Privacy Policy
Effective date: 11 October 2026
This Privacy Policy explains what information One Day World collects, why, how long it is kept and the choices you have, wherever you live. One Day World is operated by Ahmad Hussain, Srinagar, Jammu and Kashmir, India ("we", "us"), who is the controller (or "data fiduciary") of your information. Questions can be sent to support@onday.world.
1. The short version
- You can read the chat, the map and the daily numbers without an account, in the iPhone app, on https://onday.world or at https://app.onday.world.
- To post, you sign in with Apple or Google and allow location access. Your device rounds your location to about 11 km and we keep only the nearest city.
- Your message is public for the world day you post it. We keep a private copy for you in "My messages" until you delete it or your account.
- We keep a visitor log to protect the service. IP addresses are erased after 7 days, the rest of the log after 365 days.
- We do not sell or share your data for advertising, show ads, use tracking cookies or track you across other apps and websites.
- You can delete your account inside the app or the web app at any time, and you can use the rights in section 9 wherever you live.
2. Information we collect
When you visit the website or use the apps, with or without an account
- Visitor log. For each page view on https://onday.world or https://app.onday.world, and each time the iPhone app opens, we record: the time, the page or screen, the website that sent you (if any), your approximate location as country, region and city (worked out from your network address by Cloudflare, never from your device's GPS), the type of device, operating system and browser (read from the information your browser or app sends), your language setting and screen size.
- Your IP address, stored with that log entry for 7 days only and then permanently erased.
- A daily visitor code: a scrambled one-way code made from your IP address, browser details and the date, so we can count unique visitors without cookies. It changes every day, so it cannot be used to follow you from one day to the next.
- Daily counts of visits, app opens, first launches and sign-ins (for example "120 visits from Japan on an iPhone today"). These counts contain no IP address, cookie, account or device identifier.
- An app-generated device identifier, used only if you report or block someone, so reports cannot be repeated endlessly and your block list works.
When you sign in
- Your account identifier and email address from Apple or Google. If you use Apple's Hide My Email, we receive a private relay address instead.
- A random 7-digit user ID that we create for your account. It identifies you to our support team and in moderation and is never shown to other users.
- The display name you choose. We do not use the name on your Apple or Google account.
- The version of the Terms you accepted and when you accepted it.
- Whether you signed in on the iPhone app or the web app, and roughly when you last used it (to the hour).
When you post
- Your message text.
- Your city and country. Your phone or browser rounds your location to about 11 km before sending it. Our server matches that point to the nearest town or city and stores only the city name, country and the city centre's coordinates. The rounded point is discarded and your exact position is never stored.
- The time of posting and the world day it belongs to.
When the map shows "My city" or "My country", your rounded position is sent once to find the nearest city and the outline of your country, and is not stored. If you have not allowed location access, the city of your latest message is used instead.
When you contact us
- The emails you send to support@onday.world, our replies, and the account they belong to (matched by your email address or your 7-digit user ID).
Safety information
- Reports you make or receive, warnings, strikes, suspensions and bans.
- An identifier for your device, stored in scrambled (hashed) form, used to enforce bans.
- The people you block.
What we never collect: precise location, contacts, photos, microphone or camera data, browsing history from other sites, advertising identifiers, or any of the special categories of data (such as health, religion or political views) unless you choose to write them in a public message.
3. Cookies and storage on your device
We do not use cookies for advertising, analytics or tracking. The web app stores a few items in your browser's local storage that are strictly necessary for it to work: your sign-in session (until you sign out), that you accepted the Terms, your light or dark mode choice and people you blocked as a guest. The iPhone app keeps your sign-in session in the secure iOS keychain. Because these items are needed for the service you ask for, they do not require a consent banner under the EU and UK ePrivacy rules.
4. How we use information and our legal bases
| Purpose | Information used | Legal basis (EU, UK and similar laws) |
|---|---|---|
| Run your account, show messages in the chat and on the map, keep "My messages" and "My world", enforce one message a day | Account, user ID, messages, city | Performing our contract with you (the Terms) |
| Use your location to place your message at your city | Rounded location, city | Your consent, given in the location permission prompt |
| Keep the community safe: check messages before they appear, handle reports, warnings, suspensions and bans | Messages, display names, reports, strikes, hashed device identifier | Our legitimate interest in a safe service, and legal obligations |
| Protect the service from abuse, fraud, spam, attacks and automated misuse, investigate security incidents, and respond to lawful requests | Visitor log including IP addresses (7 days) | Our legitimate interest in security and preventing abuse, and legal obligations |
| Understand how the service is used and improve it (for example which pages are visited and which devices to support) | Visitor log without IP addresses, daily counts | Our legitimate interest in running and improving the service |
| Answer support requests, appeals and grievances | Emails, account, user ID | Performing our contract, and legal obligations |
| Comply with the law and respond to valid legal orders | Any information needed | Legal obligation |
Where we rely on legitimate interests we have balanced them against your rights: the visitor log holds no account information, IP addresses are kept for only 7 days, and you can object at any time (section 9). Where we rely on consent, you can withdraw it at any time, for example by turning off location access or deleting your account. Under India's Digital Personal Data Protection Act, 2023, we process your data on the basis of your consent and the legitimate uses allowed by that Act.
Automated checks. Every message and display name is checked automatically before it appears. A message that seems to break the Community Guidelines is held back and you can rewrite it; this does not use up your day. Strikes, suspensions and bans are applied by a person after a report. You can always ask for a person to review any decision (see the Terms).
