Privacy policy

What we collect, why, who sees it and how long we keep it.

Last updated 3 Nov 2026

1. What we collect

From Google when you sign in: your name, email address and profile photo.
What you add to your profile: a display name and handle, bio, photos, phone number, Instagram and other links, languages, your city.
For bookings: date of birth (only if you choose to add it), gender (for group composition on trips and experiences that ask), an emergency contact's name and phone, dietary notes, and the names of friends you book for.
Booking and payment records: what you booked, how much you paid or were refunded and the Razorpay references. We never receive or store card numbers, UPI PINs or bank passwords. Hosts' PAN and bank details are held by Razorpay; we keep only the last four digits for display.
If you connect Instagram (creator or business accounts only): your Instagram username, follower, following and post counts, and your latest posts' pictures, links and short captions. We keep Instagram's access key, encrypted, only to refresh these once a day; we can't post, read your messages or see your password. Disconnecting deletes the key and everything we copied, and so does removing OyeDash in Instagram's settings.
If you verify your ID: the document type, its last four digits (never a full Aadhaar number), the name and date of birth on it, a photo of your face (from DigiLocker, or a live selfie) and, for an upload, the document images. We encrypt the files and keep them in private storage. If you verify with DigiLocker, we also keep a coded fingerprint of your Aadhaar (made from the name, date of birth, gender and last four digits, never the number) so one Aadhaar stays with one account; it stays while your account exists, even if you delete your ID.
Chat: your messages, the photos, videos and files you attach, who you are connected to and whom you have blocked, and reports you make or that are made about you.
Technical data: your device's browser, IP address and the time of each request, kept in server logs, and one session cookie that keeps you signed in. We don't use advertising trackers.
Listing visits: when you open a listing page we count the visit, with where you came from (such as Instagram or a search engine, never the full address) and a random number your browser keeps so a visitor is counted once. If you're signed in, the visit is linked to your account unless you turned off "Let hosts see when I view their listings".
Preview links: when someone opens a private preview page we made for them, we record the time, the approximate place (city, region and country, from the network), the device and browser, the site they came from and, if they're signed in, their account, so we know the link reached the right person. We never keep the IP address itself. Only OyeDash staff see this, and we delete it after 180 days.

2. Why we use it

To run bookings: hold seats, take payment, pay hosts, issue refunds and send confirmations and reminders.
To let hosts run their trips and experiences safely: they need to know who is coming and how to reach them.
To run the group chat, reviews, follows and notifications you have turned on.
To keep people safe: handling reports, enforcing blocks, detecting fraud and misuse.
To meet legal duties, such as tax and accounting records.

We don't sell personal data and we don't use it for third-party advertising.

3. Who sees what

Everyone: your public profile: display name, handle, photo, bio, links and, if you turn them on, your city and how many trips you've been on. Your email is never shown.
The host of a trip or experience you have booked: the names of the people on the booking, your dietary notes and emergency contact, and, once your seat is confirmed, your phone number.
The host of a listing you open while signed in: your name, photo, profile link and when you last viewed it, never your phone or email. Turn this off any time in Settings → Privacy ("Let hosts see when I view their listings"); you then count only as an anonymous visit, for earlier visits too. People you've blocked, or who blocked you, never see this.
The host of a date you have a confirmed seat on, about your ID: whether it is verified, and, from when your seat is confirmed until the date ends (at least 5 days after it starts), your face photo from the ID check and the last four digits of the number. View only and watermarked; never the document itself. Every time a host opens it, it is logged and you can see it under Verify your ID.
Other guests in a trip group: only what you chose to share when you joined the group, which is always your name and photo and optionally your city and trip count. Never your gender, phone, email or date of birth.
OyeDash staff: booking and payment records when handling support; chat messages only when a participant reports them, and every such read is logged.

4. Services we rely on

These companies process data on our behalf under their own security commitments: Google (sign-in), Razorpay and Cashfree (payments, refunds, payouts and the hosts' bank and PAN checks; Cashfree also runs the DigiLocker ID check), Supabase (database and file storage), Resend (email delivery), Meta (Instagram, only if you connect your account), Render and Vercel (hosting). Data may be stored on their servers in India or abroad.

