Privacy policy
1. What stays on your device
To work offline-friendly and never repeat a card in a night, Bawaal saves a few things in your browser's local storage (or the app's on-device storage):
To work offline and never repeat a card in a night, Bawaal saves a few things on this phone or tablet:
| What | Why | How long |
|---|---|---|
| Settings: spice level, Daaru Mode on/off, timer, sound and haptics | So the game opens the way you left it | Until you clear it |
| Settings: spice level, timer, sound and haptics | So the game opens the way you left it | Until you clear it |
| Player names you type | For turns, teams and "{p1}" cards | Until you clear it |
| Cards played tonight and your last deck | No repeats, plus "Phir se" (replay) | About 12 hours for the no-repeat list |
| Age confirmations for Besharam and Daaru Mode | So we don't nag you every round | Until you clear it |
| Your age check for the age-checked cards | So we don't ask you every round | Until you clear it |
| Feedback notes you save ("Kaisa raha?" and card reports) | So you can send them later, even after a party with no signal | Until you delete them (the newest 200 are kept) |
| A short note of errors (the last 10) | So Bawaal can offer to send a crash note you approve | The newest 10 are kept |
| Your two privacy choices (crash reports, usage sharing) | So Bawaal remembers them | Until you change or clear them |
| Tonight's reels, in the apps only, if you switch on "Reel bana do" (section 5) | So you can watch, save or share them | Deleted from the app 12 hours after they're made; Delete removes one at once |
None of this is sent to us or anyone else except as sections 2 and 3 describe, or when you send a feedback note yourself (below). To erase it, clear site data for bawaal.app in your browser settings, or uninstall the app.
None of this is sent to us or anyone else except as sections 2 and 3 describe, or when you send a feedback note yourself (below). To erase all of it, delete the app.
Feedback you choose to send. After a game Bawaal may ask "Kaisa raha?", and every card has a Report option. Your answers are saved on your device first, and if you type a name from your player list in a note, it is replaced with "[naam]". Nothing is sent automatically: you see the exact text first, and it leaves only when you send it yourself, by email, through an app you pick or by copy and paste. It contains your answers, the app version, the type of device (phone or tablet, and its system version) and, if you leave "Include game stats" on, which games you played, for how long and how many rounds. It contains card text only when you report that card. We use what you send only to improve Bawaal and to reply to you, and we delete it when you ask.
Crash notes you choose to send. If a screen fails or the app closes by itself, Bawaal keeps a short note on your device: the error message, where in the app's code it happened, the app version and build, the type of device and its system version, and which screen or game was open. It never contains player names (they are replaced with "[naam]"), card text, your content settings or anything that identifies you or your device. The next time you open Bawaal it may ask once whether to send a crash note. Like feedback, you see the exact text first and it leaves only if you send it yourself. This is separate from the automatic crash reports in section 2.
2. Crash reports (iPhone and Android apps)
What. When the app crashes or hits an error, it sends an anonymous crash report to Firebase Crashlytics, a Google service, in a Firebase project used only by Bawaal. A report contains what went wrong (the error, and where in the app's code it happened), the app version and build, the device model, its operating system and version, free memory and storage, whether the app was in the foreground, and a random installation ID that Crashlytics creates for the app on this device. For an error in the game's own code, the message is cleaned the same way as a crash note first: player names, card text and anything you typed are masked. A report never contains your name, player names, cards, custom cards, your settings, the spice level or Daaru Mode, your contacts or your location, and we never attach an account or user ID.
Why. Only to find and fix crashes, faster than waiting for someone to send a crash note.
On by default, and how to switch it off. Crash reports are on when you install the app. Switch them off any time in Settings › Privacy › "Crash reports bhejo". When they are off, nothing is sent: collection stops and reports the app hasn't sent yet are deleted. Your choice stays until you change it or reinstall. The web game at /play sends no crash reports.
Who processes it, and for how long. Google processes crash reports for us as a service provider, under the Firebase data processing terms and Google's privacy policy. Crashlytics keeps crash reports and their installation IDs for 90 days. Crash reports are not used for advertising or tracking and are not linked to you.
3. Usage sharing (optional, 18 or older, off by default)
Where available, Settings › Privacy › "Share usage" lets someone aged 18 or older opt in on that device or browser. It is off until you turn it on, it is separate from crash reports, feedback and the content age checks, and no screen asks you to turn it on. We send only two events to Google Analytics (Firebase, the same Bawaal-only project): that Bawaal was opened after you opted in, and that a round finished. They contain no player names, card text, custom cards, game mode, party settings, age or date of birth, feedback, full web addresses or search text.
Google Analytics also processes an app or browser identifier and standard technical information such as app version, operating system, device category, engagement and session activity, and Google can work out an approximate region from network information. We don't request precise location, advertising identifiers are switched off, Google signals are off, and nothing is used for advertising. On the web, the Google tag and its cookies load only after you opt in; the website's information pages never load analytics.
When you turn sharing off, Bawaal stops sending events and resets the analytics identifier (and, on the web, its cookies). Reports Google already received are not deleted by the switch; Google Analytics keeps event data for two months. Your choice stays until you change it or clear the app's data. Leave usage sharing off on devices used by children.
4. What we don't do
- No sign-up, account, email or phone number in the game. (The iPhone beta sign-up on the website is separate: see section 7.)
