1.Who we are
This Privacy Policy explains how OneCourt ("we", "us") collects, uses, shares and protects personal data when you use onecourt.in, its sub-domains (nclat.onecourt.in, app.onecourt.in) and related tools and alerts (the "Services"). For the Digital Personal Data Protection Act, 2023 ("DPDP Act"), OneCourt is the Data Fiduciary and you are the Data Principal.
It should be read with our Terms & Conditions. It is published in line with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (Rule 3(1)(a)), the DPDP Act, 2023 and the Digital Personal Data Protection Rules, 2025, as each is in force from time to time.
Contact for privacy matters, and our Grievance Officer: see section 9.
2.What we collect
We collect only what the Services need. We do not ask for Aadhaar, PAN, financial or payment details, health data or biometrics.
| Category | What | Why |
|---|---|---|
| Sign-in data | Email address; access-request status (pending, approved, rejected); a signed sign-in token and session cookie; time of request | To decide who may enter, send sign-in links and keep you signed in |
| Case-tracker data (app.onecourt.in) | Case numbers or diary numbers you choose to track, nickname/notes you add, alert preferences, orders fetched for your matters | To match listings and orders to your matters and send alerts |
| Notification data | Email address, content of alerts and digests we send, delivery status | To deliver and troubleshoot alerts |
| Supreme Court page account (onecourt.in/supreme-court/) | If you sign in there: your email address, your AOR code(s) and the case numbers (with party names) you add to My matters | To show your matters on any device you sign in on |
| Correspondence | What you write to us (feedback, requests, complaints) and your contact details | To reply and keep a record |
| Technical data | IP address, browser type, device, pages requested, timestamps, error logs (kept by our hosting and CDN providers and in our server logs) | To run, secure and debug the Services, prevent abuse and meet legal log-keeping duties |
| Browser storage | Session cookie; sessionStorage/localStorage values on your device (for example, sign-in state and tool preferences) | To keep you signed in and remember settings |
Document generators run on your device
The document tools (filing index, affidavit, cover page, vakalatnama and similar) build your Word file inside your browser. What you type or open there, including party names, case details and uploaded drafts, is processed on your device and is not transmitted to or stored by us unless a feature says otherwise at the point of use.
Public court data
Our pipelines read public cause lists, orders and case information from court websites. These can contain names of parties and advocates. We keep only what is needed to run the Services, and we drop advocates' and litigants' phone numbers and email addresses that appear in cause lists. We do not build profiles of individuals from this data.
Where it comes from
Directly from you, automatically from your device when you use the Services, and from public court sources as described above. We do not buy personal data.
3.Why we use it, and the legal basis
We process personal data for these purposes:
- to approve access requests, send sign-in links and keep your account secure;
- to provide the case tracker and send listing, order and digest alerts you asked for;
- to answer your messages and handle grievances;
- to maintain, secure, debug and improve the Services, and to detect and prevent abuse and fraud;
- to comply with law, court orders and lawful requests from authorities.
Basis under the DPDP Act. We process your data with your consent, which you give by requesting access after being shown this notice, and which is free, specific, informed, unconditional and unambiguous, and limited to what is necessary for the purpose. We also process data for certain legitimate uses listed in Section 7 of the Act, such as where you voluntarily give us your email address for a stated purpose and do not object, and for compliance with law. You can withdraw consent at any time (see section 9); withdrawal is as easy as giving it, and its consequence is that we can no longer provide the Services that depend on that data.
We do not sell your personal data, use it for advertising, or use it to train third-party AI models.
4.Who we share it with
We share personal data only with service providers who process it for us, under written terms that require security and use only for our purposes. Our current providers are:
| Provider | Role |
|---|---|
| Hostinger (web hosting and content delivery) | Hosts the website, app and database; receives request logs |
| Cloudflare | Runs a small worker that reads public court display boards for us; receives request metadata |
| Resend | Sends sign-in and alert emails; receives the recipient email address and message |
| GitHub (GitHub Pages and Actions) | Hosts static cause-list pages and the scheduled jobs that build them; processes public court data, not your personal data |
| Google Fonts | Serves the Archivo typeface. Your browser contacts Google to load it, which shares your IP address and browser details with Google |
We may also disclose data (a) to a court, tribunal, government agency or authority where required by law, or in response to a lawful order or request (including under Section 69, 69A or 70B of the IT Act, and the Bharatiya Nagarik Suraksha Sanhita, 2023); (b) to protect our rights, the Services and users from fraud or security threats; and (c) in a merger or transfer of the Services, subject to this policy continuing to apply. We never disclose to anyone who simply asks.
