The short version
- Messages that need translating are translated on our server in India and not stored. Messages in languages you read are not sent to the translation service.
- Your phone number stays private. People find you by your @username, not your number.
- Chats between two people are end-to-end encrypted on the latest version of the app: messages, photos, videos, voice notes and files can be read only on your phones and theirs, not by us (apart from translation, below). Group and business chats are stored on our servers in India and are not end-to-end encrypted yet.
- No ads in the app, and we don’t sell your data. We count which features get used, never what you write.
- You can ask us to delete your account at any time.
Who we are
BharatChat is operated by Seruces Information Technology Private Limited, Hyderabad, Telangana, India (“BharatChat”, “we”, “us”). This policy covers the BharatChat apps for Android and iPhone, the web app, and this website.
Under India’s Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here. Questions go to support@bharatchat.co.
What we collect and why
| What | Why we need it | Who can see it |
|---|---|---|
| Phone number | To create your account and sign you in with a one-time code. | Only you. It isn’t shown to other people. |
| Profile: name, @username, about, photo, app language | So people can find you and know who they’re talking to. | Anyone signed in to BharatChat. |
| Messages: text, photos, voice notes, polls, reactions and replies. In end-to-end encrypted chats between two people we store only encrypted copies we can’t read, plus reactions and who sent what, when | To deliver them and keep your chats in sync across your devices. | The members of that chat. |
| Groups: name, photo, description, members, admins, invite codes, join requests | To run groups and invite links. | Group members; people with an invite link see the name, photo and member count. |
| Chat settings: pinned, archived, muted, notification level, delivered and read times, disappearing-message timer | So the app behaves the way you set it. | You. Delivered and read times are visible to the other people in the chat. |
| Notification token for each phone you sign in on | To send you new-message notifications. | Only our servers. |
| Service logs: for example that a notification was sent to an account, plus the technical data our cloud provider records (such as IP address and device type) | To keep the service working and secure. | Only authorised staff. Logs don’t contain message text. |
| Contacts: one-way hashes of the phone numbers in your address book, only if you allow access to contacts | To show which of your contacts are on BharatChat. We compare hashes; we don’t store names or your address book. | Only our servers. |
| Invites: if you join from a friend’s invite link, whose link it was | To open your chat with them, tell them you joined and show them how many friends joined from their invites. We don’t keep a list of the people you invite. | You and the friend who invited you. |
| Location: a place you send, or your live location while you share it | To show it to the people in that chat. Live location stops when the time you chose runs out or you stop sharing. | The members of that chat. |
| Calls: who called whom, when and for how long. Call audio and video pass through our call servers and are not recorded | To connect calls and show your call history. | You and the people on the call. |
| Shops and orders: a shop’s name, address, catalogue and hours; orders, bookings and their status | To run shops, orders and bookings between customers and shops. | The customer and the shop. Shop profiles are public. |
| Crash reports: device model, Android or iOS version, app version and what the app was doing when it crashed | To find and fix crashes. | Only authorised staff. Crash reports don’t contain message text. |
| App usage: that you signed up, sent your first message, started a call, sent an invite, set up a business, or sent or were paid a bill; your app language; whether you own a business; device model and app version; your approximate region (worked out from your IP address); an ID for this install of the app; and on Android, your phone’s advertising ID | To see which features people use, and to measure our own ads for BharatChat on Google. | Only authorised staff, and Google, which runs Google Analytics and Google Ads for us. Never message text, names, phone numbers or amounts. |
What we don’t collect
- Your address book itself. Contact names and numbers stay on your phone; only one-way hashes of numbers are checked.
- Your location in the background. Location is used only when you send it or while you share live location.
- Payment details. UPI payments happen in your own UPI app; we don’t see your bank account or UPI PIN.
- Data to show you ads. BharatChat shows no ads. The advertising ID in App usage is used only to measure our own ads for BharatChat; you can reset or delete it in your phone’s settings (on Android: Settings > Privacy > Ads).
Our staff don’t read your messages. We can’t read end-to-end encrypted chats, except the text of a message while our server translates it for the person reading it (see Translation); it isn’t stored. For other chats, we only access message content when we have to: to investigate a report of abuse, to comply with the law, or to fix a technical problem that can’t be fixed otherwise. When you report someone, the app sends us the last few messages from that chat, including from an encrypted chat, so we can review the report.
Translation
Your phone first works out which language a message is in. If it’s a language you read, the phone does not send it to the translation service.
If it isn’t, your phone sends the text of that message to our server in Google Cloud’s Mumbai region, which translates it with Google’s Gemini model on Vertex AI and sends the translation straight back. Links, email addresses, phone numbers and @mentions are held back on your phone and never sent. We don’t store the text or the translation on our servers or write them to our logs, and Google doesn’t use them to train its models. We keep only a count of how much you translated each day, to prevent abuse. Your phone keeps translations it has shown you so that chats reopen quickly.
This includes end-to-end encrypted chats. The message travels encrypted between the two phones, but when the person reading it needs a translation, their phone sends the decrypted text to our server for that translation, as described above.
Without an internet connection, your phone can translate Hindi, Bangla, Tamil, Telugu, Kannada, Marathi, Gujarati and Urdu by itself using Google ML Kit language packs (about 30 MB each, downloaded from Google once).
Machine translation can be wrong. Tap Show original to see exactly what was sent.
Website analytics
On our public marketing pages, website analytics is off by default. The “Website analytics” button in the footer lets you turn it on or off. Your choice is saved in this browser. Browser Do Not Track and Global Privacy Control preferences keep this measurement off.
