How we collect, use, and protect your personal data.
Last updated: 8 August 2026
Effective Date: 8 August 2026
Last Updated: 23 August 2026
Onyatrips ("Onyatrips," "we," "us," "our," the "Company") operates a website and related services (the "Platform" or "Services") that help people discover destinations, plan trips, find travel companions, form and join travel groups, and communicate with other travellers. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights available to you.
This Privacy Policy is incorporated by reference into, and should be read together with, the Terms and Conditions (see in particular the "Data Handling Terms" and "Companion Matching & Community Terms" modules), the Cookie Policy, the Community Guidelines, and the Travel Companion Safety Policy. Where this Policy and the Terms and Conditions both address data practices, this Policy governs the details of what is collected and how it is used; the Terms and Conditions govern the contractual authorizations for that processing.
This Policy applies to personal data processed in connection with the Onyatrips website (onyatrips.com), our backend services and APIs, and any Onyatrips-operated mobile application, when and if launched. It applies to all Users, including visitors browsing without an account, registered Users, business/host accounts created through business onboarding, and administrators.
It does not apply to: (a) third-party websites or services we link to or integrate with, which are governed by their own privacy notices (see Section 15); or (b) information processed by another User acting on their own account, outside our control (for example, a screenshot another User takes of your profile).
| Term | Meaning |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person, as defined under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the EU/UK GDPR, and comparable laws. |
| Processing | Any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion. |
| Data Principal / Data Subject | The individual to whom Personal Data relates — i.e., you. |
| User | Any person who accesses or uses the Platform. |
| Profile | The information, preferences, and photograph a User provides about themselves. |
| Group | A community trip, group listing, or membership feature through which Users coordinate group travel. |
| Connection | A friend request, message thread, group membership, or other link between Users facilitated by the Platform. |
| Content / User-Generated Content | Photos, videos, reviews, ratings, messages, bios, itineraries, bucket lists, and other material a User submits. |
| Service Provider / Processor | A third party that processes Personal Data on our behalf and under our instructions. |
Onyatrips is operated by:
For the purposes of the DPDP Act, Onyatrips acts as the Data Fiduciary for Personal Data processed to operate the Platform. For the purposes of the GDPR/UK GDPR (to the extent applicable — see Section 16), Onyatrips acts as the Controller.
We distinguish five sources of data throughout this Policy: (a) information you provide directly; (b) information collected automatically through your use of the Platform; (c) information generated through your usage of specific features; (d) information received from third parties (such as Google, when you sign in with Google); and (e) information inferred by Onyatrips from the above (for example, a discoverability status derived from your profile completeness). We do not currently use machine-learning inference, scoring, or profiling to derive new facts about you beyond simple, deterministic computations described in Section 7.
| Data | Details | Source |
|---|---|---|
| Email address | Used as your account identifier and for OTP-based email verification | You provide |
| Password | Stored only as a bcrypt hash (cost factor 12); we never store or can see your plaintext password | You provide |
| Google account identifier | If you sign in with Google, we receive and store your verified Google account ID and the email address Google confirms is verified | Google (via Google Sign-In) |
| Session and token data | Access/refresh token identifiers, token version counters, session revocation records, IP address and user-agent string associated with a login session | Automatic |
| One-time passcodes (OTP) | A hashed (HMAC-SHA256), time-limited verification code sent to your email; never stored in plaintext | Generated by us, sent to you |
Collected when you complete or edit your profile: full name, age, gender, contact number, address (free text, not structured/geocoded), profession, company, college, a single profile photo, a short bio, an "interests" list, and an "official" institutional/professional email address used solely for the additional verification described in Section 5.4. If you optionally complete "Verify with LinkedIn," we also receive and store your LinkedIn member identifier, your verified LinkedIn name, and which verification categories LinkedIn reports as complete for your account — see Section 5.4. We do not receive or store your LinkedIn login credentials, and we do not retain the LinkedIn access token beyond the single verification request.
We also collect travel-related preferences: your next planned trip destination and date, and structured preference data covering lifestyle (e.g., smoking/drinking/sleep-cycle tolerance), travel behavior/traveller type, food preferences, and trip preferences (pace, itinerary style, origin, return date, transport mode, and companion gender preference).