Providers may be located outside India, so your data may be transferred out of India. We transfer personal data only to the extent the DPDP Act and any restriction notified by the Central Government under Section 16 allow.
5.How long we keep it
| Data | Kept for |
|---|---|
| Email and access status | While you hold access, plus up to 12 months afterwards; rejected or unanswered requests, up to 6 months |
| Sign-in links | 15 minutes; sessions up to 30 days |
| Case-tracker entries and fetched orders | Until you remove them or ask us to delete your account |
| Supreme Court page account (email, AOR code, saved case numbers) | Until you remove them or ask us to delete your account |
| Alert emails and logs | Up to 90 days |
| Technical and security logs | Up to 180 days, which is the minimum the CERT-In Directions of 28 April 2022 expect for ICT system logs. Where your host keeps logs outside India that is the host's responsibility |
| Grievances and correspondence | 3 years after closure |
We erase personal data when the purpose is served or you withdraw consent, unless law requires us to keep it longer (for example, the one-year minimum for certain personal data and logs under the DPDP Rules). Backups are overwritten in their normal cycle.
6.How we protect it
We apply reasonable security safeguards as required by Section 8(5) of the DPDP Act and Section 43A of the IT Act with the 2011 Rules, including:
- HTTPS encryption in transit;
- passwordless, expiring, signed sign-in links and signed session cookies, so we do not hold passwords;
- access to admin tools limited to named administrators;
- keeping API keys and configuration out of public code and the browser;
- logging and monitoring of access to our systems.
No system is perfectly secure. If a personal data breach occurs, we will inform the Data Protection Board of India and affected users in the form and time the DPDP Rules require, and report cyber-security incidents to CERT-In within six hours of noticing them, as per its Directions under Section 70B(6) of the IT Act.
7.Cookies and similar technologies
We use only what is strictly necessary: a session cookie that keeps you signed in, and browser storage that holds sign-in state and tool preferences. We do not use advertising, cross-site tracking or behavioural-profiling cookies, and we do not run third-party analytics scripts. Blocking the session cookie will stop sign-in from working. You can clear cookies and site data from your browser settings at any time.
8.Children
The Services are meant for adults and are not directed at children. We do not knowingly process the personal data of anyone under 18. If you believe a child's data has reached us, contact the Grievance Officer and we will delete it. Under Section 9 of the DPDP Act, we do not track, monitor the behaviour of or target advertising at children.
9.Your rights and how to exercise them
Under the DPDP Act, you have the right to:
- Access a summary of the personal data we process, the processing activities, and the others with whom we have shared it;
- Correct, complete and update your personal data;
- Erase your personal data when it is no longer needed for the purpose or you withdraw consent, unless the law requires us to keep it;
- Withdraw consent at any time;
- Grievance redressal as set out below; and
- Nominate another person to exercise your rights in the event of your death or incapacity.
In the same way, you have the right under the 2011 Rules to review the information you provided and have inaccurate information corrected.
To exercise any right, email the contact below from the address that you used to sign in (so we can verify it is you). We will respond within 90 days, and sooner where we can.
- Grievance Officer / Data Protection Contact
- Mohit Singh, OneCourt
- mail@onecourt.in
- Response time
- Acknowledgement within 24 hours; resolution within 15 days
Please use our grievance process first. If you are not satisfied, you may complain to the Data Protection Board of India, once the Board's complaint mechanism is operational, and to the Grievance Appellate Committee for matters under the IT Rules, 2021. Our full grievance procedure is in section 12 of the Terms & Conditions.
Your duties as a Data Principal under Section 15 of the DPDP Act include not filing a false or frivolous grievance, not impersonating another person and providing only verifiably authentic information. A false or frivolous complaint can attract a penalty under the Act.
10.Third-party sites
The Services link to court and government websites and other external sites. They have their own privacy practices that we do not control. Check their policies before you share any data with them. This includes the Supreme Court's and other courts' CAPTCHA-protected pages, where what you enter is handled by the court.
11.Changes to this policy
We may update this policy as the Services or the law change, including as the DPDP Rules come fully into force. We will change the "last updated" date and give notice of material changes on the Services or by email. Where the law requires fresh consent, we will ask for it.
Questions: mail@onecourt.in.