5. How long we keep it

Your profile and chat: for as long as your account exists.
Notifications: marked read after 30 days and deleted after 90.
Your ID check (document, face photo and details): deleted 30 days after your last booked date, unless you chose to keep it on file for future bookings. You can delete it yourself any time; only the log of who viewed it stays.
Reports and the audit trail of staff actions: 180 days after the report is closed.
Booking, payment, refund and payout records: for as long as Indian tax and accounting law requires (up to 8 years), even after you delete your account. Nobody can see them on OyeDash after that.
When you delete your account, your profile is blanked and your handle released, your photos and chat attachments are deleted, your messages are kept for the other participants but shown as from a deleted user, and your saved trips, connections, blocks, follows, notifications and settings are removed. We keep the reason you gave for leaving, without your name or email.

6. Your rights

See and get a copy of your data: download it yourself, as one file, from Your data and account (once a day).
Correct it: edit your profile and details under Account and its settings pages, and choose what other guests see in Privacy settings. Write to us for anything you can't change yourself.
Delete it: delete your account yourself from Your data and account (how it works). We show you what will be deleted and what we must keep first. Your account is hidden straight away and deleted after 30 days. We email you when you ask and again 2 days before. If you sign in during those 30 days, the deletion is cancelled. Upcoming bookings have to be cancelled first, and money still on its way (a refund or a payout) is finished first.
Withdraw your consent: turn off what you agreed to separately (group chat sharing and listing views in Privacy settings, emails in notification settings, your ID check in Verify your ID, a connected Instagram account). To withdraw it for everything, delete your account. Withdrawing doesn't undo what was done before, and we still keep the records the law requires.
Nominate someone: you can name a person to use these rights for you if you die or can't act yourself. Write to us to do this.

Questions about your data: our Co-founder & CTO answers questions about how OyeDash handles personal data. Write to support@oyedash.com with "Data request" in the subject, from the email address on your account if you have one. If you can't sign in, we can also export or delete your data for you after checking it's you.

Complaints about how your data is handled go to the same address, support@oyedash.com. If you are not satisfied with our answer, you may approach the Data Protection Board of India.

7. Children

OyeDash accounts are for adults. Chat and hosting require you to be 18 or older. We don't knowingly collect data from children; if you believe a child has created an account, tell us and we will remove it.

8. Changes

If we change this notice in a way that matters, we'll say so on the site or by email before it takes effect. The date at the top is the current version.

1. What we collect

From Google when you sign in: your name, email address and profile photo.

What you add to your profile: a display name and handle, bio, photos, phone number, Instagram and other links, languages, your city.

For bookings: date of birth (only if you choose to add it), gender (for group composition on trips and experiences that ask), an emergency contact's name and phone, dietary notes, and the names of friends you book for.

Booking and payment records: what you booked, how much you paid or were refunded and the Razorpay references. We never receive or store card numbers, UPI PINs or bank passwords. Hosts' PAN and bank details are held by Razorpay; we keep only the last four digits for display.

If you connect Instagram (creator or business accounts only): your Instagram username, follower, following and post counts, and your latest posts' pictures, links and short captions. We keep Instagram's access key, encrypted, only to refresh these once a day; we can't post, read your messages or see your password. Disconnecting deletes the key and everything we copied, and so does removing OyeDash in Instagram's settings.

If you verify your ID: the document type, its last four digits (never a full Aadhaar number), the name and date of birth on it, a photo of your face (from DigiLocker, or a live selfie) and, for an upload, the document images. We encrypt the files and keep them in private storage. If you verify with DigiLocker, we also keep a coded fingerprint of your Aadhaar (made from the name, date of birth, gender and last four digits, never the number) so one Aadhaar stays with one account; it stays while your account exists, even if you delete your ID.

Chat: your messages, the photos, videos and files you attach, who you are connected to and whom you have blocked, and reports you make or that are made about you.

