Privacy policy

Last updated 16 October 2026 · App: Onzo · Developer: Individual Developer

Onzo helps people find others to do things with, and meet. It is run by SURPPASS PTE. LTD. ("we"). This policy says what we collect, why, who sees it, and what you can do about it. Onzo is for people aged 18 and over.

What we collect

• Your account: your name, and the email Google or Apple shares when you sign in with them and/or your phone number if you sign in with it (an account can have several ways to sign in).
• Your profile and choices: photo (if you add one), a short line about you, links to your other profiles (Instagram, LinkedIn…) if you add them, your city and rough area, interests, when you're usually free, language and notification settings.
• Location, only when you ask: "Use my location" finds your rough area once. We keep the area, not your exact location.
• What you do in Onzo: activities you host or join, messages in activity chats, invites, reports, blocks and feedback you send.
• After an activity: who came and who you'd meet again. This stays private: nobody is told what you chose.
• Technical: a push notification token for your device, crash reports, and server logs (including IP addresses) kept for security and to stop abuse.

How we use it

• To run Onzo: show activities near you, suggest people and groups, send the reminders and updates you've allowed.
• To keep people safe: filter offensive words, check photos and what people write automatically (a person reviews anything held back), review reports, and suspend accounts that break our terms.
• To fix problems and improve Onzo. We don't sell your data, show ads, or track you across other apps.

Who sees what

• Other Onzo users see your name, photo, the activities you host or join, and your messages in chats you're part of. Your links are shown only to whom you choose: your connections (the default), everyone, or nobody.
• An activity's exact meeting place is shown only to people going (when the host chooses so); others see the area.
• We use service providers to run Onzo, under their own privacy terms: Oracle Cloud (hosting and storage), Google (Sign-in, Firebase phone sign-in by SMS, Maps and place search, Firebase push notifications and crash reports, and Cloud Vision, which checks photos you upload for content that breaks our rules), Anthropic (Claude, which checks what you write in Onzo for content that breaks our rules, and translates an activity's text when you tap Translate; it doesn't use either to train its models) and Apple (Sign in with Apple, push notifications). We share data with authorities only when the law requires it.

How we protect it

• Everything between the app and our servers is encrypted (HTTPS), and stored data and backups are encrypted.
• Only the people who run Onzo can reach personal data, and only to operate it and keep people safe.
• You sign in with Apple, Google or a code sent to your phone by SMS; Onzo has no passwords to see or store.
• We keep our systems updated and review their security regularly.

Where it's stored

Onzo runs on Oracle Cloud servers in Singapore. Our service providers may process data in other countries; where they do, it's under their own safeguards and the protections of this policy.

Links to other services

Onzo may open maps, online meeting links (such as Zoom or Teams) and other sites. Their own privacy policies apply there, not this one.

How long we keep it

Only as long as it's useful, then it's deleted automatically:

• Your profile, interests and settings: while your account exists.
• Group chat messages: 90 days after the activity ends.
• Notifications: 90 days. Sign-in and device records (including IP addresses): 90 days.
• Join requests, invites and "Almost a group" interest: 180 days. Connection requests once answered, and connections you or the other person removed: 180 days. Activity photos: 180 days after the activity's last date.
• Who you joined activities with (used to suggest connections; never shown to others): 2 years after your last activity together. Your connections stay until either of you removes them, blocks the other or deletes the account.
• Activities you hosted or joined, and who you met: up to 2 years, so the app can remember people you've met.
• Reports, and messages or activities involved in them: up to 2 years, or longer while a safety case is open.
• Backups: 30 days.

When you delete your account (Me → Delete account), your profile, photo and sign-in details are removed at once and your messages no longer show your name.

Your choices and rights

You can see and change your profile and settings in the app, turn notifications off, and delete your account at any time. You can also ask us for a copy of your data or to correct it, under Singapore's and Malaysia's personal data protection laws: email onzo@surppass.com or use Me → Send feedback in the app.

Data breaches

If a breach of personal data affects you, we'll tell you and the authorities where the law requires, and say what we're doing about it.

Changes

If we change this policy in a way that matters, we'll tell you in the app before it applies.

Contact and data protection officer

Requests to see, correct or delete your data, and privacy complaints, go to our Gao Yong: onzo@surppass.com. We reply within 30 days. For anything else, email onzo@surppass.com or use Me → Send feedback in the app.