DigiBharosa privacy notice
Version 1.2 (beta) — 22 October 2026
DigiBharosa is a free public service that helps you check messages, links, numbers, payment IDs, apps and pictures for scams. It is run by Continuum AI Global Private Limited (the Data Fiduciary). This notice explains, in plain words, what we collect, why, how long we keep it and your rights under the Digital Personal Data Protection Act, 2023. This is a beta service: we follow the best practices of the DPDP Act, 2023, and we are not yet certified under it.
What we never collect or keep
- We never ask for, and never store, your OTP, UPI PIN, card number, CVV, Aadhaar number or bank password. Anyone who asks for these in our name is a fraudster.
- Screenshots and media you upload for a photo or deepfake check are deleted as soon as the check ends.
- We do not sell or rent your data, and we do not use it for advertising.
- To count visitors we use one small cookie that only remembers the date of your last visit — it holds no identifier, and we keep only daily totals. Apps, the browser extension and chat bots, which do not use the cookie, are counted once a day from the check record described below.
What we keep about your checks
- Each check made on our server is recorded with its type, its result and a shortened value: for a link only the website name; numbers, UPI and payment IDs partly hidden; for a message the first 60 characters with long numbers removed; nothing of pictures or files.
- The record is linked to your account when you are signed in, otherwise to a random code your phone made (never your number or network address). Our moderators use it to keep the service safe, to spot new scams and to improve the app; every look at it is recorded.
- Check records are deleted after 180 days. Checks made on your phone without internet are not seen by us.
Complaints, fact checks and reviews
- Complaint texts you prepare are kept in your account, encrypted, so you can open them on every phone or computer where you sign in. We never forward them to anyone and staff cannot read them in the console. Without internet a complaint stays on your phone until it is sent, and the phone's copy is removed when you sign out.
- Fact checks: when you are signed in, what you fact-check is kept in your history (encrypted) on all your devices; you can delete it. Without an account nothing is kept unless you ask our fact-check desk to check it.
- Automatic fact checks: when our desk has no answer, the text of the claim is sent to an AI service that searches the web for trusted sources (the provider is chosen by the operator and named on request). Phone numbers, e-mail addresses and account, card and UPI details are removed first, nothing about you is sent with it, and the provider is not allowed to use it for advertising. Answers can be wrong — every answer lists its sources so you can check them.
- Reviews and suggestions: your message, rating and — only if you give it — an e-mail or phone number (encrypted) so we can reply.
What we collect when you register (optional)
- Mobile number (your sign-in name), name, gender, date of birth, e-mail address, language and country — to create your account, keep it secure and show you advice in your language.
- A one-way hash of your password and of your optional 4-digit PIN (never the password or PIN itself), sign-in times and the consent version you accepted.
- You can use the checker without an account. Registration is only for features such as complaints and fact checks saved in your account on all your devices, alerts and faster sign-in.
What we collect when you report a scam (only with your consent)
- The scam link, number, ID or app you report, the type of scam and your optional description — long numbers (card, Aadhaar, account) are removed automatically.
- A pseudonymous code for your phone and a keyed hash of your network address (never the address itself), so one person cannot make a number look reported by many people.
- The message text only if you tick "Share the message text" — numbers and e-mail addresses are removed first.
- Reports warn other citizens only after a trained moderator has checked them.
Why we use it (purposes)
- To give you a scam verdict and advice; to protect other citizens through moderated warnings; to keep the service secure (preventing abuse, fake reports and break-ins); to meet legal duties.
- DigiBharosa never files complaints with the police or any authority for you. It helps you prepare the text; you decide whether and where to file it.
How long we keep it
- Account data, complaints and fact-check history: while your account is active, and deleted when you delete them or your account.
- Check records: 180 days. Reviews and suggestions: up to 2 years, or until you delete your account.
- Reports: up to 3 years after a moderator's decision, so that confirmed scams keep protecting people; rejected reports are removed sooner.
- Security records: moderator actions are kept in a tamper-evident audit trail for as long as needed for security and legal obligations.
Where your data is stored and how it is protected
- In our secure cloud infrastructure. Data is encrypted in transit (TLS 1.2+). Your mobile number, name, e-mail and date of birth are encrypted field by field in the database, so a copy of the database alone does not reveal them; the keys are kept separately. Passwords and PINs are stored only as salted hashes, and backups are encrypted.
- Access is limited to authorised staff, and every access to personal data by moderators is recorded.
How sure a result is
- Checks of messages, links, numbers and payment IDs show a risk score from 0 to 100 (higher means more warning signs); the website check shows a trust score from 0 to 100 (higher means more trustworthy).
- Each result also shows a confidence figure. In this beta it ranges from about 15% to 95% (photo and video deepfake checks at most 75%).
- No result is ever 100% certain: scam methods change frequently and new scams appear every day. Treat a result as guidance, not a guarantee, and confirm through official channels before you pay or share details.
Your rights
- Access and correction: see and edit your profile in the app (My profile); download everything we keep for your account (Profile → Download my data).
- Erasure: delete your account (Profile → Delete my account) or your reports and consent (More → Delete my reports).
- Withdraw consent at any time; this does not affect checks made before.
- Nominate a person to exercise your rights in case of death or incapacity, by writing to the Grievance Officer.
- Complain to the Grievance Officer; if you are not satisfied, you may approach the Data Protection Board of India.
Children
- Registration is for adults (18 years or older). Anyone under 18 can use the checker without an account. We do not knowingly create accounts for children.
Grievance Officer
- Grievance Officer, Continuum AI Global Private Limited, Mumbai, Maharashtra, India. E-mail: contact@continuumai.io. We acknowledge grievances within 48 hours and resolve them within 30 days.