Privacy Policy

Khet Scan: Field Tools (“Khet Scan”, “the App”, “we”, “us”, or “our”) is an independent field-work and information tool for land-revenue work in Uttar Pradesh. It is not affiliated with, endorsed by, sponsored by, or operated by the Government of Uttar Pradesh, the Government of India, NIC, or any other government body. Government portals remain the authoritative source for the records they publish.

This Privacy Policy explains what information the App handles, why, when information leaves your device, how long we keep it, and the choices you have. It applies to the Android App and to the services we operate for it. Use of the App is also governed by our Terms of Use.

1. At a glance

• Most of the App works without an account. Land-record lookups, court-case search, measurement, the GPS camera, document scanning, PDFs, notes and reminders need no sign-in.
• Your field work stays on your phone unless you back it up or share it. Photos, videos, scans, PDFs, GPS measurements, notes, reminders and search history are stored on your device. We upload them only if (a) you subscribe to Khet Scan Pro and turn on Backup (see section 3G), or (b) you are signed in and choose to share an item live (see section 3J). For a share, we upload only the items you share. Guests never upload them.
• Sharing is your choice. When you share an item live, the person you invite, or anyone with the link you send, can see it until the share ends. You can stop a share at any time, but copies already saved or screenshots taken can’t be recalled.
• Two phones with Pro. Khet Scan Pro can keep your work in sync on two phones (section 3G).
• Reading text from your documents. The App reads printed Hindi and English text in your photos, scans and PDFs on your phone, so you can search inside them. If you turn on “Use cloud AI”, you can also ask the App to read a handwritten page, or (with Khet Scan Pro) to draft paragraphs of an inquiry report from your notes, sort files into work files, or ask questions about your documents; only what you send is sent, to Google Cloud (section 3L, section 3M, section 3S).
• Backup copies everything in your workspace, including your portal search history. That can include other people’s personal data, such as landowner names, khasra/khata numbers, court-case parties and the contents of records and documents you saved. It is encrypted in transit and on our servers, with keys managed by us. It is not end-to-end encrypted.
• Government portals are contacted directly from your phone, from your own internet connection. Portal requests do not pass through our servers.
• The survey tools (eKhasra survey auto-fill and AgriStack verification), Khet Scan Pro, Backup, sharing and cloud AI need Google sign-in. For these we keep your email address, your Google account ID, an install identifier, a one-way hash of your eKhasra employee code and a record of each survey action used, so we can run your free trial or season pass.
• We never see your government portal password. You type it into the official portal yourself, and Khet Scan never sends it to us. If you choose to save a portal login in the App (or tick “Remember my password” for the eKhasra portal), it is kept encrypted on your phone only and filled in only after your fingerprint or phone PIN. It is never sent to us, backed up or shared.
• Invite & earn. If you invite friends, or join with someone’s invite link or code, we record who invited whom, how and when, so we can give the friend’s discount and the inviter’s free Pro days (section 3N).
• Partner programme. If you apply on our website to be a partner, we collect your PAN and bank or UPI details to pay your commission and handle TDS. They are stored encrypted and readable only by authorised staff (section 3O).
• Usage statistics. The App can send usage statistics (which screens and tools are used, app and Android version) to PostHog, our analytics provider in the EU, to help us improve it. They never include your files, names, khasra numbers, search text, location or phone number, and we do not keep your IP address. They are part of how the App works and cannot be switched off in the App (section 3P).
• Our website counts visits without cookies. sugamdigital.com records page views and a few steps such as tapping “Get it on Google Play”, using PostHog in the EU. It sets no cookies, stores nothing in your browser and does not keep your IP address (section 3R).
• Your WhatsApp number (optional). After you sign in, the App may ask for your WhatsApp number, so we can help you with your account and payments and send you updates about your pass and Pro. Offers come on WhatsApp only if you tick a separate box. You can skip it, and change or remove it any time in Settings (section 3Q).
• We do not show ads, do not use the Android advertising ID, do not sell personal information, and do not request background location.