5. What is public
Your display name, city, country, message and the time you posted are visible to everyone using One Day World for the world day you post. Anyone could take a screenshot, so do not share anything you want to keep private. Your email address, your 7-digit user ID and your message history are never shown to other users.
6. Who processes your information
We use a small number of service providers who process data on our behalf, under contracts that require them to protect it and use it only to provide their service to us:
- Cloudflare (Cloudflare, Inc., USA) runs our server, database and DNS, and provides the approximate location of visitors.
- Vercel (Vercel Inc., USA) hosts our websites, including https://onday.world and the web app.
- Zoho (Zoho Corporation, India) hosts our mailbox.
- Brevo (Sendinblue SAS, France) delivers the emails we send you.
- Apple and Google confirm your identity when you sign in. We receive only an account identifier and email address.
- OpenFreeMap and OpenStreetMap provide the map tiles in the web app. Your browser downloads tiles from them, which means they receive your IP address as part of that request.
- Automated moderation: message text and display names (nothing else) are checked by Llama Guard, an open model run by Cloudflare, and if that service is busy, by OpenAI's moderation service (OpenAI, USA).
We do not sell, rent or share your information for advertising or cross-context behavioural advertising. We may disclose information if required by law or a valid legal order, to protect someone's safety, or as part of a transfer of the service to a new operator who agrees to this policy.
7. International transfers
We operate from India and our providers store data in several countries, including the United States and the European Union. When information about people in the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) offered by our providers, or on another lawful transfer mechanism. Contact us for more information about these safeguards.
8. How long we keep information
| Information | Kept for |
|---|---|
| Public messages | Visible for their world day, then hidden, and deleted from the public wall after 30 days |
| Your private copy of your messages ("My messages") | Until you delete the message or your account |
| Account, user ID, display name, block list | Until you delete your account |
| Reports, warnings and strikes | Until you delete your account |
| Ban records (scrambled) | Kept after deletion if an account was banned, to stop immediate re-registration |
| IP addresses in the visitor log | 7 days, then erased |
| The rest of the visitor log (no IP address) | 365 days |
| Daily counts (anonymous) | Kept, as they contain no personal data |
| Support emails and our replies | 2 years, or sooner if you ask us to delete them; deleted items are emptied after 30 days |
| Daily posting records | 30 days |
We may keep information longer only if the law requires it, or to deal with an ongoing legal claim or investigation.
9. Your rights
Wherever you live, you can:
- Access the information we hold about you and get a copy in a portable format.
- Correct it. You can change your display name at any time in the app.
- Delete your account and data from the Account page in the app or the web app. Deletion is immediate. You can also delete single messages.
- Object to our use of your information based on legitimate interests, or ask us to restrict it.
- Withdraw consent at any time, for example by turning off location access or deleting your account.
- Not be discriminated against for using your rights.
- Appeal a decision about your request by replying to our answer.
Depending on where you live, you also have these rights under local law:
- European Union, EEA and United Kingdom (GDPR and UK GDPR): all the rights above, including portability and the right to complain to your local data protection authority (in the UK, the Information Commissioner's Office).
- India (Digital Personal Data Protection Act, 2023): to get a summary of your data and how it is processed, to correction, completion, updating and erasure, to grievance redressal through our Grievance Officer (section 12) and then the Data Protection Board of India, and to nominate another person to exercise your rights in case of death or incapacity.
- California and other US states with privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others): to know what personal information we collect, use and disclose, to delete and correct it, and to opt out of its sale or sharing. We do not sell or share personal information, and we do not use sensitive personal information for purposes that would need your permission. We honour Global Privacy Control signals as an opt-out. In the last 12 months we collected the categories described in section 2 (identifiers, internet activity on our service, approximate geolocation, and the content of your messages) for the purposes in section 4, and disclosed them only to the providers in section 6.
- Brazil (LGPD): confirmation of processing, access, correction, anonymisation, portability, deletion, information about sharing, and to complain to the ANPD.
- Canada, Australia, Japan, South Korea, Singapore, South Africa and other countries: the access, correction and complaint rights given by your local privacy law, including to complain to your local privacy regulator.
To make any request, email support@onday.world from the address linked to your account and include your 7-digit user ID if you have one (shown on the Account page). We may need to confirm your identity. We answer within 30 days (or sooner where your local law requires), and tell you if we need more time. You may use an authorised agent where your law allows it.
10. Age
One Day World is only for people aged 18 or older. We do not knowingly collect information from anyone under 18. If we learn that a user is under 18, we will delete their account.
11. Security
Data is encrypted in transit and stored with Cloudflare. Only our server can create messages, apply bans or delete accounts, and only the operator can sign in to our back office, with Google sign-in limited to approved accounts. IP addresses are erased automatically after 7 days. No method of storage is perfectly secure, but we take reasonable steps to protect your information, and if a breach affects your information we will notify you and the relevant authorities as the law requires.
12. Grievance Officer and contact
In line with India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023:
- Name: Ahmad Hussain
- Email: support@onday.world
- Location: Srinagar, Jammu and Kashmir, India
We acknowledge complaints within 24 hours and aim to resolve them within 15 days. People in any country can contact the same address with privacy questions or requests.
13. Changes to this policy
If we change this policy in a meaningful way, we will update the effective date, and the app will show the updated version and ask you to accept it before you post again.
14. Contact
Ahmad Hussain, Srinagar, Jammu and Kashmir, India. Email: support@onday.world.