The short version
- No accounts. You can read every free preview without giving us any personal data.
- At checkout, email and phone are optional. Razorpay handles the payment; we never see card or UPI details.
- Your pass code lives in your browser. We keep only a one-way hash of it, so we can’t read it back.
- Saved projects and “helpful” marks stay on your device. Analytics cookies only with your consent.
- We don’t sell your data. Write to us to see, correct or erase what we hold.
This policy explains how KiloByteCrew (“we”, “us”), which runs OnlyProjects, handles personal data. We are the data fiduciary for the data described here. It is written for the Information Technology Act, 2000 and its rules, and for the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and its rules as they come into force.
1. What we collect
When you buy a pack
- Email and/or phone number, if you choose to give them. Both are optional. We pass them to Razorpay to pre-fill the payment form and send your receipt, and we keep them with the purchase so we can help you recover a lost pass code and answer support requests.
- Your pass code, as a hash. The full code is generated on our server, stored in your browser in a secure cookie and shown to you on the “Your pass” page. We store only a one-way hash of it and its last four characters. We cannot recover the code from what we store.
- Payment records. The pack, amount, currency, status, Razorpay order and payment IDs, the payment method type (for example UPI or card), and timestamps. Your card number, UPI PIN, UPI ID and bank login are collected by Razorpay directly and never reach our servers.
- What you unlock. Which projects each pass has unlocked, and when, so your unlocks keep working.
When you use the site
- Technical data. Your IP address and browser details reach our servers with every request. We use the IP address briefly, in memory, to rate-limit abuse such as pass-code guessing; our hosting provider keeps standard request logs for a short period for security and debugging.
- Data that stays on your device. Saved projects, “helpful” marks and your theme preference are kept in your browser’s storage. They are never sent to us.
- Analytics, only with consent. If we turn on analytics or advertising measurement (for example, Google Analytics or Google Ads conversion tracking), their cookies are set only after you agree, and saying no changes nothing else on the site.
We do not collect your name, address, college, roll number or any government ID.
2. Cookies
| Cookie | Purpose | Type | Lasts |
|---|---|---|---|
op_pass | Holds your pass code so this browser stays unlocked. Not readable by page scripts. | Strictly necessary | 400 days |
op_has_pass | A yes/no hint that this browser has a pass, so the site knows to show your credits. | Strictly necessary | 400 days |
| Analytics cookies | Aggregate usage statistics and ad measurement. | Optional, with consent | Per provider |
Strictly necessary cookies are part of the purchase you asked for, so they don’t need consent. Clearing them removes your pass from this browser (you can restore it with the code).
3. Why we use it
- To take your payment, issue your pass, deliver what you unlocked and keep it working.
- To help you recover a lost code, answer support requests and process refunds.
- To keep the site secure and prevent fraud and abuse.
- To keep the records that tax and accounting laws require.
- With your consent only: to understand how the site is used and measure our advertising.
Under the DPDP Act, we process purchase data because you gave it to us for that specific purpose, legal records because the law requires them, and analytics data on the basis of your consent, which you can withdraw at any time. We do not use your data for automated decisions about you, and we do not sell or rent it.
4. Who processes it for us
We share personal data only with service providers that process it on our instructions:
- Razorpay: payment processing, receipts and refunds (its own privacy policy covers the payment details it collects directly);
- Vercel: website hosting and request logs;
- Neon: our database;
- Cloudflare: storage and delivery of downloadable files; and
- Google: analytics and ad measurement, only if you consent.
Some of these providers process data outside India, for example in the United States, under contractual safeguards and subject to any restrictions notified under the DPDP Act. We may also disclose data when the law requires it, such as a valid request from a government authority or court.
5. How long we keep it
- Purchase and payment records: for as long as tax and accounting laws require (currently up to eight years), then deleted.
- Email and phone on a purchase: kept with that purchase for recovery and support. You can ask us to erase them sooner; you will then no longer be able to recover a lost code with your email.
- Pass hash and unlocks: for as long as the pass exists, because that is what keeps your unlocks working.
- Rate-limit data: minutes, in memory only. Hosting logs: a short period set by the hosting provider.
6. Security
Traffic is encrypted with HTTPS. Pass codes are stored only as hashes, the pass cookie can’t be read by page scripts, sensitive endpoints are rate-limited, downloads require a valid unlock, and access to our systems is restricted to the people who run the service. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
7. Your rights
Subject to the law, you can ask us to:
- give you a summary of the personal data we hold about you and how we use it;
- correct, complete or update it;
- erase it, unless we must keep it by law;
- withdraw a consent you gave (this doesn’t affect anything done before); and
- register a nominee to exercise these rights on your behalf.
Email support@onlyprojects.online with “Privacy request” in the subject. Because we have no accounts, we will ask for the payment ID or the email or phone used at checkout to find your records and confirm they are yours. You also have the right to have grievances addressed by us (below) and, after that, to complain to the Data Protection Board of India.
8. Children
You can read the free previews without giving us any personal data. We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or guardian. If you are under 18, ask a parent or guardian to make the purchase. We do not track children or target advertising at them. If you believe a child has given us personal data without that consent, write to us and we will delete it.
9. Grievance Officer
Questions or complaints about your personal data go to the Grievance Officer at support@onlyprojects.online. We acknowledge grievances within 48 hours and aim to resolve them within one month. See also the contact page.
- Business
- KiloByteCrew, operating OnlyProjects
- Website
- onlyprojects.online
10. Changes to this policy
We will update this policy when our practices change; the date at the top shows the current version. If a change affects how we use data you have already given us, we will say so on the site before it takes effect and, where the law requires, ask for your consent again.