Privacy Policy · IPO Saathi

Who we are

IPO Saathi is an independent app made in India ("we", "us"). This policy covers the IPO Saathi Android app and the website iposaathi.com. For the purposes of India's Digital Personal Data Protection Act, 2023, we decide why and how the usage data described below is processed.

What stays on your phone

These are saved in your phone's secure storage and are never sent to us:

the PANs you add, the nickname you give each one, and the holder name a registrar returns;
the allotment results of the checks you ran;
your theme choice and your reminder settings.

When you tap Check allotment, the app sends the PAN straight from your phone, over HTTPS, to the registrar that handles that IPO (KFin Technologies, MUFG Intime (Link Intime), Bigshare Services or Maashitla Securities). It is the same lookup you would do on the registrar's own website. We do not see the request or the result. From that point the registrar's own privacy policy applies.

What we collect

What	Why	Where it goes
Usage events. Which screen opened, taps on buttons, filters and sheets, how far a page was scrolled, which IPO was opened, how many PANs are saved (a number), whether any PAN is saved (yes or no), and whether an allotment lookup finished, was pending or failed. Never a PAN, a nickname, a search text or the result itself.	To find bugs, see which features are used and improve the app.	Our database (Mumbai, India) and Mixpanel (US).
Install code. A one-way, salted hash of the app-specific Android ID. It stays the same if you reinstall the app. We never see the Android ID itself.	To count people instead of taps, to tell a reinstall from a new user, and to find your data if you ask for it to be deleted.	Attached to every item in this table.
App and phone details. App version, that the phone is Android, and the time of each event. Our hosting provider also sees your IP address in routine server logs.	To know which versions are in use and to run the service safely.	Our database and hosting provider.
Notification details. A push token (an anonymous code that lets a message reach your phone), which alert types are on (an IPO opens, closes or lists, and allotment results), and whether any PAN is saved (yes or no).	To send reminders and, if you allow it, a notice when allotment results are out.	Our database. Messages travel through Expo's push service and Google's Firebase Cloud Messaging.
Website visits and clicks. Which page you opened, the site you came from, whether you are on a phone or a computer, and which buttons you press (for example Download the app). A random code that the browser forgets when you close the tab. Not collected if your browser sends Do Not Track or Global Privacy Control.	To see how many people visit and press Download.	Mixpanel (US).
Website heatmaps. Where visitors click, scroll and move the pointer on each page, and short recordings of visits. Form fields (such as the contact form) are never recorded. Clarity is told that cookies are not allowed, so it sets none. Each page view is its own recording, but the recordings of one visit carry the same random code as the visit counts above, which is forgotten when you close the tab, so we can look at them together. Not run if your browser sends Do Not Track or Global Privacy Control.	To see which parts of a page people use or miss.	Microsoft (Clarity).
Contact form. If you use the form on the Support page: your name, email address and message. We email a one-time code to the address you give, so a message only reaches us once you have entered it. An unconfirmed message is deleted within a day.	To confirm your email, read your message and reply.	Our database (Mumbai, India) and our email inbox (Gmail).
Firebase Analytics. Automatic app events such as first open, sessions, updates and uninstalls, with the install code as the user id. Advertising ID collection and ad personalisation are switched off.	Reliable counts of installs, active use and uninstalls.	Google (Firebase).
Microsoft Clarity. Session recordings and tap maps: the screens you see and where you touch. Recording is paused on the screens where a PAN is shown or typed, and what you type into input boxes, numbers and email addresses are hidden in the recordings.	To see where people get stuck.	Microsoft (Clarity).

None of this is linked to your name, phone number or email, because we do not have them. Because it carries a persistent install code, the law may still treat it as personal data, so we handle it that way.

We use these services to run the app. Each receives only what is listed above, and each has its own privacy policy.

Supabase, our database and server functions, hosted in Mumbai, India. Policy
Mixpanel, product analytics, United States. Policy
Google Firebase, app analytics and push delivery. Policy
Microsoft Clarity, session recordings and tap maps in the app, and heatmaps on this website. Policy
Expo, push notification delivery. Policy
Google (Gmail), where our email inbox lives, so a contact form message reaches us there. Policy
Google (document viewer), on Android only, when you open an offer document: Google's viewer shows the PDF inside the app and fetches the document's public link (the IPO's public prospectus; nothing about you is added to it). Policy
Registrars, only when you tap Check allotment, as described above.

We do not sell or rent data, we do not show ads, and we do not share data for advertising. We may disclose data if a law or a court order requires it.

Your data is processed in India (our database) and, through the services above, in the United States and other countries.

What we do not collect

No name, email address or phone number. No location. No contacts, camera, microphone, photos or files. No advertising ID. The only permission the app asks for is to show notifications.

This website sets no cookies and uses no third-party fonts. It loads Microsoft Clarity for heatmaps (in its cookie-free mode), counts visits and button clicks with Mixpanel, using a random code that is forgotten when you close the tab, and it sends the contact form on the Support page only when you press Send.

How long we keep it

On your phone: until you remove a PAN, delete all PANs or uninstall the app.
Usage events in our database: we keep them and do not delete them on a schedule, unless you ask us to (see below). They carry no name, phone number or email.
Contact form messages: up to a year in our database, then deleted automatically. The copy in our inbox stays until we delete it.
Push tokens: until notifications stop working for that phone, or you ask us to delete it.
Mixpanel, Google and Microsoft: as set in each service's own retention settings.

Your choices and rights

Remove a PAN: in the Allotment tab, or choose Profile → Delete all saved PANs. Uninstalling the app removes everything stored on the phone.
Reminders: switch each type off in Profile → Notifications, or in Android's notification settings.
Usage data: the app has no switch to turn it off yet. To have it deleted, open Profile → Feedback. The app copies your support code to the clipboard and opens a blank email: paste the code, write that you want your usage data deleted and send. The code is how we find your data. We delete it from our database and ask the analytics services to delete theirs where they allow it, and we reply within 30 days. Uninstalling stops new data from being sent.
Your rights: under the DPDP Act you can ask what personal data we hold, ask us to correct or erase it, withdraw consent, nominate someone to act for you, and complain to us. Write to the address below.

Security

PANs are kept in the phone's secure storage, which is backed by Android's Keystore. Everything the app sends goes over HTTPS. Our server never receives a PAN, so there is no list of PANs for anyone to breach. No system is perfectly secure, and we cannot promise that it is.

Children

IPO Saathi is for adults. It is not directed at anyone under 18 and we do not knowingly collect data from them.

Changes

If the app starts to collect something new, we will update this page and its date before the change reaches you, and tell you in the app when the change is significant. The version on this page is always the current one.

Contact

Questions, requests and complaints about privacy: hello@iposaathi.com. This is also our contact for grievances under the DPDP Act.