Technical data: your device's browser, IP address and the time of each request, kept in server logs, and one session cookie that keeps you signed in. We don't use advertising trackers.

Listing visits: when you open a listing page we count the visit, with where you came from (such as Instagram or a search engine, never the full address) and a random number your browser keeps so a visitor is counted once. If you're signed in, the visit is linked to your account unless you turned off "Let hosts see when I view their listings".

Preview links: when someone opens a private preview page we made for them, we record the time, the approximate place (city, region and country, from the network), the device and browser, the site they came from and, if they're signed in, their account, so we know the link reached the right person. We never keep the IP address itself. Only OyeDash staff see this, and we delete it after 180 days.

2. Why we use it

To run bookings: hold seats, take payment, pay hosts, issue refunds and send confirmations and reminders.

To let hosts run their trips and experiences safely: they need to know who is coming and how to reach them.

To run the group chat, reviews, follows and notifications you have turned on.

To keep people safe: handling reports, enforcing blocks, detecting fraud and misuse.

To meet legal duties, such as tax and accounting records.

We don't sell personal data and we don't use it for third-party advertising.

3. Who sees what

Everyone: your public profile: display name, handle, photo, bio, links and, if you turn them on, your city and how many trips you've been on. Your email is never shown.

The host of a trip or experience you have booked: the names of the people on the booking, your dietary notes and emergency contact, and, once your seat is confirmed, your phone number.

The host of a listing you open while signed in: your name, photo, profile link and when you last viewed it, never your phone or email. Turn this off any time in Settings → Privacy ("Let hosts see when I view their listings"); you then count only as an anonymous visit, for earlier visits too. People you've blocked, or who blocked you, never see this.

The host of a date you have a confirmed seat on, about your ID: whether it is verified, and, from when your seat is confirmed until the date ends (at least 5 days after it starts), your face photo from the ID check and the last four digits of the number. View only and watermarked; never the document itself. Every time a host opens it, it is logged and you can see it under Verify your ID.

Other guests in a trip group: only what you chose to share when you joined the group, which is always your name and photo and optionally your city and trip count. Never your gender, phone, email or date of birth.

OyeDash staff: booking and payment records when handling support; chat messages only when a participant reports them, and every such read is logged.

4. Services we rely on

5. How long we keep it

Your profile and chat: for as long as your account exists.

Notifications: marked read after 30 days and deleted after 90.

Your ID check (document, face photo and details): deleted 30 days after your last booked date, unless you chose to keep it on file for future bookings. You can delete it yourself any time; only the log of who viewed it stays.

Reports and the audit trail of staff actions: 180 days after the report is closed.

Booking, payment, refund and payout records: for as long as Indian tax and accounting law requires (up to 8 years), even after you delete your account. Nobody can see them on OyeDash after that.

When you delete your account, your profile is blanked and your handle released, your photos and chat attachments are deleted, your messages are kept for the other participants but shown as from a deleted user, and your saved trips, connections, blocks, follows, notifications and settings are removed. We keep the reason you gave for leaving, without your name or email.

6. Your rights

See and get a copy of your data: download it yourself, as one file, from Your data and account (once a day).

Correct it: edit your profile and details under Account and its settings pages, and choose what other guests see in Privacy settings. Write to us for anything you can't change yourself.

Delete it: delete your account yourself from Your data and account (how it works). We show you what will be deleted and what we must keep first. Your account is hidden straight away and deleted after 30 days. We email you when you ask and again 2 days before. If you sign in during those 30 days, the deletion is cancelled. Upcoming bookings have to be cancelled first, and money still on its way (a refund or a payout) is finished first.

Withdraw your consent: turn off what you agreed to separately (group chat sharing and listing views in Privacy settings, emails in notification settings, your ID check in Verify your ID, a connected Instagram account). To withdraw it for everything, delete your account. Withdrawing doesn't undo what was done before, and we still keep the records the law requires.

Nominate someone: you can name a person to use these rights for you if you die or can't act yourself. Write to us to do this.

Complaints about how your data is handled go to the same address, support@oyedash.com. If you are not satisfied with our answer, you may approach the Data Protection Board of India.