Privacy Policy

Last updated: 10 October 2026

This policy explains what information One2One (also called O2O) collects, how it is used, and the choices you have. One2One is operated by Vinnovation. You can reach us at vijaysinnovation@gmail.com.

1. Information we collect

• Account details: your username, display name, an optional profile photo (visible to people who chat with you or find you in search), an optional "about" line, a profile colour, and your password (we store only a salted hash, never the password itself).
• Optional contact details: a mobile number and/or an email address if you choose to add them, and whether your email is verified. They are never shown to other users.
• Messages, photos and voice notes: these are end-to-end encrypted on your device. We store only the encrypted data, which we cannot read, together with who sent it, which chat it belongs to, when, and its delivery/read status. Emoji reactions and poll votes are not encrypted.
• Status updates: text, photo and link statuses are not end-to-end encrypted. They are stored so the people you chose can view them, and are removed automatically after 24 hours.
• Calls: audio and video travel directly between the two devices and are encrypted. Our server only passes along encrypted call set-up information. We keep a short line in the chat such as "Voice call · 2:31".
• Encryption keys: your public key is stored on our server so others can message you securely. Your private key stays on your device (and in any backup file you create).
• Notifications: if you allow them, a push-notification address for your device, the list of chat IDs you have locked on that device (so we do not notify you about them), and whether the app is currently open.
• Reports: if you report a user or group, we store the reason and your note. If you choose to include the last five messages, those messages are sent to us in readable form.
• Technical data: your IP address and basic request information, processed by our server and hosting provider for security, abuse prevention and rate-limiting.
• On your device only: your app PIN, locked-chat list, theme and sound settings, and your encryption key. These do not leave your device.

2. How we use information

• To run the service: deliver messages, calls and statuses, show who is online, and send notifications.
• To keep the service safe: prevent abuse, enforce our Terms, and review reports.
• To let you recover your account (email codes) and help friends find you if you allow it.

We do not sell your information, we do not show advertising, and we do not use analytics or tracking tools.

3. Who else may receive information

• Other users see your name, username, about line, online status, last seen time and the statuses you share with them.
• Our hosting provider runs the server that stores the encrypted data.
• Push services run by Google, Apple, Mozilla or Microsoft deliver notifications to your device. Notification content is encrypted for your device.
• An email service (Resend) is used only to send verification and password-reset codes.
• A call relay service (STUN/TURN) may help connect calls. It can see network addresses but not the encrypted call content.
• YouTube and Instagram: when you or a contact plays an embedded video, that content is loaded directly from YouTube or Instagram and their own privacy policies apply.
• Legal requests: if required by law we may have to provide data we hold. We cannot read encrypted messages.

4. How long we keep information

• Messages stay until you or the other person delete them, a disappearing-message timer removes them, or the account is deleted.
• Statuses are removed after 24 hours.
• Reports are kept for as long as needed to keep the service safe.
• We keep a private daily backup of our database for 7 days so we can recover from failures, so deleted data can remain in backups for up to 7 days.
• When you delete your account we remove your profile, statuses, messages you sent, direct chats, push registrations and sessions. Group chats you leave keep the other members' messages.

5. Your choices

• Edit your name, about line, mobile number and email in Settings, and switch off "find me by number or email".
• Use Block and Report from the ⋮ menu in any chat.
• Use disappearing messages, the app lock and chat lock for extra privacy.
• Delete your account any time in Settings → Delete my account, or see how to delete your account.
• Depending on where you live you may have rights to access, correct or delete your data. Contact us at vijaysinnovation@gmail.com.

6. Security

Messages are end-to-end encrypted, passwords are hashed, and the service is served over HTTPS. No system is perfectly secure. If you lose your device and have no key backup, we cannot recover your old messages. Download your key backup in Settings and keep it private.

7. Children

One2One is not for children under 13 (or under 16 where the law requires). We do not knowingly collect information from them. If you believe a child has an account, contact us and we will delete it.

8. Changes

If we change this policy we will update the date above and, for important changes, tell you in the app.

Questions? Write to vijaysinnovation@gmail.com. See also our Terms of Use.