Privacy Policy
One Place is a local business directory and marketplace for India. It is operated by Sagar Rathore, an individual developer based in India ("we", "us"). This policy explains what the app collects, why, who it is shared with, and how to get it deleted.
Contact for any privacy question or request: rathoresagar26@gmail.com
1. Information we collect
| Data | When | Why |
|---|---|---|
| Name | You create an account | Identifies you to businesses you order from or message |
| Username | You create an account | Your sign-in identifier, and how you are named to businesses you order from or message. It is public. |
| Phone number | Optional — only if you choose to add one | A contact detail, never a credential. Kept private and shown to a business only once you become their customer. You can create and use an account without giving one. |
| Email address | Optional — only if you choose to add one, or if you sign in with Google | A contact detail, never a credential. We send nothing to it and never verify it. Our authentication provider keys every account to an email address internally, so one is generated from your username (<your-username>@localo.app); it is not a real mailbox, receives nothing, and is never shown to anyone. |
| Password | You create an account | Stored only as a salted hash by our authentication provider. We never see it. |
| Google account name and email | Only if you choose "Continue with Google" | Google returns your name and email address to create the account. We receive nothing else, and no access to your Google data. |
| A temporary guest identity | If you place a voice call without signing up | An anonymous account with no name, phone or email, created so a call can be connected and returned. Not linked to you. |
| Approximate and precise location | While using the app, with your permission | Shows businesses near you and sorts results by distance |
| Live location while sharing a shift | Only if you are a driver and switch on live sharing, and only while One Place is open on your screen | Shows a vehicle's live position to its business and to customers tracking that vehicle |
| Photos you choose | When you list an item or set a business picture | Displayed on your listing |
| Microphone audio | Only during an in-app voice call | Carries the call. Calls are never recorded or stored. |
| Business details | You list a business | Published in the public directory |
| Orders, bookings, bills, memberships | You transact | Shows both sides an accurate record |
| Messages and reviews | You write them | Delivered to the recipient; reviews are public |
| Push notification token | You allow notifications | Used only to alert you to incoming calls and messages |
What we do NOT collect
- No background location. This version of the app does not collect your location when it is not open on your screen — see section 2.
- No advertising identifier (IDFA / GAID). We do not track you across other apps or websites.
- No third-party advertising or analytics SDKs. Businesses can pay to be featured inside the app; how that is counted is in section 5.
- No contacts, calendar, health, or financial account data.
- No call recordings. Voice call audio is relayed live and never stored.
- No payment card details. The app processes no payments; any money changes hands off-app.
2. Location, explained precisely
This version of the app uses location in one way only: while you are using it. It never collects your location in the background.
While-using location powers the core of the app: finding shops, services and sellers near you and ordering them by distance. You may decline it — the app still works, but you will need to pick a location manually.
Driver live sharing is an optional feature for one role. If a business you work for operates vehicles and you are assigned as a driver, you can switch on "Share my live location" for a shift, so the business owner and customers whose goods or children are on that vehicle can see it moving. It is off by default, it is never enabled automatically, and you can switch it off at any moment from the same screen. It reports your position only while One Place is open on your screen: sharing pauses as soon as you leave the app and stops when you close it.
We do not collect background location. The app does not request Android's background-location permission, and that permission is not present in the installed app. If a future version adds background sharing for drivers, it will ask for that permission separately, explain it before asking, and this policy will be updated before that version ships.
3. What is public
Some information is public by design, because the app is a directory:
- Business listings: name, description, tags, opening hours, offerings and prices, and the location you chose to publish.
- Items on a personal stall, including their photos and prices. Photos you upload are stored in a public file bucket so they can load for anyone browsing, including people who are not signed in — treat a photo you upload as published.
- Reviews and ratings you post, shown with your display name.
- Public question-and-offer threads under a stall item.
Private by contrast: your phone number, your email, your orders and bills, and your direct messages. A business only ever sees your phone number if you place an order or become their customer.
4. Service providers
We use a small number of processors. We do not sell your data, and we do not share it for advertising.
| Provider | Role | Data reaching them |
|---|---|---|
| Supabase | Database, authentication, file storage | Account details, listings, transactions, messages, photos |
| LiveKit | Voice call audio relay | Live call audio and a temporary call token. Nothing stored. |
| Expo & Apple Push Notification service / Firebase Cloud Messaging | Push notification delivery | Your device push token and the alert text |
| Expo (app updates) | Delivering app updates without a store download | An installation identifier and the app version your device is running |
| Optional "Continue with Google" sign-in | Only if you choose it: the name and email address on your Google account | |
| OpenStreetMap, OSRM and unpkg | Map tiles, directions and the map library | Your device's IP address and the part of the map you are looking at. This happens because your device fetches the map directly, the same as visiting any website that shows a map. |
5. Promoted listings
A business can pay to have its listing featured inside One Place — in the "near you" strip, for example. These are our own listings, promoted by us. There is no advertising network, no ad SDK and no advertising identifier in the app, and nothing you do here is used to build a profile of you or followed into any other app or website.
