Privacy Policy
1. Who we are
Bas (the website and app at bas2minute.com) is run by Kartikay Agarwal, an individual based in Kanpur, Uttar Pradesh, India ("Bas", "we", "us"). For the Digital Personal Data Protection Act, 2023, we are the data fiduciary for the personal data described here. Questions or complaints go to our Grievance Officer (section 12).
2. Bas is satire
Every store, rider, order, wallet, "Bas Money", card, UPI app and bank in Bas is pretend. No food, drink, tobacco, product or service is sold, prepared or delivered, and no real money moves when you "pay". The characters are fictional. If any screen ever asks you for a real card number, UPI PIN, OTP or password, it is not us: close it and tell us.
3. Who can use Bas
Bas is only for adults aged 18 or older. You enter your age as a number when you join. The Daru Theka counter and the Cigarette Counter open only if that age is 21 or older and you also tick a 21+ self-declaration each time you enter. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.
4. What we collect
| What | When | Why |
|---|---|---|
| Google sign-in: Google shares your name, email address, profile photo and a Google account ID with us. | When you tap Continue with Google | We keep your name, email address and Google ID in a separate identity store, apart from your app activity, with the email encrypted. We use them to recognise your account, to reply to you about your account or a complaint, and to send Bas emails only if you agree (see Marketing emails). We do not keep your profile photo. |
| Your age (required) and the date you entered it. Your age goes up by one automatically each year from that date. | When you join | The 18+ rule for Bas and the 21+ rule for the Daru Theka and Cigarette Counter. Under 18 cannot join; nothing is saved. |
| Name (optional) | Quick join, Profile | Greeting you |
| 21+ self-declaration: that you ticked the box | Each time you enter the Daru Theka or Cigarette Counter | The second 21+ check, on top of your age |
| Email address (optional) if you use Start free | Only if you type it at joining or in Profile. Not needed to use Bas. | Kept in the same separate, encrypted identity store. Used to reply to you, and for Bas emails only if you also tick the box. |
| Marketing email choice: yes or no, when, where you chose it, and the exact wording you saw | When you join or in Profile; the box is unticked unless you tick it | To send Bas updates and offers by email only to people who said yes, and to prove that choice |
| Sex — optional, "Prefer not to say" is fine | Quick join, Profile | Choosing a greeting. If you skip it, greetings stay neutral. |
| Area or location: a city or area you pick or type; or, only if you tap Share location, an approximate position rounded to about 100 metres; PIN code (optional) | Quick join, Profile | The pretend delivery address and local jokes. There is no live or background tracking. |
| App activity: which counters and items you open and "order", your pretend wallet and order history, feedback answers | While you use Bas | Running the app, restoring it on a new phone, and seeing which jokes work |
| Things you post: Adda board lines (with the area name you add), gang names and gang orders, Hall of Fame entries | Only when you post | Showing them to other Bas users. Hall of Fame entries are reviewed before they appear. |
| Campaign link tags (only if you arrive from a tagged link): utm_source, utm_medium, utm_campaign and utm_content. They describe the link, for example "instagram" or "organic-social", never you. A tag that contains an @ or a long number is thrown away. | When you open bas2minute.com from such a link | Kept on your phone only, to know later which link brought you. In this version they are not sent anywhere. |
| Technical data: IP address, browser and device type, time of visit | Every visit, in the hosting provider's logs | Security, preventing abuse, fixing faults |
Marketing emails
Joining Bas never depends on this. When you join you see an optional, unticked box (and, if you did not sign in with Google, an optional email field): "Send me Bas updates and offers by email". We email you only if you tick it. You can withdraw as easily as you gave it: untick Profile → Bas updates and offers by email, or tap the unsubscribe link that is at the bottom of every Bas marketing email. Either way we stop straight away. We never sell, rent or share your data with anyone for their marketing.
Microphone
Bas asks for microphone permission once, when your first in-app call opens. In this version Bas does not record, listen to, store or send your voice during calls; you can say No and every call still works.
What we never collect
Real card, bank or UPI details, PINs, OTPs or passwords; your contacts, photos, files, SMS or call logs; your continuous or background location; your messages to anyone.
5. Where your data is kept
Most of what you enter stays in your browser's storage on your own phone. A copy is stored on the servers of our hosting provider, Cloudflare (Cloudflare Pages, Workers and the D1 database), so your account and history can come back if you change phones, and so we can count events. Cloudflare may store or process this data in data centres outside India. Your Google name, email and ID are kept in their own table, separate from app activity, and the email is encrypted with a key only our server holds. Sign-in is handled by Google. We use no advertising or analytics companies: no Google Analytics, no Facebook pixel, no third-party tracking.
6. Who we share it with
We do not sell or rent your data, and we do not share it for advertising. It is shared only with:
- Cloudflare, which hosts the site and database for us;
- Google, for sign-in, under Google's own privacy policy;
- other Bas users, but only for things you choose to post (Adda board, gangs, Hall of Fame), shown with your display name or area as you entered them;
- government or law-enforcement authorities, when Indian law requires it.
7. How long we keep it
- Account and app data, including your age, your Google name, email and ID, and any email you gave us: while your account is active. If you delete your account, we erase it from our servers within 30 days.
- Your marketing email choice: while your account is active. When you withdraw, we stop emails at once and keep only the record that you said no, so we never email you again by mistake. It is erased when you delete your account.
- If you stop using Bas for 3 years, we may delete your account after telling you in the app.
- Security logs may be kept for at least one year, as Indian rules require.
- Counts that cannot identify anyone (for example "how many people opened Paan Shop") may be kept.
8. Your rights
Under the Digital Personal Data Protection Act, 2023 you can ask us to: tell you what personal data we hold and who we shared it with; correct or update it; erase it; and withdraw your consent at any time (this does not affect what was done before). To stop marketing emails, untick the switch in Profile or use the unsubscribe link in any email. You can also nominate someone to act for you if you die or cannot act. Write to the Grievance Officer. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
9. How to delete your account
Signing in with Google again later starts a fresh account. You can also remove Bas's access in your Google Account settings under "Third-party apps and services".
10. Security
The site uses HTTPS only. Access codes are never stored on our servers in readable form. Your email address is stored encrypted, in a store kept apart from app activity. Only the owner can see the private tester dashboard. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board as the law requires.
11. Changes to this policy
If we change this policy, we will update the date at the top and show a notice in the app before the change applies to you. Big changes, such as collecting a new kind of data, will ask for your consent again.
12. Contact and grievances
Email: support@bas2minute.com
Address: Kanpur, Uttar Pradesh, India
We acknowledge every complaint within 24 hours and resolve it within 15 days. Details: bas2minute.com/grievance