Privacy Policy

App name: Dokani (Babsayi)
Package ID: com.babsayi.babsayi
Effective date: 21 May 2026
Last updated: 21 May 2026

This Privacy Policy explains how the Dokani mobile application ("the App", "we", "us", "our") collects, uses, stores, shares, and protects your information. Dokani is a business management application intended for small and medium business owners in Bangladesh. By installing or using the App, you agree to the practices described below.

Dokani is not directed to children under 13. The App is designed for adult business owners and their authorized staff. We do not knowingly collect personal information from children under 13.

1. Information We Collect

1.1 Information You Provide

When you register and use the App, you provide the following information:

Account details: your full name, Bangladeshi mobile phone number (11-digit, format 01XXXXXXXXX), and a password of your choice.
Business profile: business name, business type, invoice prefix, address, contact details, and optionally a business logo image.
Business operating data that you enter into the App, including:
- Customer and supplier records (party name, phone number, address, opening balance).
- Inventory items (name, category, unit, price, stock).
- Accounts (cash, bank, mobile wallet) and balances.
- Sales, purchases, payments, expenses, income entries, returns, and account transfers.
- Free-text notes, references, and invoice numbers.
OTP verification code: a one-time code we send to your phone number to verify ownership during signup and password reset.

1.2 Information Collected Automatically

Authentication tokens: server-issued session tokens stored on your device so you stay logged in.
Sync metadata: timestamps, dirty flags, and watermarks we use to synchronize your local database with our cloud.
Crash and error logs: if the App encounters a server error, we may log it on our server for debugging. These logs do not deliberately include your password or financial values, but may include user and business identifiers.
Approximate request metadata: our server records the IP address, timestamp, and route of each API request as a normal part of web-server operation.

1.3 Information We Do Not Collect

The App does not access or transmit any of the following:

Your contacts, call logs, or SMS messages.
Your precise or approximate location.
Your camera, microphone, photos, or files outside the App's own storage.
Advertising identifiers or behavioral tracking data.

The App requests only the android.permission.INTERNET permission to communicate with our servers.

2. How We Use Your Information

We use the information described above only for the following purposes:

To create and authenticate your account.
To send one-time SMS codes for signup and password reset.
To store and synchronize the business data you enter, so it is available across your devices and protected against device loss.
To provide application functionality such as ledgers, reports, invoicing, and balance calculations.
To process and validate subscription payments.
To diagnose crashes and improve reliability.
To prevent abuse, fraud, and unauthorized access (request signing, rate-limiting, security audits).

3. Where Your Data Is Stored

Your data is stored in three locations:

Location	What it stores	Provider
On-device SQLite database	A local mirror of your account and business data, used for offline access and faster reads.	Stored in your device's private application storage; not readable by other apps.
Cloud database (Supabase)	Your business data, accounts, transactions, parties, items.	Supabase (PostgreSQL hosting). See supabase.com/privacy.
Authentication & billing API	Account credentials (password is stored as a salted bcrypt hash), phone numbers, OTP records, subscription records.	Our own Laravel server hosted at `dokani.kamrulhasan.xyz`.

4. Sharing With Third Parties

We do not sell your personal information. We share it only with the processors that are necessary to operate the App:

Third party	Purpose	Data shared
Supabase Inc.	Database hosting and realtime sync.	Business records you enter and your user identifier.
SMS gateway provider	Delivery of OTP codes to your phone number.	Phone number and OTP message.
Payment gateway(s) (bKash, Nagad, SSLCommerz — as applicable)	Processing subscription payments. You are redirected to the gateway's own page; we do not see or store your full card or wallet credentials.	Transaction reference, amount, your phone number.
Google Fonts	Bengali typeface delivery for the App's user interface.	Your device's IP address (handled by Google as part of the font request).
WhatsApp	Optional — used only when you choose to contact us through the in-app "Contact via WhatsApp" link.	Whatever message you choose to send.

We may also disclose information if required by a valid legal process (court order, subpoena) issued by a competent Bangladeshi authority.

5. Data Security

All network traffic between the App and our servers uses HTTPS (TLS).
API requests are signed with an HMAC-SHA256 signature to prevent unauthorized clients from calling our backend.
Passwords are never stored in plain text; they are hashed with bcrypt on the server.
Row-Level Security policies in our cloud database restrict each user to data belonging to their own business.
The local SQLite database is stored inside the App's private storage area, which Android isolates from other applications.

No method of electronic transmission or storage is 100% secure. While we follow industry-accepted practices, we cannot guarantee absolute security.

6. Data Retention

We retain your account and business data for as long as your account is active. If you request deletion, or if your account remains inactive for an extended period, we will delete or anonymize your data within a reasonable timeframe, except where retention is required for tax, accounting, or legal obligations applicable in Bangladesh.

7. Your Rights

You may at any time:

Access the data we hold about you (most of it is visible inside the App).
Correct inaccurate information by editing it in the App.
Request export of your data in a portable format.
Request permanent deletion of your account and associated business data.
Withdraw consent for processing (this will require closing your account, since processing is necessary to operate the App).

To exercise any of these rights, contact us using the details in Section 11.

8. Children's Privacy

Dokani is intended for adult business owners and authorized employees. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to the App, please contact us and we will delete it.

9. International Data Transfers

Supabase may store your data in regions outside Bangladesh. By using the App you consent to such transfers. Our Laravel server is hosted at dokani.kamrulhasan.xyz and operates from a region we choose to provide reliable service to Bangladeshi users.

10. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, where the change is material, notify you within the App or by SMS. Continued use of the App after changes take effect constitutes acceptance of the revised policy.

11. Contact Us

If you have any questions, concerns, or requests about this Privacy Policy or your data, please contact us:

Developer:Dokani
Email: dokani@rushdha.com
Website: https://dokani.rushdha.com
Country: Bangladesh