Privacy Policy

Information we collect

Information you give us

• Account details at sign-up: name, email address and (optionally, where the mobile-number flow is enabled) your phone number. Passwords are stored only as salted cryptographic hashes.
• Details you choose to save for IPO tracking: demat account information such as PAN, DP/client ID, UPI ID and bank details. PAN and bank account numbers are encrypted at rest (AES-256-GCM) — only masked hints are ever displayed, and they are visible only to you.
• Your IPO bid records, watchlists and alert preferences.
• Messages you send us through the contact form, email or Telegram.

Collected automatically

• Device & notifications (apps): if you enable push notifications, we store your push token together with the platform (iOS/Android) and device name so we can deliver the alerts you choose.
• Approximate location: we derive your city/region/country from your IP address at sign-up and sign-in for security, fraud prevention and localisation. We never collect precise (GPS) location — the apps do not request the location permission at all.
• Usage analytics: on the website, page views are recorded against a salted daily hash (we do not store raw IP addresses for analytics), and Google Analytics may be used for aggregate traffic measurement.
• Crash & diagnostics data (apps): the mobile apps send crash reports and error diagnostics (device model, OS version, app version, stack trace) so we can find and fix bugs. Crash data is not linked to your marketing profile and is not used for advertising.

How we use your information

• To operate the website and apps: sign-in, IPO tracking, bid records, printed application forms.
• To send messages you request: verification codes (email/SMS), password resets and IPO alerts.
• To deliver push notifications you have opted into (you can disable them any time in settings).
• To keep the platform secure: abuse and fraud prevention, rate limiting, account protection.
• To improve the product through aggregate, anonymised usage statistics and crash reports.

We do notsell your personal information, we show no third-party ad SDKs in our apps, and we do not use your data to track you across other companies' apps or websites. Your demat and bid data is private to your account and is never shared with third parties, except where required by law.

Service providers we rely on

These processors handle limited data strictly to provide their function:

• Email delivery (verification codes, alerts) — your email address and the message content.
• SMS delivery for one-time codes (India), where the mobile-number flow is enabled — your phone number.
• Push-notification delivery for the apps — your push token and notification content.
• Crash reporting for the apps — device and error diagnostics as described above.
• Web analytics (website only) — aggregate traffic measurement, governed by the provider's policy.
• Content delivery & security (CDN/WAF) — standard connection data needed to serve the site safely.

Market prices and company fundamentals shown in the product come from licensed market-data providers; no personal data of yours is ever sent to them.

App permissions

The iOS and Android apps request only one permission: Notifications (optional, so we can send the IPO alerts you choose). They do not request access to your camera, microphone, contacts, photos or precise location.

Data security

All traffic is encrypted in transit (HTTPS). Sensitive fields (PAN, bank account numbers, API keys) are encrypted at rest. One-time codes expire within minutes. Access to production systems is restricted. No method of storage is 100% secure — keep your password safe and sign out on shared devices.

Cookies & third-party tags

We use a session cookie to keep you signed in. Where enabled, Google Analytics and Meta Pixel may set their own cookies on the website for traffic measurement and ads attribution; these are governed by the respective providers' policies. The mobile apps do not use advertising cookies or ad SDKs.

Data retention & deleting your account

• You can update your profile and delete saved demat accounts and bids at any time from your account.
• To delete your account entirely, use the contact form or email [email protected] from your registered email — we will delete your account and personal data (profile, encrypted demat details, bids, push tokens) within 30 days.
• We keep only what the law requires us to keep, for as long as it requires.

Children

IPO Plus is intended for adults (18+). We do not knowingly collect personal information from children; if you believe a minor has created an account, contact us and we will remove it.

Updates & contact

We may update this policy from time to time; the latest version is always at ipo.plus/privacy-policy. Questions or privacy requests? Use the contact form or email [email protected].