Privacy policy and account deletion for the Basha Bazar app
Last updated: 15 September, 2026
Basha Bazar (“the app”, “we”) helps people find rental houses (“to-lets”) on foot in Bangladesh. It records the route you walk, lets you pin to-lets you find, and lets you share what you find with other users.
This policy explains exactly what the app collects, why, where it is stored, who can see it, and how to delete it.
Contact: tasmirolislam@gmail.com Developer: Tajmirul Islam
When you sign in with Google we receive and store:
| Data | Why |
|---|---|
| Email address | Identifies your account |
| Name | Shown as the contributor name on to-lets you share publicly |
| Google account identifier | Links your data to your account |
There is no other way to use the app — an account is required, and we do not support anonymous use.
| Data | When | Visible to |
|---|---|---|
| Precise location, in the background | Only between you pressing Start Walk and Stop Walk | Only you |
| Precise location, in the foreground | While the map is open, to show your position | Not stored |
| Location of a to-let | When you pin one | Everyone, if you mark the to-let public |
Background location. The app records your walking route so you can see which streets you have already covered. This happens only while a walk is active — never at other times. An ongoing notification is shown while recording. Recorded routes (“trails”) are private to you: no other user can see them.
You can use the app without granting background location; you simply will not get route recording.
When you pin a to-let you may enter rent, contact phone number, number of rooms, washrooms, balconies, floor, sunlight, gas type, free-text details, and photos.
You choose whether each contribution is public (visible to all users) or private (visible only to you).
Photos you attach are uploaded and stored. You may also photograph a “To Let” sign so the app can read the phone number from it — see Automated phone-number scanning below.
The app keeps a local database on your device holding pending changes that have not yet been uploaded, so it works offline. This is removed when you uninstall the app.
To understand how the app is used and where it is confusing or broken, we use PostHog. It collects:
| Data | Detail |
|---|---|
| Screens you open and buttons you tap | Screen name and control name only |
| A small set of app events | e.g. a walk started, a to-let saved, a phone-number scan — recorded as counts and yes/no flags |
| A recording of your screen while using the app | See the masking rules below |
| Device and app information | Device model, operating system version, app version, language |
| Your account id, email and name | So a recording can be linked to your account |
Screen recordings are masked. Before anything leaves your device, the app hides:
These appear as blank blocks in the recording. What the recording does show is the layout you saw, where you tapped, and the map as displayed on your screen — which can reveal the area you were in while using the app.
App events never include a rent amount, a phone number, a photo, free text you wrote, or your coordinates.
We use this only to improve the app. It is not used for advertising, and we do not sell it.
To-let listings usually contain a landlord’s or caretaker’s phone number, which is information about a person who is not a user of this app.
By entering such a number and marking the contribution public, you are publishing someone else’s contact details to other users. Only enter contact information that is already publicly displayed — for example, written on a “To Let” sign visible from the street — and do not enter it if you have been asked not to share it.
If you are the owner of a phone number published in the app and want it removed, contact us at tasmirolislam@gmail.com and we will remove it.
If you use the photo-scan feature, the photo is sent to Google’s Gemini API
(gemini-3.1-flash-lite) to extract the phone number from the image. Google processes
the image on our behalf under their API terms.
We store the scanned image, the extracted result, and usage counts, so we can measure and improve accuracy. These records are private to your account and are not shown to other users.
| Data | Who can see it |
|---|---|
| Your email and Google account id | Only you and us |
| Your name | Other users, on to-lets you make public |
| Your recorded walking routes | Only you |
| Public to-let contributions and their photos | All users, and anyone using the app’s public data |
| Private to-let contributions | Only you |
| Your scan history and scanned images | Only you and us |
| Your usage events and masked screen recordings | Only you and us (held by PostHog on our behalf) |
Photos are stored in a publicly readable storage bucket. File paths are long random identifiers that cannot be guessed, and the app never shows a private to-let’s photos to another user — but anyone who obtains the direct URL of a photo can open it, even if the to-let is marked private.
Do not attach photos to a private to-let that you would not be willing to have seen if the link were shared. We intend to close this gap in a future release.
Data is stored with Supabase, our backend provider, on servers in the
Tokyo, Japan region (ap-northeast-1). If you use the app from Bangladesh or
elsewhere, your data is transferred to and stored in Japan.
Sub-processors:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, file storage, authentication | All data described above |
| Google (Sign-In) | Authentication | Email, name, account id |
| Google (Maps) | Map display | Map requests from your device |
| Google (Gemini API) | Phone-number scanning | Photos you choose to scan |
| PostHog | Usage analytics and masked session recordings | Screens, taps, app events, device info, your account id/email/name |
We do not use advertising networks, and we do not sell your data or share it for advertising.
In the app: open Profile → Delete account. This permanently deletes your account, your to-lets and contributions, your photos, your recorded routes, and your scan history. It cannot be undone.
Analytics and screen recordings are not covered by that button. They live with PostHog rather than in our database, so deleting your account does not erase them. Email tasmirolislam@gmail.com and we will delete the analytics profile and recordings linked to your account.
By request: email tasmirolislam@gmail.com, or use the form at https://tajmirul.github.io/basha-bazar-legal/delete-account. We will confirm your identity and delete your data.
To delete individual items instead, delete the contribution or trail in the app.
You can revoke any permission at any time in Android or iOS settings.
Access is controlled per user at the database level, so one user cannot read or modify another user’s private data. Traffic between the app and our backend is encrypted with HTTPS. Note the photo-URL limitation described in section 4.
No system is perfectly secure, and we cannot guarantee absolute security.
The app is not intended for children. You must be 18 or older to use it. We do not knowingly collect data from children. If you believe a child has provided us data, contact tasmirolislam@gmail.com.
We may update this policy. Material changes will be announced in the app or on the store listing, and the “Last updated” date above will change.