We do not currently collect device GPS coordinates or precise geolocation from Users. "Location" data in the current product consists only of free-text fields you type yourself (e.g., city, address, trip origin/destination) and, separately, coarse city/region-level location that may be inferred from your IP address for analytics purposes (see Section 5.6). Precise latitude/longitude coordinates exist in our systems only for static points of interest ("places") and for business/host addresses submitted during business onboarding — not for tracking a User's device or movements.
If we introduce device-level GPS location collection in the future (for example, to power "travellers near me" discovery), we will update this Policy, seek any consent or device permission required by law, and describe the feature and its controls before launch.
Onyatrips currently verifies identity to the extent of confirming: (a) that you control the email address you registered with (via OTP), (b) that you control an "official" institutional or professional email address you optionally submit, (c) if you sign in with Google, that Google itself has verified your Google account email, and (d) if you optionally complete "Verify with LinkedIn," that LinkedIn confirms you completed one of its own verification checks (identity and/or workplace) and reports your verified LinkedIn name to us. LinkedIn verification is entirely optional, is a separate step from signing in, and never changes your Onyatrips login credentials.
We do not ourselves perform government-ID verification, document-based KYC, biometric verification, or background checks of any kind. Where LinkedIn verification reflects an identity check, that check is performed and attested to by LinkedIn, not by Onyatrips — we only receive LinkedIn's verification result (which categories are verified, and your verified name), never the underlying identity document itself. Any "verified" badge or status you see reflects only the checks described above (email-based, and/or LinkedIn's own attestation). The Terms and Conditions (Data Handling Terms, Clause 16) note that biometric or identity-document verification performed directly by Onyatrips may be introduced in the future, only with separate, explicit consent and disclosure at that time.
IP address, browser type and version, operating system, device type, referring/exit pages, and general usage/interaction data (pages viewed, features used, clicks, searches) are collected automatically through server logs and our analytics tools (PostHog and Google Analytics — see Section 8 and the Cookie Policy). Approximate city/region-level location may be derived from IP address by these analytics tools; we do not collect precise geolocation this way.
When you create or join a group, we store the group's destination, origin, dates, budget, description, "vibe," size, price per seat, and any companion-preference fields the organizer sets (preferred gender, "open to" audience such as "same college" or "everyone," and tolerance settings for smoking/drinking/transport/sleep schedule). Membership requests and their status (pending, accepted, rejected, cancelled) are recorded. "Individual traveller" discovery uses this same profile and trip-preference data — there is no separate traveller-specific database table; a "traveller" listing is simply your profile shown to others once you set a planned trip.
Discovery and matching between Users is currently performed through deterministic, rule-based filtering (structured database queries against fields you or others set, such as destination, dates, budget, and preferences) — not through machine learning, AI scoring, or predictive matching, notwithstanding language elsewhere describing "AI matching" or "compatibility scores" as a planned capability. See Section 7 for the current-vs-future distinction.
Paid booking is live on Onyatrips today, in two forms: paying for a seat on a group trip (via the "Plan a Trip" flow) and paying for a bookable Place's slot — see the Refund and Cancellation Policy for the full disclosure. Both are processed through our Razorpay payment integration. We do not receive, process, or store your card number, CVV, UPI PIN, or full bank account details — these are entered directly into Razorpay's hosted checkout and are subject to Razorpay's own security and PCI-DSS controls. We store only the Razorpay order ID, payment ID, amount, currency, and payment/booking status needed to reconcile your booking, plus which coupon (if any) you used. Booking price is always calculated by our backend from the trip's/slot's own stored price — never accepted as a value supplied by your browser — so a tampered client request cannot change what you're charged. This Policy will be updated with any material changes to how payment data is handled.
Onyatrips does not currently offer a group-trip expense-splitting or cost-tracking tool. If one is introduced in future, it would be for record-keeping convenience only — no money would be transferred through Onyatrips as part of such a feature, and Onyatrips would not act as a payment institution, escrow agent, or financial intermediary for peer-to-peer settlements. This Policy will be updated before any such feature is enabled.
If you apply to list a business (hotel, resort, hostel, homestay, restaurant, activity provider, transport, or tour operator), we collect the business's name, type, description, contact email and phone, full address (including geocoded coordinates), room/property details, amenities, pricing, logo/cover/property images, GST number, PAN number, and a registration document you upload for manual admin review. We also keep an internal log of status changes (submitted, approved, rejected) and the reviewing admin's identity, for accountability.
