Updated 14 October 2026 · Version 2026-10-14
Privacy Policy
What we collect, why, who handles it and your rights.
Who we are
Only70 is an online study aid for the DGCA Air Regulations syllabus. It is run by Vasu Nagpal (sole proprietor), who decides why and how your personal data is used (the “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023). In this policy, “we” means Vasu Nagpal.
Questions or requests about your data: email [email protected]. Our Grievance Officer is VASU MANOJ NAGPAL.
The short version
- We collect only what we need to run your account, take payment and keep the site secure.
- No analytics, no advertising, no tracking pixels, and we never sell or rent your data.
- You can ask to see, correct or delete your data at any time.
What we collect, and why
| Data | Why we need it | How long we keep it |
|---|---|---|
| Email address (required) | Your login, password resets and messages about your account or payment. | Until you delete your account. |
| Name (optional) | Shown in your account menu and on your payment record so we can match your payment. | Until you delete your account. |
| Password | Signing you in. It is stored only as a one-way hash by our database provider; nobody can read it back. | Until you delete your account. |
| Two-step login data (only if you turn it on) | An encrypted authenticator secret and hashed backup codes. | Until you turn it off or delete your account. |
| Payment record: plan, amount, order ID, the payment method type and the payment reference from our payment gateway (Cashfree), status and dates | Confirming your payment, switching on access, refunds, and our tax and accounting records. | As long as Indian tax and accounting law requires, even after your account is deleted. |
| Record that you agreed to these policies (date, policy version, sign-up or order) | Proof of your consent. | As long as your account or the related payment record exists. |
| Security log: time, IP address, browser type and the page, for sign-ins, failed attempts and similar events | Detecting and stopping account takeovers and abuse. | 90 days. |
| Rate-limit counters, keyed by a scrambled (hashed) form of your IP address | Stopping repeated password guessing and spam. | About 1 day. |
When you pay, you pay on the secure checkout of our payment gateway, Cashfree Payments, by card, UPI or NetBanking. Your card number, bank login and UPI PIN go to Cashfree and your bank, never to us. Cashfree tells us only whether the payment succeeded, the amount, the type of method used and its own payment reference.
Your theme (light or dark) and your study track (Core or Exam-Ready) and the last chapter you opened are saved only in your own browser, never sent to us. See the Cookie Policy.
Your consent
We ask for your consent when you create an account and again when you start a payment. You can withdraw consent at any time by deleting your account (email us). Withdrawing does not affect anything we did before, and we will still keep payment records that the law requires us to keep.
Who else handles your data
We use a small number of service providers to run the site. They process data only on our instructions:
- Supabase: database and login service (account, payment and security records).
- Cashfree Payments: our payment gateway. It receives your email address, name and order details so it can take your payment, and handles your card, UPI or bank details itself under its own privacy policy and the Reserve Bank of India's rules.
- Cloudflare: hosting and network security. When a sign-in looks suspicious we may show a Cloudflare Turnstile check, which processes information about your browser and device to tell people from bots.
- Resend: sends password-reset and account emails to your email address.
- Have I Been Pwned: when you choose a password, our server sends only the first 5 characters of a scrambled (SHA-1 hashed) version of it, to check whether it has appeared in a known data breach. Your password itself is never sent.
These providers may store data on servers outside India. Indian law allows this except to countries the Government restricts, and we will follow any such restriction. We do not share your data with anyone else unless the law requires it, for example a valid order from a court or government authority.
Your rights
Under the Digital Personal Data Protection Act, 2023 you can:
- ask for a summary of the personal data we hold about you and how we use it;
- ask us to correct, complete or update it;
- ask us to delete it, unless the law requires us to keep it;
- nominate someone to exercise these rights if you die or become unable to;
- complain to our Grievance Officer, and if you are not satisfied, to the Data Protection Board of India.
Email your request from your account's email address. We will acknowledge it within 48 hours and act on it within 30 days.
Children
Only70 is for people aged 18 or over. If you are under 18, a parent or legal guardian must create and manage the account and make any payment. If we learn that someone under 18 has created an account themselves, we will delete it.
Security
Passwords are hashed, sessions use secure, http-only cookies, two-step login is available, sign-in attempts are rate-limited, and our database is not reachable from the browser. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as Indian law requires.
Changes
If we change this policy in a way that matters, we will update the date below and ask you to agree again where the law requires it. Version 2026-10-14.