Privacy - Onya

What we store

We store no message content and no profile information - only Slack IDs, amounts, your workspace's name, and, where a workspace switches rewards on, the reward items an admin types in.

Workspace identity - your Slack team ID and name, and an encrypted bot token so the app can act in your workspace.
Member identities involved in recognitions - the Slack user ID of people who give or receive. No names.
The recognition ledger - for each give: the giver, the receiver, the amount, the source (message or reaction), the channel, and the message timestamp. No message content.
The rewards catalogue - only where rewards are switched on: each item's name and cost, plus the description, emoji and image link an admin chose to add. Written by admins, about items rather than people.
Redemption records - for each redemption: the Slack user ID of the person who redeemed, which item, the cost they paid, and when. Kept for as long as the recognition ledger is, and deleted at the same time.

What we do not do

No message content stored, and none sent on. When a give happens in a message, the DM to the receiver links to that message rather than quoting it, so Slack decides whether they're allowed to open it.
No profile information stored. We resolve Slack profiles only to skip bots and deactivated accounts, and nothing from the profile is kept.
No reading of channels beyond detecting gives.
No storing of direct messages. If you message Onya directly it reads what you sent only to reply, and keeps nothing.
No fetching of reward images. An item's picture is an https link a workspace admin supplies, and Slack is what fetches it to render the catalogue. Onya never requests that URL itself, so the site hosting it hears from Slack, never from us.
No analytics or tracking, on this page or inside Slack.
No selling or sharing of your data.

Slack turns user IDs back into names and avatars in your client. That happens in Slack, not here. Onya only ever stores the ID.

Removing data

Removing a reaction deletes that give's ledger entry.
A redemption can't be removed on request. There are no refunds, so the record is the only receipt the person who redeemed has, and taking it away would leave them with nothing to show. It goes with everything else on uninstall.
Uninstalling the app stops all processing immediately, and all of that workspace's data - recognitions, redemptions, the rewards catalogue and the member IDs - is deleted from the live database 7 days after uninstall.
The database is hosted on Supabase, and nightly backups go to Cloudflare R2 and expire within 30 days, so deleted data can survive in a backup for up to a month.

Sub-processors

A sub-processor is a company that stores or handles your workspace's data on our behalf. Onya uses three, and nobody else receives your data.

Supabase - hosts the PostgreSQL database holding the recognition and redemption records, the Slack IDs involved and the encrypted bot token.
Cloudflare - stores the nightly database backups in R2, encrypted at rest, and carries inbound traffic to the app through Cloudflare Tunnel.
RackNerd - provides the virtual private server that the application container runs on.

Slack isn't on this list. It's where the data comes from, not somewhere we send it. This page is updated before any new sub-processor starts handling workspace data.

Permissions we ask for

Onya requests the least it needs - eight bot scopes:

channels:history - Read messages in public channels the bot is in, to detect gives.
groups:history - The same, for private channels the bot has been invited to.
reactions:read - Receive reaction events, so a reaction can be a give.
chat:write - Post confirmations, leaderboards, and notifications.
commands - Handle the /onya slash command.
users:read - Check whether a mentioned user is a bot or deactivated account, so those are skipped. Nothing about the profile is stored.
im:write - Open a direct message to send you notifications.
im:history - Receive direct messages you send to Onya so it can reply, and check whether your Messages tab is empty before sending a first-time welcome. Slack requires listed apps to answer their DMs. Nothing you send is stored.

Reporting a security problem

If you find a security issue in Onya, email onya@dotmahdi.com with enough detail to reproduce it. You'll get an acknowledgement within two business days, and an update when it's fixed.

In scope - the Onya Slack app and this website.
Out of scope - denial of service, spam, social engineering, and issues in the services Onya runs on. Those belong with the provider.
Please test on a workspace you control. Don't run anything that degrades the service for other workspaces, and don't access or change data that isn't yours.
Report in good faith and we won't come after you. We ask for 90 days to fix an issue before you make it public.
There's no bounty. Onya is free and there's no budget for one. We're happy to credit you here if you'd like.

Back to the homepage · Help · Terms