We log authentication events, rate-limit counters, and failed login/verification attempts to protect accounts and detect abuse. We do not currently operate an automated fraud-scoring or risk-scoring system; abuse detection today relies on rate limits, upload-content validation, and manual review of user reports/feedback rather than an automated risk engine.
We do not have a dedicated field for "sensitive personal data" (as that term is understood under the DPDP Act, GDPR, or CCPA/CPRA — e.g., health data, precise geolocation, sexual orientation, religious belief, or financial account credentials) and we do not ask you to provide it. Some free-text fields (bio, interests, lifestyle preferences) could incidentally reveal sensitive characteristics if you choose to disclose them voluntarily; any such disclosure is at your discretion, and we process it only to operate the feature in which you provided it. Please avoid including sensitive personal data in profile fields, messages, or uploaded content that do not require it.
We process Personal Data for the following purposes. Where required by applicable law, we identify the corresponding legal basis (relevant primarily to GDPR/UK GDPR; DPDP Act processing is grounded in your consent or in the "legitimate uses" recognized by that Act, such as for a specified purpose for which you have voluntarily provided data).
| Purpose | Examples | Typical legal basis (GDPR/UK GDPR) |
|---|---|---|
| Account creation and authentication | Registering, logging in, verifying your email, password resets | Contract necessity |
| Providing core Services | Profile display, group creation/joining, discovery/filtering, messaging, bookings | Contract necessity |
| Trust, safety, and security | Rate limiting, upload validation, session-revocation on suspected compromise, responding to reports | Legitimate interests / legal obligation |
| Communications | Transactional emails (OTP, password reset, welcome), service notices | Contract necessity / legitimate interests |
| Marketing communications | Product updates, re-engagement emails (Customer.io) | Consent, where required; you may opt out at any time |
| Analytics and product improvement | Understanding feature usage, diagnosing issues (PostHog, Google Analytics) | Legitimate interests / consent, where cookie consent is required |
| Payments and bookings — see Section 5.8 | Processing group-trip and Place-slot bookings via Razorpay | Contract necessity |
| Business onboarding review | Evaluating and approving host/business applications | Contract necessity / legitimate interests |
| Legal compliance | Responding to lawful requests, tax/audit recordkeeping | Legal obligation |
| Fraud and abuse prevention | Detecting fake accounts, spam, and policy violations | Legitimate interests |
We do not use Personal Data for advertising personalization or ad targeting today (see Section 8.2 and the Cookie Policy) and we do not sell Personal Data.
Current state: Discovery, filtering, and "traveller"/group matching are implemented as deterministic, rule-based database queries against explicit fields (destination, dates, budget, preferences, etc.). There is no machine-learning model, scoring algorithm, embedding-based similarity search, or automated-decision system currently in production that ranks, scores, or predicts compatibility between Users.
Planned/future: Other Onyatrips materials (including the "Place Discovery & Recommendations" and "Companion Matching & Community" modules of the Terms and Conditions) describe "AI matching," "compatibility scores," and a "hybrid artificial-intelligence and human-editorial" recommendation process for destination content. This Policy describes the verified, current state of the product; see the Responsible AI Policy for how we address the difference between that language and current capability.
If and when we introduce AI-driven recommendations, scoring, or matching, we will: (a) update this Policy to describe the system, the data it uses, and its limitations; (b) make clear that such outputs are probabilistic signals, not guarantees of compatibility, safety, or accuracy; (c) provide any rights required by applicable law in relation to solely automated decision-making with legal or similarly significant effects (we do not believe any current or currently-planned processing meets that threshold, since AI-assisted suggestions do not, by themselves, determine access to the Service); and (d) only use Personal Data to train or improve models on a lawful basis, with consent where required.
We do not sell your Personal Data. We share it only as described below.
Depending on the feature and your settings, other Users may see: your profile photo, name, bio, interests, travel preferences, group memberships, and reviews you post. Message content is visible to the participants in that conversation or group.
We do not currently share Personal Data with third parties for advertising or ad-targeting purposes, and we have not identified any advertising SDK, ad network, or ad-tracking pixel integrated into the Platform. If this changes, we will update this Policy and the Cookie Policy and provide any consent or opt-out mechanism required by applicable law before doing so.
