Privacy policy

• When you check allotment, the PAN you enter is sent to that IPO's registrar. We don't save check results on our server.
• If you don't sign in, your saved PANs and check history stay in your browser.
• If you sign in with Google, your saved PANs, their labels and holder names are stored on our server, encrypted.
• No ads, no analytics or tracking tools, and we never sell your data.

PANs and labels. The PANs you type, paste or import (files are read in your browser), and any label you give them, such as "Mom".

Allotment results. What the registrar returns for a PAN: the applicant's name as the registrar has it, whether shares were allotted, and the shares or lots applied for and allotted. We discard other details a registrar may return, such as application numbers and demat account IDs.

Your Google account, if you sign in. Your name, email address, whether the email is verified, a link to your profile picture and your Google account ID, plus the sign-in tokens Google issues. We only ask Google for basic profile and email access, so we can't see your Gmail, contacts, Drive or anything else in your Google account.

Session and technical details. While you're signed in, we store a session token with your IP address and browser type (user agent). To prevent abuse, allotment checks are rate-limited by IP address, held briefly in memory. Our hosting provider may also record IP addresses in its standard server logs.

Preferences. Your theme and whether to show full PANs, saved in your browser.

• To check allotment with the registrar and show you the result.
• To save your PANs, with their labels and holder names, so you don't have to type them again, and to sync them to your account if you sign in.
• To keep you signed in, protect your account and stop abuse of the service.
• To find and fix problems. Our logs note that a check ran and its outcome, showing only the last four characters of the PAN (like XXXXXX234F). They never contain full PANs, names or email addresses.

We don't use your data for advertising or profiling, and we don't sell or rent it to anyone.

On our server, only if you sign in:

• Your account details, your sessions, and the sign-in tokens Google issues (encrypted).
• Your saved PANs, labels and holder names, encrypted with AES-256-GCM using a key kept separately from the database. We also store a keyed hash of each PAN so the same PAN isn't saved twice. You can save up to 200 PANs.

In your browser, on each device you use:

• Your check history: each result with its PAN, holder name and label. This always stays on your device and is never sent to our server.
• Your saved PANs, if you aren't signed in. When you sign in on a device that has saved PANs, we ask whether to move them to your account or keep them only on that device.
• Your preferences.

Browser storage isn't encrypted by us, so anyone who can use your browser profile can see it. Files you export (CSV or Excel) contain full PANs and names, so store them carefully.

• Registrars. When you run a check, our server sends the PAN and the IPO to the registrar handling it: Bigshare Services, KFin Technologies (whose service runs on Amazon Web Services) or MUFG Intime. The registrar's own privacy policy covers what it does with it.
• Google. To sign you in, if you choose to.
• Logo.dev. Your browser loads company logos from Logo.dev, which receives your IP address and browser details, as any website you load images from does. We only ever send Logo.dev company names and websites, never your data.
• Our hosting provider, which stores and processes data on our behalf.
• Authorities, if the law requires it, or to protect the rights and safety of our users or the service.

IPO information comes from sources such as NSE and IPOWatch. We don't send them anything about you.

Through Google Sign-In we receive only your name, email address (and whether it's verified), profile picture link and Google account ID, along with the sign-in tokens Google issues. We use them only to create your account, identify you when you return and show you which account you're signed in with. We don't share them except with our hosting provider to run the service, or when the law requires it, and we never use them for advertising.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Allotment Checker's access at any time from your Google Account connections.

We only set cookies when you sign in, and only to keep you signed in:

• better-auth.session_token keeps you signed in, for up to 7 days.
• better-auth.session_data is a short-lived copy of your session (5 minutes) so pages load faster.
• better-auth.state protects the sign-in step from forgery and lasts only while you sign in.

In your browser's storage we keep your saved PANs (when signed out) and check history in IndexedDB, and your theme and show-PANs preference in local storage. There are no advertising or analytics cookies.

• Your account and saved PANs: until you remove the PANs or delete your account.
• Sessions: they expire after 7 days without use and are deleted when you sign out or delete your account.
• IP addresses used for rate limiting: about 10 minutes, in memory only.
• Server logs: only as long as needed to fix problems.
• Data in your browser: until you clear it.

• Remove a saved PAN in Saved PANs settings.
• Clear your check history, or remove all saved PANs, in Data settings.
• Delete your account in Data settings. This permanently removes your account, sessions, Google sign-in tokens and saved PANs from our server. For your security, you may be asked to sign in again first. It doesn't touch data in your browser, so clear your history on each device as well.

Under India's Digital Personal Data Protection Act, 2023, you can ask to access, correct or erase your personal data, withdraw your consent, nominate someone to act for you, and raise a grievance. Email gautamrudani1@gmail.com and we'll respond as soon as we can, within the time the law requires. If you're not satisfied with our response, you can complain to the Data Protection Board of India.

If you check a PAN that belongs to someone else, such as a family member, you must have their permission. See our Terms of use.

Saved PANs, labels, holder names and Google sign-in tokens are encrypted on our server, and each saved value can only be decrypted for the account and field it belongs to. Changes to your saved PANs are only accepted from this site, and PANs are masked in our logs. No system is perfectly secure, though, so please keep your device and your Google account protected too.

Allotment Checker is meant for people aged 18 and over. If you're a parent or legal guardian checking a minor's PAN, you're responsible for doing so on their behalf. We don't knowingly collect data directly from children.

When we change how we handle data, we'll update this page and the date at the top. If a change is significant, we'll point it out on the site.

Allotment Checker is run by Gautam Rudani, India. For privacy questions, data requests or grievances, email gautamrudani1@gmail.com.