2. Information stored on your device

Depending on the features you use, the App may store on your device:

• land-record searches and results, such as district, tehsil, village, khata/khasra/gata numbers, and records returned by a public portal;
• court-case, certificate and application references, and details returned by a portal;
• reminders (title, date, type, linked case or khasra), favourites, saved-report names, notes and report drafts;
• GPS measurement points, areas, perimeters, chosen map points and field-visit notes;
• photos, videos, document scans, QR contents and PDFs you create or import;
• for the survey tools: your village and crop-year selection, survey progress and drafts, the session tokens the government portal issues after you sign in to it, and, only if you tick “Remember my password”, your eKhasra portal username and password (kept in Android’s secure storage);
• text read from your photos, scans and PDFs (section 3L), so search can find words inside them;
• portal logins you chose to save (section 3A), encrypted in Android’s secure storage;
• for officials: applications you track (for example the applicant’s name, mobile number, village and gata), inquiry reports you make, and a halka directory of officials’ names and work phone numbers (section 3M); and
• an app-generated random install identifier, language, app-lock and other settings.

The App’s main local database is encrypted at rest. Sign-in and portal session tokens are kept in Android’s secure, Keystore-backed storage. Other files live in the App’s private storage, which other apps cannot read. App lock can use your device’s PIN or biometrics; the biometric check is done by Android and we never receive your fingerprint or face data.

The install identifier is a random value created by the App. It is not your IMEI, hardware serial number, Android ID, advertising ID or phone number.

If you save a photo or video to your phone’s gallery, or share or export a file to another app, that copy is outside the App. It is not protected by app lock and stays after you uninstall the App.

3. Information that leaves your device

A. Government portals you choose to use

When you look up a record or open an official portal (for example UP Bhulekh, Bhu Naksha, eKhasra, RCCMS/Vaad, eDistrict, eCourts, the High Court, the Farmer Registry, PM-KISAN or AgriStack), the details needed for that request are sent directly from your phone to that portal. Some portals are shown inside the App in a built-in browser, which keeps the cookies and storage the portal needs on your device.

If you sign in, enter an OTP or verification code, or submit information on a government portal, that is between you and the portal. Its own privacy practices apply. We do not operate these portals and we do not receive what you send them.

Saved portal logins. On portals where you sign in with a username and password (for example the RCCMS dashboard used for the eKhasra survey and, where enabled, the eDistrict staff login and the Bhulekh staff login), the App can offer to save your login after you have signed in successfully. It asks first; nothing is saved without your “Save”. A saved login is stored only on your phone, encrypted with a key kept in your phone’s secure hardware (Android Keystore). To fill it in, or to show a saved password, the App asks for your fingerprint or phone PIN. The App fills in only the username and password boxes: you type the portal’s verification code or OTP yourself and press the portal’s Login button. Saved logins are never sent to us, never included in Khet Scan Backup, sync or sharing, and never included in error reports or usage statistics. You can delete one or all of them in Settings → Saved portal logins. Signing out of Khet Scan, removing this phone’s work from the App, or uninstalling the App also deletes them.

eDistrict pending applications (officials). If you sign in to the eDistrict staff portal inside the App, the App can read your pending verification list and the counts in your eDistrict inbox, so it can show them in a list and on the Home screen. This happens on your phone, in your own eDistrict session, over your own internet connection, in the same way as the portal pages you open yourself. The applicants’ details shown in the list (name, father’s name, village, mobile number) are kept in the phone’s memory only while you use the App. They are not saved on the phone, and they are never sent to us. The App never answers, uploads or submits anything on eDistrict for you: you take every action on the portal yourself.

Counts only in our statistics. For these portal features our usage statistics record only that a list was loaded and whether it worked (for example “loaded”, “empty” or “error”), never names, numbers or any portal content.