We share Personal Data with the following categories of service providers, each acting on our instructions and only to the extent necessary to provide their service:
| Provider | Role | Data involved |
|---|---|---|
| PostHog | Product analytics, session behavior, feature flags | Device/browser data, usage events, approximate IP-derived location |
| Google Analytics 4 | Traffic and conversion analytics | Device/browser data, usage events |
| Google (Sign-In) | Social login / identity verification | Email address, Google account identifier |
| Google Maps | Embedded map shown on place pages with location information | Your IP address and standard request data, sent to Google when the embed loads. We do not use a Google Maps API key, SDK, or the JavaScript Maps API — only Google's public embeddable map URL. |
| Razorpay | Payment processing — live for group-trip and Place-slot bookings (see Section 5.8) | Booking amount, currency, order/payment identifiers (not card data) |
| Customer.io | All transactional and lifecycle email — security-critical (OTP, password reset) and non-critical (welcome, notifications) | Email address, name, message content |
| Ably | Real-time delivery of chat messages and notifications | Message metadata and content in transit |
| Cloudflare R2 | Object storage for uploaded media | Uploaded files and associated metadata — required in production; local-disk storage is a local-development-only fallback, not used in production |
| Render.com | Backend application hosting | All data processed by the backend, as its hosting infrastructure |
| Vercel | Frontend application hosting | Data transmitted through the website's frontend |
| Neon (PostgreSQL) | Database hosting | All Personal Data stored in our primary and read-only databases |
We do not use Microsoft Clarity (previously integrated, since removed), Brevo/Sendinblue (previously integrated, since removed), or Cloudflare CDN/WAF/Turnstile (documented but not yet provisioned). We do use an embedded Google Maps view on place pages — see the table above and Section 11 of our Cookie Policy — but do not integrate Mapbox or any other maps provider.
See the table above. Our infrastructure spans India-focused and global cloud providers (Vercel, Render, Neon, Cloudflare); see Section 9 for cross-border implications.
We may access, preserve, and disclose Personal Data where we reasonably believe it is necessary to: comply with a law, regulation, court order, or valid legal process; respond to a lawful request from a government or law-enforcement authority; investigate or prevent fraud, security incidents, or violations of our Terms and Conditions or Community Guidelines; or protect the rights, property, or safety of Onyatrips, our Users, or the public.
If Onyatrips is involved in a merger, acquisition, financing, reorganization, or sale of assets, Personal Data may be disclosed to a prospective or actual acquirer or successor as part of that transaction, subject to appropriate confidentiality protections. We will notify affected Users if a transaction results in a materially different use of their Personal Data than described in this Policy.
Our hosting and service providers (Neon, Render, Vercel, Cloudflare, PostHog, Google, Razorpay, Customer.io, Ably) may store or process data in data centers located outside India, including in jurisdictions such as the United States or the European Union depending on each provider's infrastructure. By using the Platform, you acknowledge your data may be processed outside your home jurisdiction.
We currently implement the following measures:
We do not currently claim, and this Policy does not claim, that data is encrypted at rest in our database, that we hold any security certification (e.g., ISO 27001, SOC 2), or that we have undergone an independent third-party security audit or penetration test — none of these currently apply. Chat messages are stored as plain text and are not end-to-end encrypted.
No security measure is perfect, and we cannot guarantee that unauthorized access, loss, misuse, or alteration of data will never occur.
We do not currently have a documented, formally adopted incident-response or breach-notification procedure. If we become aware of a security incident affecting your Personal Data, we will notify affected Users and, where required by applicable law, the relevant supervisory authority (such as the Data Protection Board of India, once operational). We do not commit to a specific notification timeframe beyond what applicable law requires.
We retain Personal Data for as long as your account remains active and as necessary to provide the Services. Specific retention periods have not yet been formally defined for each data category. As a general principle: (a) account and profile data is retained until you delete your account or request deletion; (b) transactional/payment records are retained as required for tax, accounting, and dispute-resolution purposes under applicable law; (c) security and log data is retained for a limited period sufficient for fraud detection and incident investigation; and (d) data may be retained beyond deletion where necessary to comply with a legal obligation, resolve a dispute, or establish, exercise, or defend a legal claim.
Our backend currently has no self-service account-deletion or data-export endpoint. Requests for access, correction beyond your own profile settings, deletion, or portability must currently be made manually by emailing legal@onyatrips.com, and will be processed by our team rather than fulfilled automatically. Account deletion, once actioned, may be irreversible. Building self-service deletion and export tooling is a priority for us.
