What stays in your browser

A few settings are kept in your own browser's local storage so the site remembers them between visits: light or dark mode, the colour theme, the filters and view you last used, whether you dismissed the “Install app” bar, and — if you add them without logging in — your list of PAN numbers. This data never leaves your device on its own, is not backed up anywhere, and clearing your browser's site data removes it for good.

PAN numbers and allotment checks

For registrars that cannot be queried automatically, the allotment page shows a link and nothing is sent: you type the PAN on the registrar's own page.

For registrars marked auto, the PAN is sent to this site's server, which asks that registrar and returns the answer. On that path the PAN:

• travels in the body of an encrypted (https) request, never in a web address, so it cannot end up in a browser history or an access log;
• is never written to any log — the server records the company and the outcome and nothing else;
• is not written to disk or cached for the check, and is not kept once the answer has been returned;
• goes to that one registrar and to no one else.

The allotment result comes from the registrar and is shown as given; the registrar's own page is the record.

If you create an account

An account is optional. It lets your PAN list follow you to any device. It is made with a mobile number or an email address and a password, or with Continue with Google. On the server:

• the PANs are stored encrypted (AES-256) and cannot be read without the server's key;
• your password is never stored, only a one-way scrypt hash of it;
• with Google, the site receives only your email address and Google's ID for your account. It never sees your Google password and gets no access to your Google account;
• a mobile number or email address is used only as your login. No messages, newsletters or marketing are sent to it;
• Delete account, on the login page, removes the account and every PAN in it immediately and for good.

Visit statistics (Google Analytics)

The site uses Google Analytics to count visits: which pages are opened, roughly where from (city level), and on what kind of device and browser. Google sets cookies for this and processes the data under its own privacy policy. It is told the address of each page you open and nothing you type — no PAN, no login and no allotment result is ever sent to it. You can block it with any tracker blocker, or opt out with Google's own browser add-on, and the site works the same.

What the server sees

Like every website, the server receives your IP address and browser type with each request. It does not keep them in its logs. An IP address is held in memory for up to 15 minutes only to limit how many allotment checks or login attempts one address can make, which keeps the service fair and protects accounts, and is then forgotten.

Who else receives data

• Hosting and delivery. The site runs on Google Cloud and is delivered through Cloudflare, which handle traffic to and from it as service providers.
• Registrars. A PAN you ask to be checked automatically goes to the registrar for that issue, as described above.
• Google. Visit statistics, and sign-in if you choose Continue with Google.
• The law. Data would be disclosed only where Indian law requires it.

Nothing is sold, rented or shared with advertisers or data brokers.

Cookies

• Sign-in. Logging in sets one cookie that keeps you signed in for up to 30 days. It cannot be read by page scripts, is sent only to this site, and is removed when you log out.
• Analytics. Google Analytics sets its own cookies, as above.

No advertising or cross-site tracking cookies are used.

Your choices and rights

• Use the site without an account, and your PANs never leave your browser except for an automatic check you start.
• Remove PANs from your list at any time, or delete your account to erase everything held about you on the server.
• Block or opt out of Google Analytics without losing any feature.

Children

The site is meant for adults who invest. It is not directed at anyone under 18, and accounts should not be created for them.

Changes to this policy

This policy may be updated when the site changes; the version on this page is the one in force. See also the disclaimer.