Privacy Policy
1. Who we are
Bas (the website and app at bas2minute.com) is run by Kartikay Agarwal, an individual based in Kanpur, Uttar Pradesh, India ("Bas", "we", "us"). For the Digital Personal Data Protection Act, 2023, we are the data fiduciary for the personal data described here. Questions or complaints go to our Grievance Officer (section 12).
2. Bas is satire
Every store, rider, order, wallet, "Bas Money", card, UPI app and bank in Bas is pretend. No food, drink, tobacco, product or service is sold, prepared or delivered, and no real money moves when you "pay". The characters are fictional. If any screen ever asks you for a real card number, UPI PIN, OTP or password, it is not us: close it and tell us.
3. Who can use Bas
Bas is only for adults aged 18 or older. The Daru Theka counter and the Cigarettes counter open only for people who say they are 21 or older. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.
4. What we collect
| What | When | Why |
|---|---|---|
| Google sign-in: Google shares your name, email address, profile photo and a Google account ID with us. | When you tap Continue with Google | We keep your name and a scrambled form of the Google ID, to recognise your account. We do not store your email address or photo. |
| Invite code (private testing only) | Once, the first time a new Google account joins | To keep testing invite-only. We store which code let you in, not the code itself. |
| Name (optional), age band (18–20, 21–29, 30–44, 45+) or date of birth if you add it in Profile | Quick join, Profile | Greeting you, the 18+ and 21+ checks |
| Sex — optional, "Prefer not to say" is fine | Quick join, Profile | Choosing a greeting. If you skip it, greetings stay neutral. |
| Area or location: a city or area you pick or type; or, only if you tap Share location, an approximate position rounded to about 100 metres; PIN code (optional) | Quick join, Profile | The pretend delivery address and local jokes. There is no live or background tracking. |
| App activity: which counters and items you open and "order", your pretend wallet and order history, feedback answers | While you use Bas | Running the app, restoring it on a new phone, and seeing which jokes work |
| Things you post: Adda board lines (with the area name you add), gang names and gang orders, Hall of Fame entries | Only when you post | Showing them to other Bas users. Hall of Fame entries are reviewed before they appear. |
| Technical data: IP address, browser and device type, time of visit | Every visit, in the hosting provider's logs | Security, preventing abuse, fixing faults |
Microphone
Bas asks for microphone permission once, when your first in-app call opens. In this version Bas does not record, listen to, store or send your voice during calls; you can say No and every call still works. Invited testers may record optional voice notes about the app: these are recorded only when the tester taps Record, stay on the phone until the tester taps "Send to owner", and are deleted within 30 days of review.
What we never collect
Real card, bank or UPI details, PINs, OTPs or passwords; your contacts, photos, files, SMS or call logs; your continuous or background location; your messages to anyone.
5. Where your data is kept
Most of what you enter stays in your browser's storage on your own phone. A copy is stored on the servers of our hosting provider, Cloudflare (Cloudflare Pages, Workers and the D1 database), so your account and history can come back if you change phones, and so we can count events. Cloudflare may store or process this data in data centres outside India. Sign-in is handled by Google. We use no advertising or analytics companies.
6. Who we share it with
We do not sell or rent your data, and we do not share it for advertising. It is shared only with:
- Cloudflare, which hosts the site and database for us;
- Google, for sign-in, under Google's own privacy policy;
- other Bas users, but only for things you choose to post (Adda board, gangs, Hall of Fame), shown with your display name or area as you entered them;
- government or law-enforcement authorities, when Indian law requires it.
7. How long we keep it
- Account and app data: while your account is active. If you delete your account, we erase it from our servers within 30 days.
- If you stop using Bas for 3 years, we may delete your account after telling you in the app.
- Security logs may be kept for at least one year, as Indian rules require.
- Counts that cannot identify anyone (for example "how many people opened Paan Shop") may be kept.
8. Your rights
Under the Digital Personal Data Protection Act, 2023 you can ask us to: tell you what personal data we hold and who we shared it with; correct or update it; erase it; and withdraw your consent at any time (this does not affect what was done before). You can also nominate someone to act for you if you die or cannot act. Write to the Grievance Officer. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
9. How to delete your account
Signing in with Google again later starts a fresh account. You can also remove Bas's access in your Google Account settings under "Third-party apps and services".
10. Security
The site uses HTTPS only. Access codes are never stored on our servers in readable form, and Google IDs are stored scrambled. Only the owner can see the private tester dashboard. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board as the law requires.
11. Changes to this policy
If we change this policy, we will update the date at the top and show a notice in the app before the change applies to you. Big changes, such as collecting a new kind of data, will ask for your consent again.
12. Contact and grievances
Email: support@bas2minute.com
Address: Kanpur, Uttar Pradesh, India
We acknowledge every complaint within 24 hours and resolve it within 15 days. Details: bas2minute.com/grievance