We will verify your identity before acting on a request and will respond within the timeframe required by applicable law (see Section 16 for jurisdiction-specific response timelines).
You may unsubscribe from marketing emails using the unsubscribe link in any such email, through the Communication Preferences page in your account settings (a self-serve toggle for marketing emails and per-category activity-email notifications), or by contacting legal@onyatrips.com. Transactional and security emails (such as OTPs and password resets) cannot be opted out of, as they are necessary to operate your account.
As described in Section 7, we do not currently perform solely automated decision-making that produces legal or similarly significant effects concerning you. If this changes, we will provide the rights required by applicable law (including the right to obtain human review of, and to contest, such a decision).
Onyatrips is intended for individuals 18 years of age and older and is not directed to children. We do not knowingly collect Personal Data from anyone under 18. If we become aware that we have collected Personal Data from someone under the minimum age, we will take steps to delete it.
Our backend's profile-update validation currently accepts an "age" value between 13 and 100, and there is no date-of-birth field or age check at registration. This is inconsistent with the 18+ requirement stated in this Policy and in the Terms and Conditions, and means the stated minimum age is not currently technically enforced. Correcting this — age-gating at registration, and validation aligned to 18+ — is a critical priority for us; see the Child Safety Policy for the full disclosure.
We do not knowingly direct behavioral advertising or profiling at minors, consistent with Section 8.2 (no advertising is currently conducted at all).
Certain information you provide is, by the nature of the feature, visible to other Users or the public:
You are responsible for the information you choose to include in these public or semi-public surfaces. Avoid sharing sensitive personal information (home address, financial details, government ID numbers, exact real-time location) in your profile, messages, or reviews.
The Platform may contain links to third-party websites (for example, an external hotel or activity provider) or embed third-party functionality (for example, Razorpay's checkout, Google's sign-in widget). Those third parties process data under their own privacy policies, which we encourage you to review. We are not responsible for the independent data practices of third parties acting as their own data controllers.
Onyatrips is based in India and primarily serves users in India today. This section describes rights that may apply to you depending on your location. Onyatrips does not assume every listed right applies to every user; applicability depends on your jurisdiction and, in some cases, on future confirmation of where our user base is located.
If you are located in India, you are a "Data Principal" under the DPDP Act and have the right to: obtain a summary of your Personal Data and processing activities; correct, update, and complete your Personal Data; erase Personal Data that is no longer necessary for the purpose it was collected; withdraw consent at any time (without affecting the lawfulness of prior processing); nominate another individual to exercise your rights in the event of death or incapacity; and file a complaint with us, and thereafter with the Data Protection Board of India, if your grievance is not resolved. We rely on your consent, and on the "certain legitimate uses" recognized under the DPDP Act (such as processing for a specified purpose for which you have voluntarily provided your data), as our grounds for processing.
If you are located in the EEA or UK, you have rights under the GDPR / UK GDPR, including the rights of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing (including for direct marketing), and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).
If you are a California resident, you have the right to: know what Personal Information we collect, use, and disclose; delete your Personal Information; correct inaccurate Personal Information; opt out of the "sale" or "sharing" of Personal Information (we do not sell Personal Information and do not share it for cross-context behavioral advertising, so there is currently nothing to opt out of); limit the use of Sensitive Personal Information (we do not collect Sensitive Personal Information as defined under CPRA); and not be discriminated against for exercising these rights.
We may have Users in other jurisdictions with their own data protection laws; we will assess and extend the applicable protections as our user base grows internationally.
We may update this Policy from time to time, including to reflect new features, new service providers, or changes in law. We will post the updated Policy with a revised "Last Updated" date and, for material changes, will provide additional notice (such as an in-app banner or email) where required by applicable law. Continued use of the Platform after an update constitutes acceptance of the revised Policy, to the extent permitted by applicable law; where law requires fresh consent for a material change, we will seek it.
For any question, request, or complaint about this Policy or our data practices, contact:
If you are not satisfied with our response, you may have the right to escalate your complaint to a competent regulatory authority (e.g., the Data Protection Board of India, once operational, or your local supervisory authority under GDPR/UK GDPR).
We use analytics cookies to understand how you use Onyatrips, so we can improve it. These are optional — the site works fully without them. Learn more.