes need. Two things are not consent-based: keeping the records Indian law compels after deletion, and answering a lawful order. Both are described above rather than hidden in a clause.

If a breach of your personal data occurs, we will notify you and the Data Protection Board of India as the Act requires, and India's CERT-In within the time its directions set. Our data protection contact is [GRIEVANCE OFFICER FULL LEGAL NAME], at privacy@[LEGAL DOMAIN].

Children

OZVAK is for adults. We do not knowingly hold personal data about anyone under 18. If a date of birth under 18 is entered, no profile is created and the address is locked as described above. If we learn that a member is under 18, the account is removed from every surface on suspicion and the records are preserved for the authorities. Our Child Safety Standards page says what we do and who to contact.

Google Play Data Safety

This page is written to agree with our Google Play Data Safety declaration. In short: we collect an email address, a date of birth, an adult confirmation record, the profile and Current you write, your chosen city, a photo, messages and their metadata, Intro and Room events, reports and blocks, notification preferences and a device token, purchase receipts, crash diagnostics and technical logs. We collect no location, no contacts, no name, and no payment instrument. Data is not sold and is not used for advertising. You can delete from Settings or from this website.

Changes

When what we collect or what we do with it changes, this page changes and the date at the top moves. For a significant change we tell you in the app before it takes effect. At least every three months we also remind members of the rules and of what happens when they are broken, because the IT Rules 2021 require it.

Contact

Privacy questions and data requests: privacy@[LEGAL DOMAIN]. Formal complaints: the Grievance page, which names the person who answers.