Privacy Policy — BABASITARAM PRO

Last updated: 29 October 2026

Applies to:

BABASITARAM PRO — Ultimate Privacy Shield (build 9.7.7)
BABASITARAM PRO Password Manager
BABASITARAM PRO Android App (APK)
BSRPRO Digital Khata — has its own data flow; see "Digital Khata" below

Developer: VIKRAM SINGH RAJPUT

🔒 Our Commitment

For Privacy Shield and Password Manager, your core data is stored locally on your device. We offer an optional, end-to-end encrypted Cloud Backup feature (which is OFF by default). Digital Khata is different and uses online services; see the Digital Khata section below.

All settings, preferences, and credentials are stored locally on your device. For browser extensions, this data is stored using built-in storage APIs (chrome.storage.local). For the Android App, your vault and passwords are encrypted locally on the device (AES-256-GCM, key derived from your master password with PBKDF2-HMAC-SHA256, 600,000 iterations). This data never leaves your device unless you explicitly export it or enable the optional Cloud Backup.

We do not collect:

❌ Browsing history
❌ Usage statistics
❌ Analytics or telemetry
❌ Cookies or readable credentials
❌ Health, financial, or location data

Privacy Shield and Password Manager: no account is required unless you choose to enable Cloud Backup. Digital Khata requires an account (Firebase Authentication).

📌 What Data Is Stored, And Where

The following data is stored locally on your device:

Data Type	Purpose
Settings & Preferences	To remember your chosen configuration (ad blocker, HTTPS, etc.)
Whitelist / Fireproof Sites	To protect specific sites from cleaning
Vault Sites & Saved Credentials	To autofill logins. Stored locally encrypted (Android: AES-256-GCM).
PIN (hashed) & Master Password	To unlock the Vault — stored locally, never transmitted.
Activity Logs & Statistics	To show recent activity and blocked trackers locally.

☁️ Optional Cloud Backup (Encrypted)

BSRPRO offers an optional Cloud Backup feature that allows you to sync your vault across multiple devices. This feature is strictly opt-in and off by default.

Zero-Knowledge Architecture: Your vault is encrypted locally on your device before it is uploaded. We use AES-256-GCM encryption. The server never sees your master password, PIN, or readable entries.
What the server sees: Your email address, the encrypted (unreadable) vault blob, and basic metadata (upload time, file size).
Authentication: We use an 8-digit OTP (One Time Password) sent to your email to securely verify your identity.
Service Provider: We use Supabase for authentication and encrypted file storage.
Data Deletion: Disabling Cloud Backup stops future syncs but does not automatically delete the existing backup from the server. To request permanent deletion of your cloud data, please email us at babasitarampro@gmail.com.

🌐 Network Requests

1. Filter List Updates (Automatic)

The extension downloads publicly published ad/tracker block-lists (EasyList, EasyPrivacy, uBlock Origin Annoyances) when it starts and on a timer. No personal data is sent.

2. Cloud Backup (Optional)

Only when you explicitly enable Cloud Backup, the app/extension will make requests to Supabase endpoints to send your email (for OTP) and upload/download the encrypted vault file.

3. Breach Check (Android & Extension)

When enabled, it sends only the first 5 characters of a SHA-1 hash of a password to api.pwnedpasswords.com/range/. No other data is sent.

🔗 Third Parties

For Privacy Shield and Password Manager, we do not sell, rent, or share any readable data. The only third parties your device talks to are:

Service	Purpose	When It Runs
Supabase	Auth & Encrypted Vault Storage	Only when Cloud Backup is enabled
EasyList / uBlock	Filter list downloads	Automatically (periodic)
haveibeenpwned.com	Opened as a website only	Only when you click the button

📒 Digital Khata

Digital Khata works differently. It uses online services (Firebase Authentication, Cloud Firestore, EmailJS) for shop details, customer records, and transaction emails. It is a separate module from the Password Manager.

📝 Changes to This Policy

If this policy changes, the updated version will be included with the next update and posted to:

https://github.com/ramhardamp/bsrpro

📬 Contact

Questions about this policy or data deletion requests:

📧 babasitarampro@gmail.com

Developer: VIKRAM SINGH RAJPUT
GitHub: https://github.com/ramhardamp/bsrpro

✅ Summary

Question	Answer
Do you collect my data?	❌ No (except email if you enable Cloud Backup)
Do you store my data on your servers?	⚠️ Only if you enable Optional Encrypted Cloud Backup
Can you read my passwords?	❌ Never. Cloud backups are end-to-end encrypted.
Do you use analytics or telemetry?	❌ No
Are my passwords encrypted?	✅ Yes (AES-256)
Can I delete my cloud data?	✅ Yes (Email us to request server deletion)

            BABASITARAM PRO is, and always will be, 100% free. No paywalls, no locked features, no telemetry, no tracking. Your privacy is the product — not you.
        