Privacy policy

Version 1, last updated 30 September 2026.

theonebytwo is a matrimonial app run by Buddytech India Private Limited ("we", "us"), the data fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023. This policy explains what we collect, what we keep, who else handles it, what we never do, and how you control it. If anything here is unclear, write to pritika@theonebytwo.com.

The short version

• We never sell your data, we do not show ads, and we do not use your data to train AI models.
• We never store your emails, or the passwords or access keys of the accounts you connect. Emails are read once, in memory, and discarded.
• Every account you connect is optional, has its own permission, and can be taken back at any time in Settings, under Privacy choices. Taking it back deletes what we made from it.
• Other companies handle your data only where they run part of the app for us, and only what that part needs. They are all named in section 6.
• You can delete your account in the app at any time, and it is deleted straight away.

1. What you give us

• Your phone number, to sign you in with a one-time code. It is never shown to anyone.
• Profile details: your first and last name, date of birth (others see your age), gender, city, and, if you add them, your pronouns, the languages you speak, your education, where you work, and whether you smoke or drink.
• Social links: your LinkedIn profile (needed for your profile to be shown), and if you add them, Instagram and X. We store only the handle and never read anything from these networks. Links are shown only to people you have matched with, each behind its own switch.
• Photos and videos for your profile and behind your tiles. We re-create every photo and video before storing it, so location and camera details inside the original file are not kept.
• Answers you write to profile questions, and the preferences for who you want to see (age range, genders, cities, languages, education).
• What you do in the app: requests you send (and the line you add), matches, passes, blocks, profiles you save, and, when you spend a few seconds on someone's profile, that you looked. Nothing about looking is recorded while you are in stealth mode.
• Chats: messages, photos and videos you send to people you have matched with.
• Reports you file, the reason you give when you unmatch, and feedback you send us.
• Purchases: which Premium plan you have and when it runs. Apple takes your payment; we never see your card or bank details.
• Your device: an app-generated device id, the app version and platform, and a notification token, to keep you signed in and send you notifications.

2. Accounts you choose to connect

Each is optional and asks for its own permission, whose full text you see before you agree. We read each account once, while your profile is being built, and again only if you ask. For Google and Apple we receive a short-lived access key, use it for that one read, and never store it; Google's is cancelled straight away.

YouTube (through Google)

We read the channels you subscribe to, the videos you have liked, and the videos in your playlists, with each video's channel, topic and category. We never read your playlists' names, your comments, or anything you uploaded, and Google does not give us your watch history.

Gmail (through Google)

We read only order receipts from Zomato and Swiggy, order confirmations from Myntra, Zara and H&M, and booking confirmations from airlines, IRCTC, travel, hotel and ticketing sites and District, from the last three years. We find them by searching for those senders; we open no other email and no attachment, and accept an email only when Google confirms it came from that company.

• From food receipts we keep the restaurant, when you ordered, the amount paid and the dishes.
• From shopping orders we keep when it arrived and each item's brand, name, colour and quantity, never its price or size. Orders with anything for a child, maternity, innerwear, religious, plus-size, medical or sexual wellness are not kept at all.
• Booking confirmations are never opened. From the sender, subject line and time we keep only the kind of booking, the site, and when it arrived (and, for District, the restaurant and table time). We never learn where you travelled, when, with whom, or what you paid.
• We never keep the emails, your name or address, the restaurant's address, how you paid, or order numbers (only a scrambled form, to avoid counting an order twice). We keep each connected Gmail address so you can tell your accounts apart; only you see it.

Netflix (a file you upload)

The viewing history of your own Netflix profile: the title and date of each view. We refuse Netflix's full account download, which covers everyone on the account.

Spotify (a file you upload)

For each song played for 30 seconds or more: the artist, the song, when and for how long, and Spotify's id for it. Podcasts, audiobooks, private-session listening, and the IP address, country, device and username in the file are dropped before anything is stored.

Apple Music

The songs and albums in your library, with their artist, album, genre, year, length and Apple's catalog id. Not your playlists, and Apple has no listening history to give. Anything Apple files as religious or devotional is not kept.

DigiLocker (verification)

If you choose to verify, DigiLocker tells us your name and date of birth as on your Aadhaar so we can check them against your profile, then we discard them. We keep only a scrambled form of your DigiLocker account number and when you were verified. We never receive your Aadhaar number, and nothing from DigiLocker is used for matching or insights.

