Privacy
Policy

1. Who We Are

Ookubb ("Platform", "we", "us", "our") is an independent, student-built social platform combining feeds, communities, direct messaging, and event promotion — a campus-first but globally accessible social space. Ookubb is not affiliated with, endorsed by, or sponsored by Chandigarh University or any other educational institution, government body, or corporation. The "CU" in our name carries no institutional meaning.

The Platform is operated by individual students on a personal, independent, non-institutional basis.

As required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules 2021), we designate:

2. Global Scope and Jurisdiction

Ookubb is accessible worldwide, including from India, Japan, and other countries. This Policy is governed by Indian law. Users outside India, please note:

• All users: Your data may be stored and processed in India and/or the United States (via Vercel). By using the Platform you explicitly consent to this cross-border transfer.
• EEA/UK users: We do not specifically target the European Economic Area or the UK. If you access the Platform from these regions, you do so voluntarily. We process your personal data on the lawful basis of explicit consent, which you provide via the consent checkbox at signup. You may withdraw consent at any time by deleting your account.
• Japan users: We are not registered under Japan's Act on the Protection of Personal Information (APPI). Use from Japan constitutes consent to Indian-law processing.
• General: We make no jurisdiction-specific compliance guarantees beyond Indian law. If your country's laws impose additional requirements, you are responsible for determining whether using this Platform is lawful for you.

3. What We Collect

3a. Data You Give Us

• Google OAuth: Name, email, profile photo. We never see your Google password.
• Profile: Username, bio, avatar, and any other profile fields you fill in.
• Content: Posts, comments, DMs, images, links, event listings, community content — everything you create on the Platform.
• XP & Promotion Data: Events or content you promote, XP earned, XP purchased, and promotion duration/settings.
• Payment Data: When you purchase XP, payment is processed entirely by Cashfree Payments. We do not store your card details, CVV, UPI ID, or bank credentials. We only receive a transaction confirmation reference ID from Cashfree. Cashfree's Privacy Policy governs their handling of your financial data.
• Support & Grievance: Emails and messages you send us.

3b. Automatically Collected

• IP address and approximate location (country/city level)
• Browser, device type, OS, and screen resolution
• Pages visited, features used, session duration
• Referral URLs and navigation flow
• Error logs and crash data
• Cookies and local storage set by us or our infrastructure providers (Vercel, Cashfree)

3c. What We Do NOT Collect

• Aadhaar, PAN, passport, or any government-issued ID
• Full payment card or bank account data (Cashfree handles this)
• Data from persons knowingly under 18
• Precise real-time location (GPS)

4. How We Use Your Data

• To operate all Platform features: feeds, communities, messaging, events, promotions
• To authenticate you and manage your session via Google OAuth
• To manage your XP balance, process purchases, and execute promotions you pay for
• To process refund requests within the window in our Refund Policy
• To send transactional notifications (purchase confirmation, refund status) — not unsolicited marketing
• To detect fraud, abuse, spam, and Terms violations
• To respond to grievances, legal notices, and support queries
• To comply with applicable law and court/government orders
• To analyse anonymised usage data and improve the Platform

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

5. Third-Party Data Sharing

• Google — Authentication. Governed by Google's Privacy Policy.
• Vercel — Hosting and infrastructure. Processes server/access logs. Servers may be in the US.
• Cashfree Payments — Payment processing for XP purchases. PCI-DSS compliant Indian payment aggregator. Governed by Cashfree's Privacy Policy.
• Cloudinary — Media storage and delivery. Hosts user-uploaded avatars, images, and videos. Data may be processed on Cloudinary's global CDN. Governed by Cloudinary's Privacy Policy.
• OneSignal — Push notification delivery. Receives device tokens to send push notifications. Governed by OneSignal's Privacy Policy.
• Legal Authorities — We may disclose data if required by law, court order, or government directive (India or internationally), or to prevent serious harm.
• Business Transfer — If the Platform is transferred or acquired, data may transfer. We will notify users in advance via the Platform.

No other third-party sharing occurs.

6. Storage, Security, and Retention

We apply reasonable technical and organisational measures to protect your data. However, no system is completely secure, and we cannot guarantee absolute protection against breaches. You use the Platform at your own risk in this respect.

Data may be stored on servers outside India (via Vercel, US-based). You consent to this cross-border storage by using the Platform.

Retention periods: account data — until deletion request or account inactivity >2 years; transaction/payment records (XP purchases, refunds) — minimum 3 years for legal/financial compliance; legal/grievance records — as required by applicable law. You may request deletion at namanaryan002@gmail.com, subject to retention obligations.

In the event of a personal data breach likely to result in risk to Data Principals, we will notify affected users and report to the Data Protection Board of India within 72 hours of becoming aware. Notification will be sent to your registered email and posted on the Platform.

7. Your Rights (DPDP Act 2023 / IT Act 2000)

• Access: Request a summary of your personal data we hold.
• Correction: Request correction of inaccurate data.
• Erasure: Request deletion of your data. Transaction records may be retained per legal obligations even after account deletion.
• Withdraw Consent: Withdraw consent (delete your account) at any time. Withdrawal does not undo prior processing.
• Grievance Redressal: File a grievance with our Grievance Officer. If unresolved in 15 days, escalate to the Data Protection Board of India (under DPDP Act 2023).
• Nomination: Under DPDP Act 2023, you may nominate someone to exercise your rights in case of death or incapacity.

Contact: namanaryan002@gmail.com — subject line: [PRIVACY REQUEST]

8. Children's Privacy

This Platform is strictly not intended for anyone under 18 years of age. We do not knowingly collect data from minors. Under the DPDP Act 2023, processing data of minors requires verifiable parental consent — which we are not currently equipped to collect. If you are under 18, do not use this Platform. If we discover a minor is using the Platform, we will delete their account and data without notice. If you believe a minor is using the Platform, contact namanaryan002@gmail.com immediately.

9. Cookies

We use cookies and similar technologies for session management and Platform operation. Our infrastructure providers (Vercel, Cashfree) may set additional technical and security cookies. By using the Platform you consent to this. You may disable cookies in your browser but core functionality including login will break. A cookie consent banner is shown to all users on first visit. You may decline non-essential cookies. Declining will disable analytics tracking while keeping core session functionality intact.

10. Public Content and XP Promotions

Content you post publicly — including events you promote using XP — may be visible to all users and potentially the open internet. Promoted content reaches a wider audience by design. We are not responsible for how others screenshot, share, or use publicly visible content. Do not post sensitive personal information about yourself or others in public areas of the Platform.

11. Policy Changes

We may update this Policy at any time. Changes take effect when posted. Continued use after changes = acceptance. For changes affecting paid features or material data rights, we will endeavour to give advance notice via Platform notification or email.

12. Contact