Privacy
Privacy Policy
Effective Date: 10 October 2026 — This Privacy Policy describes how 0nya collects, uses, and safeguards personal data across our Android mobile application, website (https://0nya.com), and streaming services, and explains your privacy rights and account deletion options under applicable Indian law.
Organization Identity
0NYA PRIVATE LIMITED ("0nya", "we", "us") is the data controller for the 0nya mobile application and website (https://0nya.com). Our registered office is at A 321, 3rd Floor, Master Mind 4 Royal Palms, Aareymilk Colony, Goregaon East, Mumbai - 400065, Maharashtra, India. For privacy inquiries or data requests, contact privacy@0nya.com.
Scope & Applicability
This Privacy Policy applies to personal data collected through the 0nya Android mobile application, the website at https://0nya.com, and associated streaming services. It describes our data practices under applicable Indian law, including the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
Data Categories & Sources
We collect information directly from you, automatically through service use, and through integrated platform services. Directly provided data includes your 10-digit mobile phone number for OTP authentication, self-declared age and terms acceptance confirmations, optional profile display name, and communications sent to support or editorial contacts. Automatically collected data includes playback progress and watch history (to enable Continue Watching across sessions), virtual coin balances and transaction history, filmmaker Chai coin tips, sanitized search queries (with email and phone numbers automatically redacted), app-generated push device identifiers (when notifications are enabled), and operational technical logs (IP address, device model, operating system version). We do not request device GPS or precise location permissions or access your camera, microphone, or contacts. However, advertising services integrated into the app may process IP addresses and related network signals to determine approximate location, such as city or region, for advertising, analytics, and fraud prevention.
Purposes of Processing
We process data to deliver core video streaming, manage user authentication and account sessions, synchronize playback progress across devices, administer virtual coin balances and episode unlocks, process Google Play in-app purchases, present optional rewarded video ads, deliver transactional and release notifications (with your permission), provide catalog recommendations based on interaction signals, offer parental PIN controls, prevent fraudulent abuse, and fulfill statutory tax and legal obligations.
Service Providers & Infrastructure
We do not sell personal data. We utilize third-party infrastructure and service providers to operate, host, deliver, and support the platform: Google Cloud Platform (Cloud Run) for API hosting; Supabase Inc. for database, authentication, and encrypted storage; Mux, Inc. for video encoding and streaming delivery; Twilio Inc. and telecommunications partners for transactional SMS OTP delivery; and Netlify Inc. for website hosting. These providers process technical data in connection with performing their respective infrastructure, delivery, or communication services, subject to their applicable terms, privacy policies, and data processing standards.
Advertising & Privacy Choices
The Android application integrates Google Mobile Ads (AdMob) to provide optional rewarded video ads (allowing viewers to unlock eligible episodes without coins) and occasional short-film interstitials. In connection with ad serving, the Google Mobile Ads SDK may process your device's Google Advertising ID (GAID) and diagnostic data subject to your device settings. Where Google User Messaging Platform (UMP) consent signaling is active, privacy choices can be adjusted via Settings within the app. You may also reset your Advertising ID or adjust ad personalization preferences at any time in Android system settings (Settings > Google > Ads).
In-App Purchases & Billing
In-app purchases of virtual coin packs are processed directly by Google Play In-App Billing. 0nya does not collect, receive, or store credit card numbers, bank account details, or payment credentials. We receive and record Google Play purchase tokens, Google order identifiers, product codes, and timestamps to verify payment validity, prevent duplicate fulfillment, and credit virtual coins to your account.
Data Security Safeguards
We implement reasonable technical and organizational safeguards designed to protect personal information. Network communications between client applications and backend servers use encrypted Transport Layer Security (HTTPS/TLS). On-device session tokens and identifiers are stored within secure application sandbox storage. Server-side databases employ access control barriers, authentication verifications, and database Row Level Security (RLS) policies scoped to the account holder. While we take commercially reasonable measures to safeguard information, no electronic transmission or storage system can be guaranteed to be immune from compromise.
Data Retention Principles
We retain personal data for as long as your account remains active or as necessary to fulfill the purposes described in this policy. Retention duration depends on the nature of the data: active profile and playback records are maintained during account existence, while operational server logs roll off according to routine system cycles. Transaction and billing records necessary for statutory taxation, financial auditing, and fraud investigation are retained as required by applicable laws.
Account Deletion & Retained Records
You may request permanent deletion of your 0nya account through the in-app deletion option (Profile > Delete Account) or by emailing privacy@0nya.com with the subject line "Delete Account". We may verify your identity before processing the request. You may also reference our public web deletion resource at /delete-account. Upon confirmed deletion, your account profile, credentials, watch history, push device registrations, and parental PIN are removed from active databases. Residual copies in standard infrastructure backups expire according to normal backup retention cycles. To satisfy statutory tax, financial accounting, anti-fraud, and creator royalty ledger obligations, purchase and creator tip transaction evidence is retained. In our active databases, direct account identifiers are disassociated (set to null) from these transaction records. However, transaction identifiers, timestamps, or provider references may remain on record for financial reconciliation, legal dispute resolution, and regulatory audit compliance.
Age Eligibility & Children's Privacy
0nya requires individuals to be at least 18 years of age to register an account. During registration, users must affirmatively self-declare that they are 18 or older. Unauthenticated users may browse the public catalog and view select preview content as guests without registering an account or providing an age declaration. Guest viewing does not require account login, but standard technical network requests (including IP addresses, streaming CDN access logs, and local device application state) are processed to serve video content and maintain device playback state. 0nya does not knowingly collect personal identifiable information from children under 18. Content is classified according to Indian OTT self-regulation norms (U, U/A 7+, U/A 13+, U/A 16+, A), and account holders can configure a 4-digit parental control PIN in Settings to restrict mature content on their device. If we discover an account was created by an individual under 18, we will take steps to terminate the account and delete associated personal records.
International Processing
0nya is operated from India by 0NYA PRIVATE LIMITED. Our cloud service providers maintain server infrastructure in India and other jurisdictions, including Singapore and the United States. Technical data may accordingly be transmitted and processed on facilities located outside your country of residence, where data protection standards may differ from those in your local jurisdiction.
User Rights & Choices
Under applicable law, you have the right to review, update, or request the deletion of your personal data held by 0nya. You may also modify notification preferences within application settings or opt out of non-essential communications. To exercise your privacy rights or submit inquiries regarding your data, contact us at privacy@0nya.com.
Policy Changes
We may update this policy periodically to reflect changes in our legal obligations, platform features, or technical practices. Changes will be published on this page with an updated effective date. Effective Date: 10 October 2026.
Grievance Officer & Contact Information
In accordance with the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the designated Grievance Officer for 0NYA PRIVATE LIMITED is Jitesh Pathak. For content, user conduct, or privacy grievances, you may contact the Grievance Officer at grievance@0nya.com or by physical mail to our registered office: 0NYA PRIVATE LIMITED, A 321, 3rd Floor, Master Mind 4 Royal Palms, Aareymilk Colony, Goregaon East, Mumbai - 400065, Maharashtra, India. Grievances are acknowledged and processed within statutory timelines established under applicable Indian rules.