3. How we use it

• Your profile. Our own code counts things in your connected data (for example your most-played artist) and shows them to you as insights. You choose which appear.
• Matching, if you allow it: suggesting people to you and you to them, from your preferences, answers and patterns in your data. For food, shopping, travel, Netflix, Spotify and Apple Music we use only patterns (how often, how late), never which restaurants, dishes, brands, places, shows or artists. Insights you hide still count here; nobody else sees them. We record which profiles we showed you and how we scored them, to improve suggestions.
• AI suggestions, if you allow them: see section 4.
• Sharing with family and friends, if you and a match both choose it: a link to each other's profile. The family page carries a few sentences written by the AI service from your visible insights (only with your AI permission) and your LinkedIn link; the friends page carries your tiles and the social links you have switched on.
• Notifications. New requests, matches and messages (a message notification shows the sender's first name and the start of what they wrote), a daily count of who viewed your profile, reminders you asked for, and occasional news about theonebytwo, which you can turn off in Settings.
• Safety. Every photo and video sent in a chat is checked for sexual content by a model running on our own servers; nothing is sent elsewhere to check it. Chat messages are checked for abusive words and phone numbers. Our moderators review reports, and can see a reported person's profile, photos and the messages the report points to, never their phone number. The app keeps other people's profiles and chats out of screenshots.
• Premium: knowing which plan you hold and when it ends.

4. AI suggestions (optional, separate permission)

If you agree, we send summaries of your connected data to an AI service, Claude by Anthropic, which suggests which insights to show and writes their captions: totals and patterns, and the names behind them (channels, restaurants, dishes, shows, artists, brands, colours, booking sites). We never send your name, phone number, photos, messages, emails, amounts paid, order numbers, anywhere you travelled, anything from DigiLocker, or anything we have left out because it could point to your religion, caste, health, sexuality or politics. The AI never produces a number about you; our own code counts everything. Anthropic processes this outside India, may not use it to train its models, and deletes it within 30 days.

5. What we will not infer

Food, music, viewing and shopping can hint at religion, caste, sexual orientation, health or income. Data that points at those is left out of insights and matching entirely, amounts you paid are never shown or used for matching, and we never compute or show such conclusions about you.

6. Who else handles your data

These companies run part of the app for us, and receive only what that part needs:

• Our hosting provider, which runs our servers and stores the app's data, photos included. Today that is Railway, with servers in Singapore.
• Google: Firebase delivers notifications (with Apple's service on iPhone), and, while we use it, sends and checks your sign-in code, keeping its own record of the numbers it verified. YouTube and Gmail data come from Google when you connect them.
• An SMS provider, when we send sign-in codes ourselves.
• Apple: the App Store takes Premium payments, and Apple Music's catalog is asked for a song's cover and preview, by the song's name and artist only.
• RevenueCat, which records your App Store purchases for us, under our own id for you, not your name or number.
• Anthropic, only if you allow AI suggestions (section 4).
• DigiLocker (National e-Governance Division, Government of India), only if you choose to verify.

Other people see what you put on your profile, and your matches see your social links if you switch them on. We share data with authorities only when Indian law requires it. If theonebytwo is ever sold or merged, your data would pass to the new owner under this policy, and we would tell you first.

7. How long we keep it

• What we read from an account is kept until you disconnect it or take back its permission, when it is deleted along with the insights and matching signals made from it.
• After an unmatch, the chat closes for both people and is deleted 14 days later, unless someone has reported it, in which case it is kept until the report is resolved.
• Deleting your account is immediate and permanent. If a report against you is open, your account is closed at once but kept until the report is resolved, then deleted. Deleting your account does not cancel an App Store subscription; cancel it in your Apple ID's Subscriptions.
• After deletion we keep a record that each permission was given and taken back (which text, and when) with nothing that identifies you, as proof we asked, and a security log of actions that holds no names, numbers or content. Apple keeps its own record of purchases.

8. Security

Data travels encrypted. Photos are served through short-lived links. We never store the access keys of accounts you connect. Our moderators work from a separate, password-protected system and see only what a report needs. No system is perfectly secure; if a breach affects you, we will tell you and the Data Protection Board as the law requires.

9. Your rights

Under the Digital Personal Data Protection Act you can ask what we hold about you, correct it, have it erased, take back any permission, name someone to act for you if you cannot, and complain. You can edit your profile, take back permissions (Settings, Privacy choices) and delete your account in the app. For anything else, write to pritika@theonebytwo.com. We acknowledge within 24 hours and reply within the time the law sets. If our reply does not settle it, you can complain to the Data Protection Board of India.

10. Age

theonebytwo is only for people aged 18 or over. We do not knowingly process a child's data; an account found to belong to someone under 18 is deleted.

11. Google user data

theonebytwo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to build the profile features described above, which you can see in the app. We do not use it for advertising, we do not sell it, we do not let people read it except with your permission, for security, or where the law requires, and we do not use it to train AI models.

12. Changes

If we change what we collect or how we use it, we will update this page, tell you in the app, and ask you again where the law requires it.