Privacy notice

Last updated 9 November 2026

This notice says what ownapp.store and the OwnApp ID (the sign-in at id.ownapp.store) keep about you, why, for how long, who else sees it, and what you can ask us to do. An app you buy runs on your own server, or on ours if we host it, and has its own notice.

1. 1. Who is responsible

   RupeeStack Platform Private Limited decides how your personal data is used here: we are its "data fiduciary" under India’s law and its "controller" under the UK’s. Write to privacy@ownapp.store about anything in this notice.

   Sources: Digital Personal Data Protection Act 2023 (India), section 2(i); UK GDPR, Article 13

2. 2. What we keep

   Your account: your email address, a random account number, and when you first and last signed in.

   Signing in: the code we email you, kept only in a scrambled form, usable for 10 minutes and deleted after a day, and records of wrong codes, kept a day. If you have signed in on this browser before, we keep your email address with a scrambled copy of the cookie that remembers it, for 180 days. The network address you connect from is used, in memory only, to limit how many codes are asked for; we do not write it to our database.

   Waitlists: the app, your country, and whether you would like the code or hosting.

   Requests: for a design partnership, your business’s legal name, its country and what you tell us about it; for hosting, the name you would like, your business’s legal name, its country and your note.

   Buying: your business’s legal name, address and country, the app, its price, the dates, the order, licence and invoice numbers, and each download (which release, and when). We send our payment provider your email address and your order’s number. It takes your payment on its own page, asks there for your business’s address, and may ask you for more, such as your name, under its own notice. From it we keep the address, for your invoice, the country of the card you paid with, which with the address decides whether your invoice is an export, its reference numbers for your payment, whether you paid, the amount and the currency. We never see your card number.

   Emails we send you: what we sent and when, kept 30 days after sending. One we could not send stays until a person deletes it.

   Records of what happens: our service’s own logs note events such as a sign-in or a download with your account number, never your email address, and stay on our server. OwnApp’s admin keeps a log of its own actions, such as answering your request.

   We do not use analytics or advertising, and we do not buy data about you.

   Sources: DPDP Rules 2025 (India), rule 3; UK GDPR, Article 13; ICO, the right to be informed

3. 3. Why we use it

   Only for what you asked for: to sign you in and keep you signed in; to tell you once, by email, when an app on your waitlist can be bought; to answer your requests; to sell you an app, deliver it, and keep your licence and its downloads; to keep the store and your account safe; and to keep the records the law asks of a company. We do not send marketing emails, sell your data, show you advertising, or make automatic decisions about you.

   In India, you give us this data for these purposes, which the law allows without a separate consent; we will ask before using it for anything else.

   In the UK, where you buy or ask as a person (a sole trader, say), we use it to make and keep our contract with you. Otherwise we rely on our legitimate interests: running the store’s waitlists and requests for businesses, keeping it secure, and keeping proper records. You may object to that use at any time (see "Your rights").

   Sources: Digital Personal Data Protection Act 2023 (India), sections 4 and 7(a); UK GDPR, Article 6; UK GDPR, Article 21; ICO, legitimate interests

4. 4. Who else sees it

   The companies that run parts of the store for us, under contract and only for these purposes: Hetzner Online GmbH, a company in Germany, which rents us the server the store runs on, in its data centre in Falkenstein, Germany; and Brevo, a company in France, which sends our emails.

   Our payment provider, Stripe, which takes your payment on its own page. For some of what it does with that payment, Stripe acts for itself, under its own privacy notice (stripe.com/privacy).

   Nobody else, unless the law makes us, for example a court order.

   Sources: Digital Personal Data Protection Act 2023 (India), section 8(2); UK GDPR, Article 13

5. 5. Where it is kept

   The store’s data is on its server in Germany. Brevo, which sends our emails, is in France. We work from India, where we read it when we answer you. If you are in the UK: UK law treats Germany and France as protecting personal data adequately, and has made no such decision for India; we protect your data as this notice says wherever we work on it.

   Sources: UK GDPR, Articles 44 to 49; ICO, international transfers; Digital Personal Data Protection Act 2023 (India), section 16

6. 6. How long we keep it

   Sign-in codes and wrong-code records: a day. A session ends after 12 hours, or 30 days if you choose to stay signed in, and is then deleted. The browser your email address was remembered on: 180 days. Emails we sent: 30 days. Download links: a day after they stop working.

