Privacy Policy

Overview

NinjaDeals is a community-powered deals platform at ninja.deals and in our native Android and iOS apps. This policy explains what data we collect, why we collect it, and the choices you have. It is written with India’s Digital Personal Data Protection (DPDP) Act in mind.

Your use of NinjaDeals is also governed by our Terms of Service.

Google sign-in data

NinjaDeals requests the openid, email and profile permissions for Google sign-in. We receive your Google account identifier, email address, verified-email status and name from a validated Google ID token. Your name can initialize your account profile or handle. We use this information to authenticate you, create or link your NinjaDeals account, prevent duplicate accounts and operate account features. We do not request access to Gmail messages, Google Drive files or Google contacts.

We store the Google account identifier and email linked to your NinjaDeals account in our account databases. Our hosting and security providers process account data as needed to run and protect NinjaDeals. Google processes the sign-in request under its own privacy policy. We do not sell Google sign-in data or use it for targeted advertising, credit or lending decisions, or training AI models. Account closure removes the Google-to-NinjaDeals account link through the deletion process described below; it does not delete your Google account.

What we collect

We collect only what the product needs to work:

• Account information — your Google sign-in identifier, email address, handle, display name and profile information you choose to provide. Google verifies your sign-in; NinjaDeals stores its own account and sessions.
• Content and activity — deals, discussions, comments, messages, uploaded images, votes, follows, reports, saved items, alerts and browsing activity. Content you publish and your public profile can be visible to other people.
• Technical data — standard server logs (such as IP address and browser type) used for security, abuse prevention, and keeping the service reliable.
• Analytics data — product-usage signals, controlled by your privacy preference (see the next section).
• Optional location — a place you select or approximate device location you allow, used for nearby deals and location-aware contributions. Selected place coordinates can identify a precise place even without device location permission. We store the coordinates and resolved address with your account when you save a location. You can browse without saving a location or granting location permission.
• Cards descriptors — card product, bank, network, membership, reward programme or provider names and optional nicknames, used to match offers. Cards does not accept card numbers, CVV, PIN, bank account numbers, balances, passwords or UPI payment addresses and does not make payments.
• Deal outbound attempts — when you open a deal at a merchant, we record the deal, its poster, the time, merchant host, and whether you used the web, Android, or iOS app. We also record your account ID if you are signed in. This operational record does not include your IP address, a guest device ID, or the full merchant or affiliate URL. It is separate from optional product analytics.

Analytics & cookies

When analytics is enabled, we use Google Analytics 4 (gtag.js) to understand how the site is used — pages viewed, sign-ups, searches, and other product interactions — so we can improve it. Analytics, personalization, and marketing preferences default to enabled without a cookie popup. Saved opt-outs remain in effect, and you can change individual categories in privacy preferences at any time. We do not use this data for advertising personalization.

The Android app uses Firebase Analytics for optional usage analytics, Firebase Crashlytics for crash diagnostics, and Firebase Cloud Messaging and installation identifiers for notifications. Crash diagnostics can include stack traces, app state and device metadata. Usage preferences control optional analytics; crash, performance and security processing continue separately. Advertising storage, advertising personalization and advertising-ID collection are disabled in our Android configuration. Notification permission controls phone notification display.

Essential cookies (for example, the cookie that keeps you signed in and the cookie that remembers your theme) are always set, because the site does not function without them.

Deal outbound attempts are recorded when a valid merchant redirect is issued, regardless of your optional analytics choice. They indicate an attempted visit, not an app opening or purchase. Guest records are retained without a visitor ID; records linked to your account are removed when your account is deleted. If you posted a deal, your account ID is removed from retained outbound records on account deletion.

Account data

When you create an account we store your email, handle, and the content and activity you contribute (deals, votes, comments, saved items). This is used to operate your account and the community features — for example showing your posts under your handle and computing your karma. We do not sell your personal data.

Optional location and Ola Maps

Location search and saving use Ola Maps through our servers. We send search text, selected place identifiers and coordinates to Ola Maps to find places and resolve their addresses. This includes coordinates for a manually selected place or the approximate device location you choose to use. Saving retains those coordinates and the resolved address in your account; manual selection does not reduce coordinates to city-level precision.

Ola handles the transmitted data under its own Ola Maps privacy policy and Ola Maps terms. Location features are optional. Android requests only approximate device location when you choose that option; you can deny permission and continue browsing.

Service providers, retention and deletion

Our hosting, security, delivery and diagnostics providers process data to operate NinjaDeals. These include Oracle Cloud Infrastructure, Cloudflare, Honeycomb and Google Firebase; Google also provides sign-in. Opening a merchant link sends you to that merchant, where its own privacy policy applies. We do not sell your personal data.

We retain account data while needed for the features you use. Account closure starts deletion across our services, including account-linked content, profile, Cards descriptors, saved items, location and notification registrations. Closure does not delete your Google account. Deletion is asynchronous; acceptance is not proof that every service has finished. The service records a 30-day completion target. Contact us if you need help confirming completion. Limited security and abuse-prevention records may remain where needed, with account identifiers removed or pseudonymised by their deletion handlers. Provider diagnostics have their own retention controls; contact us for assistance with requests concerning those records.

How we protect account data

The production website and API use HTTPS to protect data in transit. We validate Google ID tokens before accepting a sign-in and require authenticated access for private account operations. Web session cookies are HttpOnly and Secure in production, and backend authorization limits access to account data. These protections reduce risk; no service can guarantee absolute security.

If our data practices change, we update this policy and its last-updated date. Contact [email protected] with privacy or security questions, including questions about Google sign-in information.

Your rights

You are in control of your data. These rights align with India’s DPDP Act, and each one is available directly from your account:

• Account data — manage browsing history or request account closure from the Privacy & Data page. Contact us for a data-access request that is not available in the app.
• Personalization — manage recommendation preferences from your privacy preferences.
• Deletion — close your account at any time; this removes your account and fans deletion out across the service.
• Choices — change analytics and personalization preferences at any time on the privacy preferences page.

Contact

To exercise a data right that is not self-serve, or to raise any privacy concern, reach us at [email protected] or through the contact page. We aim to respond to privacy requests promptly and within the timelines the DPDP Act prescribes.