Your data, simply.

OneLife by Flax is operated by Health and Beyond Foods Pvt Ltd, trading as Flax – Healthy Living ("we", "us"). We run the meal-plan and à-la-carte service available at onelife.flaxitup.com and via our iOS and Android apps. This page explains, in plain language, what we collect, why, and what we do with it.

What we collect

• Phone number or email — to sign you in via one-time password. Required.
• Name + delivery address(es) — to deliver your food. You provide these; we never harvest contacts.
• Approximate location (mobile app only) — to suggest the nearest outlet. Asked for explicitly the first time; you can deny without losing functionality.
• Order + subscription history — to show your past orders and let you re-order or manage subscriptions.
• Payment details — handled entirely by Razorpay. We never see or store your card or UPI ID; only Razorpay's encrypted transaction reference.
• Push notification token (mobile app only) — to send you order-status updates ("kitchen ready", "out for delivery"). Stored encrypted; can be revoked any time from the OS settings.
• Device crash logs — anonymous, aggregated, used only to fix bugs.

Wearable data (optional)

If you choose to connect a wearable such as WHOOP, we read — with your permission, granted on WHOOP’s own consent screen — your daily recovery score, heart rate variability, resting heart rate, blood oxygen and skin temperature (where your device reports them), strain, energy burned, steps, sleep duration, stages and performance, workouts, height, weight and maximum heart rate, plus the name and email on your WHOOP account so we can match it to your OneLife account.

• Why: only to personalise dish suggestions and wellness tips, and to show how your recovery and sleep change alongside your OneLife meals. These are general wellness suggestions, not medical advice.
• Never: sold, shared with partners, or used for advertising.
• Read-only: we never write anything back to your WHOOP account.
• Disconnect any time: we revoke our access with WHOOP and delete all wearable data we synced, immediately.

What we don't do

• We don't sell your data to third parties. Ever.
• We don't run ad tracking. There is no Google Analytics, Facebook Pixel, or similar embedded in our apps.
• We don't share your phone number outside Flax except with our courier (Borzo) and our kitchen partner (Petpooja) — and only for the specific order they're fulfilling.

Who we share with

To get your food to you, the following partners receive the minimum data required:

• Razorpay — payment processing. Receives the order amount + your contact for receipts.
• Petpooja — our kitchen + billing system. Receives the order items + your delivery address + phone for kitchen call-back.
• Borzo — last-mile rider partner. Receives the pickup outlet and your drop address + phone.
• Msg91 — sends our WhatsApp + SMS notifications. Receives your phone number + the message body.
• Resend — sends our order and subscription emails. Receives your email address + the message body.
• Supabase — our database hosting. All your data lives in their Singapore region.

Each partner has signed a data-processing agreement with us. None of them have permission to use your data for their own marketing.

How long we keep your data

• Account + profile: as long as your account exists. Delete the account → we delete the data within 30 days.
• Order history: 7 years (required by Indian tax law).
• Push tokens: deleted automatically when you uninstall the app.
• Wearable data: kept while your wearable is connected; deleted immediately when you disconnect it or delete your account.
• Crash logs: 90 days.

Your rights

You can:

• See everything we have about you — email us at privacy@flaxitup.com and we'll send a copy within 30 days.
• Correct anything that's wrong — just edit your profile or addresses in the app.
• Delete your account — tap Account → Sign out → "Delete my data" (mobile app) or email us.
• Opt out of marketing notifications — toggle them off in the OS notification settings; or reply STOP to any WhatsApp message.

Changes to this policy

If we materially change what we collect or who we share with, we'll notify you in-app and via email at least 30 days before the change takes effect.

Children

OneLife is not for children under 13. We do not knowingly collect data from anyone under 13. If you believe we have, contact us and we'll delete it within 7 days.