Privacy Policy

Last updated 27 September 2026 · Applies to the OneMessage mobile app and this website.

1. Who we are

OneMessage is a volunteer-run service that coordinates Sehri, the pre-dawn meal during Ramadan, for residents of the neighbourhoods we serve in Bangalore, India. The app lets residents say whether they need food each night, follow the delivery on a live map, read prayer times and Qur’an, and talk to their zone’s group.

In this policy, “we” and “us” mean the OneMessage volunteer team, who act as the controller of the personal data described below. You can reach us at onemessagedev@gmail.com.

2. What we collect and why

We collect only what a particular feature needs. If you never use a feature, we hold nothing from it.

What we deliberately do not collect

• No advertising identifiers and no advertising of any kind.
• No analytics or crash-reporting SDK, and no third-party tracker.
• No contacts, photos, microphone, camera roll or calendar access.
• No payment credentials. We never handle your money — UPI does.
• No location at all from ordinary residents. Only your building, which you choose from a list at registration.

3. Location data

If you are a resident, the app never reads your device location. Your address comes from the building you pick at registration, nothing more. The live map you see during a delivery shows the volunteer moving toward your building — it does not track you.

If you are a delivery volunteer, the app shares your device location while you are on a round, so residents can see their food coming and get an accurate arrival time. Specifically:

• It starts only when you tap Start delivery, and stops when you tap stop or sign out.
• It continues while the screen is off, because the phone is in your pocket while you ride. On Android this is shown by a permanent notification for the whole round; on iOS the status bar shows the location indicator. It is never silent.
• A position is sent about every 30 seconds.
• Only your current position is kept. We do not keep a history of where you have been, and each new reading replaces the last.
• It is visible only to residents your team is delivering to that night, and to admins. It is never shared outside the app.

4. Notifications

If you allow notifications, your device gives us a push token, which we store against your account. A token identifies a device for delivery purposes; it is not a tracking identifier and it tells us nothing about what you do on your phone.

We send notifications only for:

• the nightly poll opening,
• a delivery round starting in your zone,
• your own food being a few minutes away,
• announcements from your zone admin or a super admin.

Tokens are passed to Expo’s push service, which hands them to Apple or Google to reach your device. Turning notifications off in your phone’s settings stops all of them; signing out removes the token from your account. We keep only the most recent device you signed in on.

5. Group chat, reporting and blocking

Each zone has a group. Messages are stored on our server so the conversation is there when you open the app, and are visible to the other members of that group and to admins. Chat is not end-to-end encrypted. Please treat it as a community noticeboard rather than a private channel.

• Deleting a message hides its content from everyone and replaces it with “This message was deleted”. The row is kept so that replies to it do not break.
• Reporting a message sends a copy of that message and the sender’s name to our moderators. We keep that copy even if the message is later deleted, because otherwise the evidence would disappear the moment it mattered. The person you report is not told who reported them.
• Blocking someone hides their messages from you everywhere in the app. It is one-way and silent: they are not told, and their view is unchanged. You can undo it from Profile → Blocked people.

Moderators may delete a reported message or stop a member posting in a group. See our Community Guidelines.

6. Who your data is shared with

We do not sell your data, and we do not share it for advertising. We use a small number of service providers, each for one job:

Prayer times and Qur’an and du’a content are fetched from public Islamic content sources and stored on our own server. No information about you is sent to them — not your location, not your identity, not the fact that you opened the page.

We may also disclose data if we are legally required to, or where it is necessary to protect someone’s safety.

7. How long we keep it

• Your account — until you delete it.
• One-time passcodes — minutes. They expire and are removed.
• Your nightly answers — kept as part of the record of how much food went where, and detached from you when you delete your account.
• Donations and feedback — kept for our accounts and for open complaints, detached from you when you delete your account.
• Chat messages — kept for the group. See section 8 for what happens to yours.
• Delivery volunteer position — only the latest reading is stored; there is no location history.

8. Deleting your account

Open the app and go to Profile → Delete account. It takes two confirmations and happens immediately — there is no waiting period and you do not have to email anyone. Full instructions, including how to request it if you can no longer sign in, are on the Delete Your Account page.

When you delete your account:

• Your account record is erased, not hidden or deactivated. Signing in afterwards says no account exists.
• Your phone number is released immediately and can be used to register again.
• Your name, address, gender, occupation, password hash and notification token are gone.
• Any Sehri you had booked for tonight is withdrawn, so the kitchen does not cook food nobody will collect.
• Your past nightly answers, donations and feedback are kept but detached from you. They become anonymous rows. We keep them because they are the record of how much food the community cooked and what it cost — removing them would corrupt the community’s own history, and they no longer identify you.
• You are removed from every chat group. Messages you already sent stay in the conversation, shown as from “Former member”, so the thread other people were part of still makes sense.

If you would prefer your past messages removed as well, tell us and we will delete them.

9. Your rights

You can, at any time:

• See what we hold. Most of it is visible in the app; ask us and we will send you the rest.
• Correct it. Edit your profile in the app. Some fields need an admin to approve the change, because they affect which zone cooks for you.
• Delete it. See section 8.
• Object or complain. Write to us at the address below. If you are in India, you may also complain to the Data Protection Board; if you are in the UK or EU, to your local supervisory authority.

We answer requests within 30 days, and usually much sooner.

10. How we protect your data

• Traffic between the app and our server is encrypted with HTTPS.
• Passwords are stored as bcrypt hashes and are never recoverable.
• Sign-in uses short-lived tokens that expire.
• Admins only see data for their own zone; only super admins see everything.
• Access to the database is limited to the volunteers who run the service.

No service can promise perfect security. If a breach ever affects your data, we will tell you and the relevant authority without undue delay.

11. Children

OneMessage is not directed at children. You must be at least 13 to hold an account, and if you are under 18 you should have a parent or guardian’s permission. We do not knowingly collect data from children under 13. If you believe a child under 13 has registered, tell us and we will remove the account promptly.

Our approach to child safety in the parts of the app where people can talk to each other is set out in our Child Safety Standards.

12. Changes to this policy

If we change this policy we will update the date at the top of the page. If a change materially affects how your data is used, we will also tell you in the app before it takes effect.

13. Contact us

For anything urgent, the fastest route is the support page.