Legal
Privacy Policy
Who we are
IPO Desk (“we”, “us”) is an independent app that helps you track Indian IPOs and check share-allotment status. This policy explains what data the app handles and why.
Data you enter
- PAN numbers you save for yourself or family members are stored encrypted in your device’s secure storage (Keychain on iOS, Keystore on Android). They are not written to our database unless you turn on Auto-check — see below.
- Optional names/labels, and any DP ID / UPI you choose to add, are stored the same way, on your device.
When you tap “check allotment”, the PAN(s) for that check are sent over an encrypted connection to our backend, which forwards them to the relevant IPO registrar solely to retrieve that allotment result. For these manual checks we do not retain the PAN after the check completes.
Auto-check — optional, off by default
Auto-check is the one feature that stores a PAN with us, and it only runs if you switch it on yourself in Settings. It exists so we can check a new allotment for you and push you the result without you opening the app.
- When you enable it, the PANs saved on your device are copied to our database as AES-256-GCM ciphertext. We never store the PAN in readable form.
- We also store a keyed one-way hash of each PAN so the same PAN isn’t checked twice across your devices. The hash cannot be reversed into a PAN.
- They are used for one purpose: running allotment checks on your behalf and notifying you of the outcome. They are not sold, shared, or used for advertising or profiling.
- Switch Auto-check off and the stored PANs are deleted from our database. Clearing your saved data in Settings removes them too.
If you never turn Auto-check on, no PAN of yours is ever written to our database.
Optional product analytics
Analytics are off until you switch them on. If you choose “Help improve IPO Desk” in Settings, the app sends a small anonymous event when you use a feature (for example, loading the market or completing a check). We use this to count feature use and improve reliability. It never includes a PAN, applicant name, allotment response, email address, advertising identifier, or location. We store only a one-way hash of a random install identifier and you can turn this off at any time.
The same switch also controls Google Firebase Analytics, which we use to understand which screens people rely on and where the app fails. Firebase collection is disabled in the app’s build configuration, so nothing is measured on a fresh install: it is only enabled after you turn the setting on. While it is on, Firebase receives app events, your device model, operating system version and country, and a random app-instance identifier that Google generates. Advertising identifiers, ad personalisation and ad storage are all switched off, so this is never used for advertising. Turning the setting off disables collection again and asks Firebase to delete the identifiers it holds for your install. Firebase is operated by Google — see the Firebase privacy notice.
Data we don’t collect
- No account, email, or phone number.
- No advertising identifiers, no ad personalisation, and no cross-app tracking.
- We never sell your personal data.
Information from public sources
IPO details — grey-market premium, subscription figures, listing gains and logos — are gathered from public registrar and exchange pages. This is general market information and is not personal to you. It may be delayed or incomplete.
How the check works
Allotment checks are performed on demand against the official registrar for that IPO. Some registrars require a captcha, which you solve yourself inside the app. Results shown in the app should always be confirmed on the official registrar site before you act on them.
Data security
On your phone, PANs are held in the operating system’s secure store (Keychain / Keystore). All network requests use HTTPS. If you have turned Auto-check on, the copy held with us is encrypted at rest with AES-256-GCM under a key that is not stored alongside the data. Because there are no accounts, we hold no name, email, or phone number that could tie that record back to you.
Notifications
If you allow notifications, we store a push token for your device so we can send allotment results and IPO alerts. It is tied to a random device identifier, not to you. Turning notifications off in phone settings, or clearing your saved data in the app, removes it.
Children
IPO Desk is intended for adults investing in the securities market and is not directed at children under 13.
Changes
If this policy changes, we’ll update the date above and post the new version here.
Terms & disclaimer
IPO Desk is an information tool, not a broker, registrar, or investment adviser. Nothing in the app is investment advice. Allotment, GMP and subscription data may be delayed or inaccurate; always verify on the official registrar or exchange before making any decision. You use the app at your own risk. Read the full terms.
Contact
Questions about privacy? Email hello@ipodesk.app.