Saving portal results to a work file. You can attach a portal result (Bhulekh, Vaad/RCMS, eKhasra report, Bhu Naksha plot, eCourts case page) to a work file. The App saves it as a PDF on your phone with its source: the portal name, the page address (without login or session codes), the time it was retrieved and a short description of the search. Reports the App draws from portal data are labelled “App report from portal data — not an official document”. A PDF produced by the portal itself is labelled “<portal> portal’s own PDF (not certified)”. Neither is a certified copy. Attached reports stay on your phone and are uploaded only with Backup or when you share them.

Village map overlay (Bhu Naksha). While measuring, you can show the Bhu Naksha village map under your measurement. The App downloads the village map image directly from the Bhu Naksha portal over your own internet connection (not through our servers) and keeps it in the phone’s cache so it works offline; Android may clear that cache. If you adjust the map’s position, rotation or transparency, those settings are saved only on your phone. The map is approximate and is not a survey (see our Terms, section 9). “Use the village I’m in” compares your location with village maps already saved on your phone; your location is not sent anywhere for this.

B. Google sign-in and the survey tools

Google sign-in is used for the survey tools, Khet Scan Pro, Backup, sharing and cloud AI. The survey tools help a lekhpal fill and lock eKhasra crop-survey entries in bulk, and approve pending AgriStack images, using the lekhpal’s own portal login. When you sign in with Google:

• From Google we keep your email address, your Google account ID and the name on your Google account. The name is shown to people you share with, and to people who share with you (in their list of who has access); it is updated each time you sign in and removed when you delete your account. We do not keep your profile photo, and we do not get access to your Gmail, Drive, contacts or other Google data.
• Session and device: the random install identifier, a per-device session key, the App version, your phone’s manufacturer and Android version.
• Usage records: for each survey entry locked through the App, and each RI approval, the portal’s codes for that plot, village, halka and crop season, plus the village name, census district/tehsil codes and the time. For each AgriStack approval, only a one-way hash and the time. A record of the trial and pass time granted to you.
• Employee code: to tie a survey pass to one lekhpal (and an RI pass’s RI approvals to one RI) and to apply the daily fair-use limit, the App sends a keyed one-way hash of your employee (eHRMS) code with each survey lock and RI approval. We never receive the code itself, and we cannot turn the hash back into it.
• Survey run history: for each bulk run, the number of plots, how many were filled, failed or skipped, how long it took, why it stopped, and your phone’s make, Android version, battery-optimisation and notification settings and App version. We use this to keep long runs working and to help you when a run fails.
• Earlier eKhasra app: if you used our earlier eKhasra app, we copied your email address, Google account ID and a summary of your usage there into Khet Scan, so we can recognise your account and help with any credits left in the old app. Credits from the old app are not converted automatically.

We use these records to run your trial and pass, prevent the same trial being claimed repeatedly, provide support, detect abuse, and understand in aggregate which areas the App is used in. We do not receive your portal password or OTP, your portal session tokens, farmer names, crop details you enter, or survey photos. The survey work itself goes from your phone to the government portal.

C. Diagnostics

• Survey-tool diagnostics: to keep long survey runs working, the App sends us technical events such as run counts and timings, error types, App and Android versions, phone manufacturer, whether battery optimisation and notifications are enabled, and, for app errors, the error message, the screen and a code stack trace. If you tap “Share run report”, the App opens Android’s share sheet with a short text report of that run; nothing is sent unless you choose where to send it.
• Crash reports: the App may send crash reports to Sentry. These are limited to the exception type and code stack trace. Error messages, breadcrumbs, screenshots and session replays are removed before sending, and default personal-data collection is turned off.
• Service logs: our servers record basic request logs (time, address requested, result, response time and, for signed-in requests, the internal account ID). Your IP address is used briefly to rate-limit requests and block abuse. We do not store it in our database.

D. Older optional sync (not Backup)

This section is about an older sync service, separate from Backup (section G). The App includes a sync service for favourites, reminders and saved-report details. It is not currently turned on; if we turn it on, we will update this section and tell you in the App. When it is turned on and used, it sends the random install identifier and the changed records: favourite labels and references; reminder titles, types, due dates, linked case numbers or khasra references and repeat settings; and saved-report types, file names, sizes and labels. File contents, photos, GPS measurements, note contents and search history are never part of sync. Sync requests may be checked by Cloudflare Turnstile to block bots. Please avoid putting Aadhaar numbers, passwords, bank details or other sensitive identifiers in reminder titles or labels.

