Last updated 3 November 2026

Privacy policy

The short version: this website doesn't track you, your IPOYOGI workspace is private to your account and stored in India, and we don't sell data.

This website

No analytics, advertising or tracking cookies.
Your light or dark theme, and the broker you last picked in the brokerage calculator, are saved in your own browser only.
Our host, Hostinger, keeps standard server logs (IP address, browser, pages requested) for security and reliability.
The home page loads a 3D graphics library from cdnjs (Cloudflare). Like any website, that server sees your IP address. No personal data is sent.
The invite form opens your own email app. We receive only what you choose to send, and use it to reply and arrange your invite.

The online app (app.ipoyogi.com) and the Mac app both sign in to your private workspace on our server: Oracle Cloud, Mumbai, India.
Each account has its own separate database, reached only over HTTPS.
It holds what you enter: account holder names, PANs, UPI IDs, bank and OD accounts, applications, transfers, ledgers and allotments.
If you connect a broker (Upstox, Fyers or Dhan), its API key and daily sign-in token are kept in a separate secret store on the server until you disconnect it or delete your account.
The Mac app also has a local-only mode. In that mode the workspace stays in a file on your Mac and isn't sent to us.
We look at your workspace only to run the service, or to help when you ask for support.

We store your name and email, and your password and PIN only as salted one-way hashes (PBKDF2). Passkeys store only a public key.
Google sign-in shares your Google name and email with us, nothing else.
Cookies: "session" keeps you signed in for up to 30 days; "passkey_challenge" lasts 2 minutes during passkey sign-in. No ad, analytics or tracking cookies, and every app script is our own.
Your browser also remembers preferences such as theme and your username, on your device only.

Server backups are encrypted (AES-256), made nightly and before every update, and kept on the server for 30 days. Encrypted copies kept off the server (on our own Mac and Google Drive) are deleted within 60 days.
Backups you make yourself go where you choose. Password-encrypted backups use a password only you know; we can't recover it.
Server logs record the kind of request and the page path only, not what you type.

Registrar result pages (KFintech, Bigshare, MUFG Intime) and NSE/BSE, when you check allotment. They receive the IPO and the PANs you choose to check.
Upstox, Fyers or Dhan, only for broker accounts you connect yourself.
Public IPO data sources such as NSE, BSE and GMP trackers. No personal data is sent to them.
Optional cloud sync and Google Drive copies stay off unless you turn them on.
Each service handles data under its own privacy policy. We have no payment or email-marketing provider.

You decide whose details go into IPOYOGI. Only add family members who have agreed to it.

Under India's Digital Personal Data Protection Act, 2023, you can ask to see, correct or delete your data, and withdraw consent.
To delete your account and workspace, or for any privacy request or complaint, email hello@ipoyogi.com. We'll confirm once it's done. Copies in server backups are gone within 30 days, and off-server copies within 60.
We aim to answer within 7 days. If you're not happy with our answer, you can complain to the Data Protection Board of India.
Please never email PANs, passwords, OTPs or bank details.

HTTPS everywhere, hashed passwords and encrypted backups. No system is perfect; if a breach affects you, we'll tell you as the law requires.

IPOYOGI accounts are for adults. Minors' details should only be added by a parent or guardian.

If this policy changes, the date at the top changes too. See also our Terms of use and Disclaimer.