Privacy Policy

Effective June 19, 2026

onva, Inc. ("onva," "we," "our," or "us") operates joinonva.com and the onva web application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service. Please read it carefully. If you disagree with its terms, discontinue use of the Service.

This policy applies to all users globally, with supplemental rights for residents of the European Economic Area (EEA), United Kingdom, and California described in dedicated sections below.

1. Information We Collect

Information you provide directly. When you create an account or use the Service, we collect: your email address; your first and last name; any profile photo you choose to upload; content you create (Plans, Ideas, RSVP responses, comments, and invitations); and communications you send us.

Information collected automatically. When you access the Service, we and our service providers automatically collect: IP address; browser type and version; device type and operating system; referring URLs; pages viewed and features used; timestamps; and session identifiers. We use this information to operate, maintain, and improve the Service and to detect and prevent fraud and abuse.

Information from third parties. We receive information from Clerk, Inc. ("Clerk"), our authentication provider, when you sign in, including your email address and account identifiers. If you connect a third-party account in the future, we may receive information from that service as described at the time of connection.

2. How We Use Your Information

We use your information to:

  • Create and manage your account and authenticate you;
  • Provide, operate, and improve the Service;
  • Enable social coordination features: showing your name and RSVP status to people you have invited or who have invited you;
  • Send transactional communications (sign-in codes, account notices);
  • Respond to your requests and support inquiries;
  • Monitor, analyze, and improve the Service's performance, security, and functionality;
  • Detect, investigate, and prevent fraud, abuse, and security incidents;
  • Comply with applicable legal obligations; and
  • Enforce our Terms of Service.

We do not use your information for behavioral advertising, profiling for sale, or any purpose materially different from those listed above without obtaining your consent.

3. Legal Bases for Processing (EEA and UK Users)

If you are located in the EEA or United Kingdom, we process your personal data under the following legal bases:

  • Contract. Processing necessary to provide the Service you signed up for, including account creation, authentication, and enabling Plan and Idea coordination.
  • Legitimate interests. Processing to detect and prevent fraud and abuse, improve the Service, and ensure security, where those interests are not overridden by your rights.
  • Legal obligation. Processing required to comply with applicable law.
  • Consent. Where we rely on consent (e.g., optional features), you may withdraw it at any time without affecting the lawfulness of prior processing.

4. How We Share Your Information

We do not sell your personal information. We share it only in the following circumstances:

Service providers. We share information with trusted third-party vendors who process it on our behalf, under contractual obligations of confidentiality and data protection:

Other users. Certain information is visible to other users as part of the Service's core functionality, for example, your display name and RSVP status are visible to participants of a Plan or Idea you belong to. You control what Plans and Ideas you create or join.

Business transfers. If onva undergoes a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of its assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.

Legal compliance and protection. We may disclose information if we believe in good faith that disclosure is necessary to: comply with applicable law or legal process; protect the rights, property, or safety of onva, our users, or the public; or detect or prevent fraud and security incidents.

With your consent. We may share information for any other purpose with your explicit consent.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. We retain certain information after account deletion to comply with legal obligations, resolve disputes, enforce agreements, and for legitimate business purposes such as fraud prevention and security. When retention is no longer necessary, we delete or anonymize your information.

6. Data Security

We implement and maintain reasonable administrative, technical, and physical security measures designed to protect your information against unauthorized access, disclosure, alteration, and destruction. These include encrypted data transmission (TLS), access controls, and use of SOC 2-compliant infrastructure providers.

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a security breach that affects your rights, we will notify you as required by applicable law.

7. International Data Transfers

onva is based in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from those in your country.

For transfers from the EEA or United Kingdom, we rely on appropriate transfer mechanisms, including Standard Contractual Clauses adopted by the European Commission, to the extent required. By using the Service, you consent to the transfer of your information to the United States and other countries as described in this policy.

8. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

  • Access. Request a copy of the personal information we hold about you.
  • Correction. Request correction of inaccurate or incomplete information.
  • Deletion. Request deletion of your personal information, subject to certain exceptions (e.g., legal obligations).
  • Portability. Request a machine-readable copy of information you have provided to us (EEA/UK users).
  • Objection. Object to processing based on legitimate interests or for direct marketing (EEA/UK users).
  • Restriction. Request that we restrict processing of your information in certain circumstances (EEA/UK users).
  • Withdrawal of consent. Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email privacy@joinonva.com. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before fulfilling your request. You will not be discriminated against for exercising your privacy rights.

EEA and UK residents have the right to lodge a complaint with their local data protection supervisory authority if they believe we have not addressed their concerns.

9. California Residents: CCPA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you the following additional rights:

  • Right to Know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business or commercial purpose for collecting it, and the categories of third parties with whom we have shared it.
  • Right to Delete. You may request deletion of personal information we have collected from you, subject to certain exceptions.
  • Right to Correct. You may request correction of inaccurate personal information.
  • Right to Opt Out of Sale or Sharing. We do not sell or share your personal information for cross-context behavioral advertising. If this practice changes, we will provide a "Do Not Sell or Share My Personal Information" mechanism.
  • Right to Limit Use of Sensitive Personal Information. We do not use sensitive personal information beyond what is necessary to provide the Service.
  • Right to Non-Discrimination. We will not discriminate against you for exercising your CCPA rights.

To submit a verifiable consumer request, email privacy@joinonva.com. You may also designate an authorized agent to make a request on your behalf. We will verify your identity before fulfilling any request.

In the past 12 months, we have collected the following categories of personal information: identifiers (email, name, IP address); internet or electronic network activity (usage data); and content (Plans, Ideas, RSVPs) you create. We have not sold or shared any personal information for cross-context behavioral advertising.

10. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information as quickly as possible. If you believe we may have collected information from a child under 13, contact us at privacy@joinonva.com.

If you are located in the EEA or UK, you must be at least 16 years old (or the applicable age of digital consent in your member state) to use the Service without parental consent.

11. Cookies and Tracking Technologies

We and our service providers use cookies and similar technologies (e.g., local storage, session identifiers) to operate the Service. These include:

  • Strictly necessary cookies. Required to provide the Service, including authentication session cookies set by Clerk. These cannot be disabled.
  • Functional cookies. Used to remember your preferences and settings.

We do not use advertising or tracking cookies. You may configure your browser to refuse cookies, but this may affect the functionality of the Service, including your ability to sign in.

12. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing them with your information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last Updated" date, and, where required by law, by sending you an email notification. Your continued use of the Service after any change constitutes your acceptance of the updated policy.

14. Contact Us

For privacy questions, rights requests, or concerns, contact us at:

onva, Inc.
Attn: Privacy
privacy@joinonva.com