- No ad networks, advertising identifiers, tracking pixels or fingerprinting, and no tracking across other companies' apps or websites.
- No sale of personal data, and no sharing beyond what sections 2, 3 and 7 describe, including online quiz rooms below.
- No contacts or location access. The camera and microphone are used only for reels, only after you switch them on, and the video stays on your device (section 5).
5. Motion sensors and reels (Sar Pe Phone)
Sar Pe Phone (forehead guessing) uses your phone's motion sensors to detect "tilt down = sahi, tilt up = pass". Sensor readings are processed instantly on the device and are never stored or transmitted. On iPhone, the app (or Safari, on the web) may ask permission first. You can always play with on-screen buttons instead.
Reels ("Reel bana do", iPhone and Android apps). Reels are off unless you switch them on in Sar Pe Phone, and the switch turns itself off again the next night. Only when you switch it on does the app ask for the camera and the microphone. During a round the front camera records the people giving clues, with a red REC sign on screen, and the camera goes off between rounds. The reel is made on your device: on iPhone, the video with the words, the score and a Bawaal end card; on Android, the recorded clip, with the words shown over it when you watch it in the app. A reel never contains player names, and it never shows age-checked card text or cards you wrote. The reel stays on your device. We never upload it and never see it: it leaves your device only if you save it to Photos (the app asks for permission to add to Photos the first time) or share it yourself through your phone's share sheet. Reels you don't save are deleted from the app 12 hours after they're made, and Delete removes one at once. The web game never uses the camera.
6. Hosting
The website, web game and online quiz are hosted by Vercel. Like any web host, Vercel may process basic technical request data (such as IP address, browser type and time of request) to deliver the site and protect it from abuse. We don't use this to identify you, and we don't combine it with anything else. Fonts and images are self-hosted, so loading Bawaal doesn't call Google Fonts or any other third party.
Online Buzzer Beater rooms
When you host or join an online quiz, Bawaal sends the room code, team names, quiz actions, custom questions and answers (if supplied), scores and connection status to its server so everyone can play together. Use a nickname rather than personal information. Team names and scores are shared with the room; question text and answer keys are available only to the quiz master. No microphone audio is recorded or sent.
Vercel runs the room service, and Upstash Redis stores room state for us in Mumbai. Rooms and their stored state expire 12 hours after creation. Short-lived request limits help prevent abuse; hosting providers also process technical request data under their own policies. Room access tokens stay in your browser’s session storage and survive reloads; closing the tab may end your ability to rejoin as the host. Online quiz data is used to run the game, not for advertising or usage analytics. See Upstash’s privacy policy.
Google Play. The Android app is downloaded and updated through Google Play, which handles that under Google's own privacy policy. Google Play Console shows us overall numbers, such as installs and crash rates, plus any review you choose to post.
7. iPhone beta sign-up
If you join the iPhone beta on our beta page, you sign in with Google or Apple so we know the email is yours. We store your email to invite you to the beta and to count testers: we keep that email, that you signed up for Bawaal, and when. Apple receives the email so it can send you the TestFlight invitation (Apple's privacy policy covers TestFlight). The sign-up service runs on Google Firebase and is shared by the apps Vidit Chopra makes (ForwardCheck, Bawaal, Pagefond and Fish2Shark). Signing up doesn't create a Bawaal account, and we use the email for nothing else. Google's sign-in code loads on that page only after you tap Join. To be taken off the beta list, write to contact.techfusionlab@gmail.com.
8. Age and content
Bawaal is made for adults hosting parties. Besharam (NSFW) and Daaru Mode (drinking games) are 18+ and legal-drinking-age only, off by default and behind a confirmation. Sanskari mode is family-friendly and is meant to be played with an adult hosting. Usage sharing is only for people aged 18 or older and needs its own choice in Settings; the content age checks never turn it on. Crash reports carry no personal data about anyone, including children.
Bawaal is made for adults hosting parties. Some cards sit behind an age check, off by default and behind a confirmation. Sanskari mode is family-friendly and is meant to be played with an adult hosting. Usage sharing is only for people aged 18 or older and needs its own choice in Settings; the content age check never turns it on. Crash reports carry no personal data about anyone, including children.
9. What will change when accounts arrive
Later we plan to add optional sign-in (using Google Firebase Authentication) for things like multi-phone rooms and saving custom decks. When that ships:
- Accounts will stay optional. Single-phone play will keep working without one.
- We'd collect only what sign-in needs: an account ID, the email address or phone number you sign in with, and a display name you choose. Room and deck data you create would be stored so the feature works.
- Google (Firebase) would process this on our behalf as a service provider. We'll name any other provider here.
- You'll be able to delete your account and its data in the app or through /delete-account.
- We'll update this page with a new effective date and show a notice in the app before any collection starts.
10. Your rights (India)
Under India's Digital Personal Data Protection Act, 2023, you have the right to access, correct and erase personal data and to have grievances addressed. The only personal data on our side that names you is a beta sign-up email: write to us to see, correct or erase yours, and we'll respond within 30 days. Crash reports and usage sharing are not tied to a Bawaal account or to your name, so we usually can't find one person's reports; switching them off stops future collection, and crash reports are deleted after 90 days.
11. Contact and grievances
Questions or complaints: contact.techfusionlab@gmail.com (subject "Bawaal privacy").
← Back to Bawaal