Privacy Policy

• Account info — your email address and password. Authentication is handled by Supabase Auth; we never see or store your raw password.
• Data you enter — the demat accounts, IPO applications, allotments, holdings, sales, and capital records you add for your own tracking. This is financial record-keeping data you control entirely, not something we collect independently.
• PAN (optional) — if you choose to save your Permanent Account Number on a demat account, it is stored on our servers using Fernet authenticated encryption (AES-128-CBC with HMAC-SHA256). The encryption key is kept server-side. Only the last 4 characters of your PAN are shown after saving. PAN is used solely to check your IPO allotment status by querying KFintech or MUFG Intime on your behalf. Saving your PAN is entirely optional — all other features work without it.
• Payment / subscription metadata — if you upgrade to Pro, we store your subscription status and billing cycle dates. Your card/UPI payment details are handled entirely by Razorpay; we never receive or store them.
• Basic usage analytics — page views via Vercel Analytics. This does not use advertising or tracking cookies, and does not collect personally identifying information.
• Product analytics (only if you accept cookies) — if you click “Accept” on our cookie banner, we use Google Analytics 4 to understand how the app is used: page views, and events like signing up, viewing an IPO, or checking allotment status. These events never include your email, PAN, application numbers, or any bank/demat account details — only which action happened and, where relevant, a public IPO name. If you click “Decline” or don’t respond, none of this loads at all.
• Technical error logs — if the app errors, technical details about the failure may be logged server-side to help us diagnose issues. Personal data is not intentionally included in these logs.

We do not sell your data. We do not use it for advertising. We do not place trades, submit IPO applications, or take any financial action on your behalf with any broker or exchange.

• Supabase — authentication and database hosting. Your account data and tracking records are stored on Supabase infrastructure.
• Vercel — frontend hosting and basic page-view analytics (no tracking cookies or personal data).
• Google (Analytics & Search Console) — if you accept cookies, product-usage events (see above) are sent to Google Analytics 4. Separately, and unrelated to your visit, we read our own site’s public search-performance summary (impressions, clicks, ranking) from Google Search Console — that is aggregate data about how our site appears in Google Search results, not data about you individually.
• Render — backend server hosting. The backend processes your requests, including PAN decryption for allotment checks.
• Razorpay — payment processing for Pro subscriptions. Razorpay handles card and UPI information under their own security standards; we do not receive or store those payment credentials.
• KFintech / MUFG Intime — SEBI-registered IPO registrars. When you trigger an allotment check, our backend decrypts your PAN and sends it to the relevant registrar over HTTPS to retrieve your allotment status. This is the only circumstance in which your PAN leaves our system. We do not control how registrars handle data on their end; please refer to their own privacy policies.

We do not share your data with advertisers, data brokers, or any other third party for marketing purposes.

• Stored encrypted at rest — your PAN is encrypted using Fernet authenticated encryption (AES-128-CBC with HMAC-SHA256) before being saved. The encryption key is kept server-side and is not exposed to users. Encryption reduces risk but cannot eliminate it entirely.
• Transmitted over HTTPS — when you trigger an allotment check, the backend temporarily decrypts your PAN in memory and sends it to the relevant registrar (KFintech or MUFG Intime) over an encrypted HTTPS connection. It is not sent to any other party.
• Not written to logs — your PAN is not intentionally recorded in application logs at any stage.
• Used only for allotment checking — your PAN is not used for any other purpose.
• Removable at any time — you can delete your PAN from a demat account at any time from within the app.

• Account and tracking data — retained while your account is active.
• PAN — retained only as long as you choose to keep it saved on a demat account. You can remove it at any time.
• Account deletion — when you delete your account from Settings, your records are removed from our active systems. Some data may persist temporarily in encrypted backups or system logs before being overwritten in the ordinary course of operations. We do not retain data longer than necessary for the purposes described in this policy, or as may be required for security or fraud-prevention reasons.

• View your data — all the data you have entered is accessible through your account.
• Export your data — you can download a full backup of your tracking data from Settings at any time.
• Edit or remove PAN — you can update or delete your saved PAN from any demat account at any time.
• Delete your account — you can permanently delete your account from Settings. This removes your data from our active systems.
• Marketing emails — if you opted in to product updates at signup, you can withdraw that consent at any time via the unsubscribe link in any marketing email.

Separately, our cookie banner asks permission for one more thing: Google Analytics 4, described above. It loads only after you click “Accept”; clicking “Decline”, or simply not answering, means it never loads at all — no cookie is set, no request is made, nothing is queued. We do not use advertising cookies of any kind.

Product update emails (new features, pricing changes, offers) are sent only if you opted in at signup. Every such email includes an unsubscribe link. You can withdraw this consent at any time.

• All data is transmitted over HTTPS.
• PAN receives additional encryption at rest using Fernet authenticated encryption (AES-128-CBC with HMAC-SHA256).
• Authentication and password management are handled by Supabase Auth; we do not store raw passwords.
• Access to your account data is restricted to your own authenticated session.

No system can guarantee absolute security. If you believe your account has been compromised, please contact us immediately.