If you turn it on, Google Analytics receives page views and clicks on Google Play and App Store download buttons, including the page path, website language, store and button position. Google also processes technical request information, such as IP address and browser information, to provide this service. We do not send chat content, phone numbers, names, payment details, page query strings or referral URLs with these website events. Website advertising storage, advertising personalisation and Google signals are disabled.
You can turn it off in the footer at any time. We stop sending website events and remove this site’s Google Analytics cookies. This website preference does not change analytics in the BharatChat app, described above. Download links and product previews work without website analytics.
Permissions on your phone
- Camera and photos: only when you take or choose a photo to send, or set a profile photo.
- Microphone: while you record a voice note or are on a call.
- Contacts: to find which of your contacts use BharatChat. Only one-way hashes of numbers leave your phone.
- Location: only when you send your location or share live location in a chat.
- Screen sharing: only while you share your screen during a call.
- Fingerprint or face unlock: to lock chats. This stays on your phone.
- Notifications: to tell you about new messages. You can turn them off per chat or in your phone’s settings.
You can change these permissions at any time in your phone’s settings. The rest of the app keeps working without them.
Who we share data with
We don’t sell your personal data. We share it only with:
- Google (Firebase and Google Cloud), which hosts our database, file storage and servers and verifies phone numbers at sign-in. To stop automated abuse, sign-in may use Google’s app-verification services.
- Google Firebase Crashlytics, which receives crash reports.
- Google Analytics for Firebase and Google Ads, which receive app usage (above) so we can see which features are used and whether our ads bring people who use BharatChat.
- Google Vertex AI (Gemini), which translates the text of messages that need translating, in the Mumbai region, without storing it or using it for training.
- Your Google Drive, if you turn on chat backup. The backup goes to your own Drive account, which we can’t read.
- Push notification services: Google Firebase Cloud Messaging and, on iPhone, Apple Push Notification service. A notification carries the sender’s name and a preview of up to 200 characters of the message, so that text passes through these services. For end-to-end encrypted chats the notification says only “New message”.
- Authorities, when Indian law requires it, for example a valid order from a court or government agency. We check that each request is lawful and share only what it requires.
- A new owner, if BharatChat is merged or sold. This policy would continue to apply to your data, and we would tell you first.
Where your data is stored
Our database and servers run in Google Cloud’s Mumbai region (asia-south1). Some of the services above, such as push notifications and sign-in verification, may process limited data outside India.
Data is encrypted in transit and at rest by our cloud provider.
End-to-end encryption. When both people use the latest version of the app on their phones, a chat between the two of them becomes end-to-end encrypted, and the chat shows a line saying so. Text, photos, videos, voice notes, documents, locations and contacts are encrypted on the sender’s phone, using the open, audited Olm protocol (Double Ratchet) and AES-256, so that only the phones of the two people can read them. Each phone keeps its own keys; we store only public keys and encrypted copies, which we can’t read. You can compare a security code with the other person (Contact info > Encryption) to check that nobody is in between. Messages sent before encryption was turned on stay as they were. Group chats, chats with businesses, status updates, channels and calls are not end-to-end encrypted yet; they are stored on our servers so they can be delivered and synced. Even for encrypted chats, we can see who talks to whom and when, and reactions.
How long we keep it
- Your account and profile: until you delete your account.
- Messages: until they’re deleted. When you delete a message for everyone, its text is removed for all members. Attached photos and voice notes are hidden and removed from our storage within 30 days.
- Disappearing messages: when a chat has a timer on, each message is deleted from our servers after that time.
- Service logs: up to 90 days, unless we need them longer to investigate abuse or because the law requires it.
- App usage: up to 14 months in Google Analytics.
When you delete your account, we delete your profile, username, phone number and notification tokens within 30 days. Messages you already sent stay in other people’s chats, because they’re part of their conversations, but they’re no longer linked to your profile.
Your rights
Under the Digital Personal Data Protection Act, 2023, you can:
- Access a summary of the personal data we hold about you.
- Correct or update it. You can edit your name, username, about, photo and language in the app at any time.
- Erase it, by deleting your account.
- Withdraw consent. Your data is then deleted as described above, and you won’t be able to keep using BharatChat.
- Nominate someone to exercise these rights if you die or can’t act yourself.
- Raise a grievance with our Grievance Officer (below). If you’re not satisfied, you can complain to the Data Protection Board of India.
To make a request, email support@bharatchat.co from the email address you want us to reply to, and include your @username. We’ll confirm it’s you before acting, and reply within 30 days.
Children
BharatChat is for people aged 18 and over. We don’t knowingly collect data from children. If you believe a child is using BharatChat, tell us at support@bharatchat.co and we’ll delete the account. Read our child safety standards.
Security
Access to your data is controlled by security rules on our servers: only chat members can read a chat, only you can read your phone number, and only you can change your profile. We limit staff access and keep our systems up to date. No system is perfectly secure, so please keep your phone locked and don’t share sign-in codes with anyone. BharatChat will never ask you for one.
Changes to this policy
If we make a significant change, we’ll tell you in the app before it takes effect. The date at the top of this page shows the latest version.
Contact and Grievance Officer
For privacy questions or complaints, contact our Grievance Officer:
Sridhar T, Grievance Officer
Seruces Information Technology Private Limited
Hyderabad, Telangana, India
Email: support@bharatchat.co
We acknowledge complaints within 24 hours and resolve them within 15 days, as required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.