We count how many times a promoted listing was shown and how many times it was tapped, and we report those totals to the business that paid. Because a business is buying the attention of people who could realistically walk in, each view is also counted against how far away the viewer was — under one kilometre, under five, and so on. That distance is worked out on your device and sent only as a bucket added to a running total. It is not stored against your account, it does not record where you were, and the business sees only counts, never who you are.
6. Where data is stored
Data is stored on our providers' servers, which may be located outside India. Where data is transferred internationally, it is transferred under the provider's contractual protections. By using the app you consent to this transfer.
7. How long we keep it
- Account data — until you delete your account.
- Transaction records (orders, bills, memberships) — retained after account deletion in anonymised form, because they are also the other party's business records.
- Messages — your conversations with a business are deleted outright, both sides, when you delete your account. Messages you posted on a public stall item are kept, shown as written by "Deleted user", so the answers stay useful to other shoppers.
- Live-sharing position — one row per driver per business, holding the latest position and whether sharing is currently on. No history or trail is kept: each new position replaces the last. Switching sharing off stops the updates and hides the vehicle from everyone, and the last position stays in that single row until you delete your account.
- Push tokens — deleted when they stop working, when you sign out, and when the device is signed into by someone else.
8. Deleting your account
In the app, at any time: Account tab → Delete my account. It takes effect immediately — there is no waiting period and no queue.
Without the app installed: use the request page at
sagar26102004.github.io/Business-Bubby/delete-account.html, or email
rathoresagar26@gmail.com from the address, or with the phone
number, on the account and the subject Delete my account. Emailed requests are actioned within
30 days and confirmed by reply.
Deleted: your profile and username, your phone number and email address, your saved places, your registered devices and push tokens, your own notifications, any child or parcel you had tracked, your conversations with businesses (both sides), and any listing of yours that nobody has used.
Kept, with your identity removed and your name shown as "Deleted user": orders, bills, bookings and memberships, because they are also the business's own financial records; ratings and reviews you left, because a business's score is earned from verified transactions and deleting an account should not rewrite it; and questions or offers you posted on a public stall item, because other shoppers rely on the answers. Your name is replaced everywhere in these records.
If you solely own a business listing that has staff, orders, bills, members or reviews, the app will not delete your account until you transfer that listing to its real owner or take it down yourself — deleting it with you would destroy other people's records. The app names each listing that is in the way. A listing nobody has used yet is simply deleted along with your account.
A team member's roster entry at a business they worked for keeps the name the business recorded, and is unlinked from the deleted account. That entry belongs to the business's own records.
9. Your rights
Under India's Digital Personal Data Protection Act, 2023, you may ask us to access, correct, or erase your personal data, and you may withdraw consent for any permission at any time — from your device's system settings for location, camera, photos, microphone and notifications, or by writing to us. Write to the address above; we respond within 30 days. If you are unhappy with our response you may complain to the Data Protection Board of India.
10. Children
One Place is not directed at children and is not intended for anyone under 18. We do not knowingly collect data from children. A child may appear in the app only as a tracked passenger on a school vehicle, recorded by their parent or the school — in that case we hold only a label chosen by the adult, and never an account, a photo or a contact detail for the child. If you believe a child has created an account, write to us and we will remove it.
11. Security
Traffic between the app and our servers is encrypted in transit with TLS. Access to stored data is restricted by row-level security rules, so one account cannot read another's private records. Passwords are salted and hashed by our authentication provider and are never visible to us. No system is perfectly secure, and we cannot guarantee absolute security.
12. Changes
If this policy changes materially we will update the date at the top and, where the change is significant, notify you in the app. Continued use after a change means you accept the updated policy.
13. Contact
Sagar Rathore · India
rathoresagar26@gmail.com
Our other documents
- Privacy Policy — sagar26102004.github.io/Business-Bubby/privacy-policy.html
- Terms of Service — sagar26102004.github.io/Business-Bubby/terms-of-service.html
- Delete your account — sagar26102004.github.io/Business-Bubby/delete-account.html
- Support — sagar26102004.github.io/Business-Bubby/support.html