   Your account, waitlists and requests: until you ask us to delete them. Leaving a waitlist deletes your place on it straight away.

   Orders, licences, invoices and downloads: as long as your licence lasts, and at least eight financial years after the one you bought in. That is how long India’s company law asks a company to keep its books, and longer than GST law asks (72 months from the due date of the year’s annual return).

   From 13 May 2027, India’s rules ask every company to keep personal data, traffic data and logs of what it did with them for at least a year after it did it. We will.

   Sources: Digital Personal Data Protection Act 2023 (India), section 8(7); DPDP Rules 2025 (India), rule 8(3); Companies Act 2013 (India), section 128(5); CGST Act 2017 (India), section 36; UK GDPR, Article 13

7. 7. Your rights

   You may ask us for a summary of what we keep about you and who we shared it with, a copy of it, to correct or complete it, or to delete it. In the UK you may also ask us to restrict how we use it, object to how we use it, or, where the law gives that right, have it in a form you can take elsewhere. In India you may name someone to act for you if you die or cannot act.

   Write to privacy@ownapp.store from the email address on your account; that address is how we know it is you, and we may send it a code to check. We answer within one month.

   If you ask us to delete your account, we delete your waitlists and your requests, delete your account or, if you bought something, remove your email address from it and from its orders, and tell you what we must keep, such as the records of what you bought, and why. We do this by hand, within one month of your asking.

   Sources: Digital Personal Data Protection Act 2023 (India), sections 11 to 14; DPDP Rules 2025 (India), rule 14; UK GDPR, Article 12; UK GDPR, Articles 15 to 21

8. 8. Complaints

   Write to privacy@ownapp.store first. We acknowledge your complaint within 48 hours and answer it within one month.

   If you are in the UK, you may complain to the UK’s regulator, the Information Commission (ico.org.uk/make-a-complaint). If you are in India, once you have used our grievance route you may complain to the Data Protection Board of India.

   Sources: Digital Personal Data Protection Act 2023 (India), section 13; UK GDPR, Article 77; The Information Commission succeeds the ICO (GOV.UK)

9. 9. Cookies

   We use only the cookies the store and the sign-in need to work. __Host-oa_store and __Host-oa_id keep you signed in. __Host-oa_store_csrf and __Host-oa_id_csrf stop other websites from acting as you. __Host-oa_store_flow, __Host-oa_id_signin and __Host-oa_id_pending carry a sign-in from one step to the next, for minutes. __Host-oa_id_known remembers, for 180 days, that this browser signed in to your address before, so that someone else asking for codes for your address cannot lock you out.

   None is for analytics or advertising, and none is shared with anyone. Because each is needed for what you asked for, or to keep your account safe, the law does not ask for your consent to them.

   Sources: Privacy and Electronic Communications Regulations 2003 (UK), regulation 6; ICO, the exceptions for storage and access technologies

10. 10. Keeping it safe

    Every page goes over an encrypted connection. Codes and session keys are kept only in scrambled form. Waitlists, requests and orders are seen only in OwnApp’s admin, which only the people named as its admins can open (today, the founder alone); an admin may download a waitlist to write to it. Our database accepts the store’s own service alone. If your data is ever exposed, we tell you, and the regulators, as the law requires.

    Sources: Digital Personal Data Protection Act 2023 (India), sections 8(5) and 8(6); DPDP Rules 2025 (India), rules 6 and 7; UK GDPR, Article 32

11. 11. Children

    The store sells to businesses and is not meant for anyone under 18. We do not knowingly keep the data of anyone under 18.

    Source: Digital Personal Data Protection Act 2023 (India), sections 2(f) and 9

12. 12. When these laws apply

    Most of India’s Digital Personal Data Protection Act, and the Rules made under it, take effect eighteen months after 13 November 2025, on 13 May 2027. The UK’s law changed through the Data (Use and Access) Act 2025, and its regulator is now the Information Commission.

    We put every version of this notice here with its date. If a change affects what we do with your data, we email account holders before it takes effect.

    Sources: G.S.R. 843(E), 13 November 2025 (MeitY); DPDP Rules 2025 (India), rule 1; Data (Use and Access) Act 2025: plans for commencement (GOV.UK); The Information Commission succeeds the ICO (GOV.UK)