1. About this policy
BagMitra is an orchard record app for santra (orange) and mosambi (sweet lime) growers. This policy explains what the app and its server collect, where it is stored, who receives it and what your rights are, following India's Digital Personal Data Protection Act, 2023 (DPDP).
2. What we collect and why
Account
- Your mobile number (sign-in by OTP) or your Google account. Sign-in is handled by Supabase Auth; with Google sign-in, Google shares the details shown on its consent screen (such as name and email) with Supabase Auth. BagMitra's server uses only the account id and, if present, the mobile number.
Profile
- Name, language, village, taluka, district, an optional contact number, and your consents: storing your records, and (optional) WhatsApp reminders. BagMitra does not send WhatsApp messages yet; your choice is only saved.
- Your district and your plots' crop and area are used to pick the government notices meant for you.
Orchard records (what you enter)
- Plots: name, crop, variety, area, trees, spacing, irrigation, water source, soil, the plot location (a GPS point) and boundary.
- Bahar cycles, tasks and reminders, sprays, fertiliser inputs, irrigation, harvest, labour (worker name, wage, advance), expenses, sales (buyer name, quantity, rate, payment status), scouting notes, crop insurance policy (insurer, policy number, amounts), soil / water / leaf test values.
- Why: to run the app, show your records on your other phones, and keep a backup.
Photos and files
- Scouting photos stay on your phone. Photo backup if turned on: they are uploaded to a private Supabase Storage bucket (on Wi-Fi, or on mobile data if you allow it) and opened only through links that expire within minutes.
- Crop-loss claim photos and notes, and lab report files, stay on your phone only.
Location
- Read once, only when you mark a plot location or boundary or add a claim photo. There is no background tracking.
Voice
- Voice typing uses your phone's own speech service (on most Android phones, Google's), which may process the audio online under its own terms. BagMitra's server never receives audio. Reading aloud happens on the phone.
Other
- "Check a message": the pasted text is sent to our server to compare with official notices and is not stored anywhere; only its length and the result are logged.
- Which government notices you saw, dismissed or asked to be reminded of, and your notification preferences.
- Push alerts if turned on: your phone's push token (Firebase Cloud Messaging). Not active yet; reminders are scheduled on the phone.
- Server logs: time, address (IP), path and result of each request, for security and troubleshooting. They do not contain your record contents. Error reporting (Sentry) if turned on: receives error details.
- A small log on the phone stays there unless you tap "Send logs" and pick an app.
- Your plan and its period. BagMitra does not collect card or bank details.
3. Where it is stored
- On your phone (the app works offline).
- In a Supabase PostgreSQL database, in the Mumbai (ap-south-1) region per our setup guide. The server's own database if turned on: on BagMitra's rented server (VPS) instead.
- Photo backup if turned on: private Supabase Storage.
4. Who receives it
We do not sell your data or use it for advertising. Only these services process it for us:
- Supabase: sign-in, database, photo storage.
- SMS provider (chosen in Supabase): your number, to send the OTP.
- Google: Google sign-in (if you choose it); the phone's speech service; push if turned on.
- Open-Meteo: for weather, the plot location rounded to about 1 km; no name or number.
- data.gov.in (Agmarknet): only crop names, to fetch mandi prices; none of your data.
- Anthropic (AI summaries) if turned on: only the text of government GRs and circulars; no grower data.
- Sentry if turned on: error reports. The server hosting company: to run the API.
- Government authorities only where the law requires it.
5. How long we keep it
- While your account is active. When you delete a record in the app, the server keeps a "deleted" mark (so it disappears from your other phones too) and a history of changes used for sync.
- On a deletion request, your account, server records, photos, marks and history are erased within 30 days. Copies in the hosting service's database backups expire on their own schedule.
- Signing out keeps the records on the phone. If another account signs in on the same phone (after everything was sent), the previous account's records and photos are removed from the phone.
6. Your rights
- Access: all your records are visible in the app; accounts can be shared as CSV and reports as PDF. You can ask by email for a copy of what the server holds.
- Correction: edit records and your profile in the app.
- Erasure: ask as described below.
- Withdrawing consent: turn off the WhatsApp consent in Profile. Consent to store records is needed for the app to work; to withdraw it, ask for your account to be deleted.
- Grievance and nomination: write to us to raise a grievance or to nominate a person to exercise your rights. If not resolved, you may complain to the Data Protection Board of India.
7. How to ask for deletion
Write to the contact below with the mobile number or Google email you sign in with. After confirming it is you, we erase the account and its server data within 30 days and tell you. Data on the phone is removed when you uninstall the app.
8. Children
BagMitra is meant for adult growers, not for children under 18. If a child's data was entered, tell us and we will delete it.
9. Security
- All traffic between the app and the server uses HTTPS; every request's sign-in token is verified.
- Each account can read and change only its own records (in the server code and by database row-level security).
- Photos are in private storage behind short-lived links. Server secrets are never in the app.
10. Changes
If this policy changes, the new text and its "last updated" date appear on this page.
11. Contact
The privacy contact email is not published here yet; it will appear on this page.
Last updated: 5 November 2026