E. Maps, updates and service providers

The App shows maps with Google Maps Platform, and may use your phone’s built-in geocoding service to show place names. Google may process technical information such as IP address, device and SDK details and map interactions under Google’s own privacy policy. The App checks for compatible updates through Expo’s update service, and fetches configuration (such as which portal features are switched on) from our servers; this request does not include any identifier. The App also downloads a list of Uttar Pradesh villages from our update server about once a month over Wi-Fi; this request does not include any identifier either. Portal status indicators (good / slow / down) are measured on your phone and are not sent to us. PDF tools, including adding a signature, run entirely on your phone; your signature image is saved only on your phone. Our servers, database, Backup storage and logs are hosted by Cloudflare. Document scanning and text reading use Google ML Kit on your device; scanned pages and images are not sent to us for this (section 3L). All production traffic to our services uses HTTPS.

Facebook videos on our website. The Khet Scan page on sugamdigital.com shows cards for videos people have shared on Facebook. Nothing from Facebook loads until you tap one. If you choose to play an embedded Facebook video on our website, Facebook may set cookies and collect data (for example your IP address, your browser details and whether you are signed in to Facebook) under its own privacy policy. We don’t receive any of it.

F. Payments (passes and Khet Scan Pro)

Passes (survey, RI and Ansh passes) are bought through Google Play, which handles the payment; we never receive your card, UPI or bank details. To activate a pass we receive from Google Play and keep the purchase token, the product and plan, the order ID, the purchase and expiry times, and later status changes (for example a refund). With the purchase we send Google Play a one-way hash of our internal account ID, never your email, so a pass can only be activated on the account that bought it. Passes are prepaid and do not renew automatically.

Khet Scan Pro in the App is an auto-renewing Google Play subscription. As for passes, we receive from Google Play and keep the purchase token, the plan, any free-trial offer used, the order ID, the subscription status (for example active, in grace period, on hold, paused, cancelled, expired or refunded) and its expiry time, and we check the status with Google Play when it changes and once a day. We never receive your payment details. Khet Scan Pro bought on our website is a one-time Razorpay payment for 30 or 365 days, handled like a website pass above.

You can also buy a pass on our website. You sign in there with Google (we receive your email address and Google account ID, as in the App), and the payment is processed by Razorpay. We never receive your card or bank account details. We keep the Razorpay order and payment IDs, the plan, the amount, the payment and refund status and their times, linked to your account. From the payment record Razorpay sends us, we also keep a one-way keyed hash (not the readable value) of the payer’s email address, mobile number and UPI ID, if present. We use these hashes only to check that an invite reward (section 3N) or a partner commission (section 3O) is not paid for by the inviter or partner themselves. Razorpay processes your payment details under its own privacy policy and emails you a receipt. Refunds follow our refund and cancellation policy.

G. Backup (Khet Scan Pro)

Backup is part of Khet Scan Pro. It is off until you subscribe and turn it on in Settings → Backup, where the App asks you to confirm before anything is uploaded. When it is on, the App copies your workspace to your Khet Scan account so you can restore it on a new phone:

• Files: GPS-camera photos and videos, document scans, PDFs, files you shared into the App’s Inbox, map exports and reports. Photos are uploaded as a high-quality compressed copy (and, if you choose “originals on Wi-Fi”, also the untouched original). Videos are uploaded as a 720p copy, including their sound. We also keep a small preview image of photos, videos and PDFs.
• Location inside your files and records: photos keep their location data (GPS coordinates, time and the address on the stamp), and measurements keep their GPS points. Backup does not track your location; it uploads the locations already saved in your work.
• Work records: work files (name, village, plot, khata, case reference, notes), notes and report drafts, diary entries, reminders, measurements, field visits, favourites, saved-report details and captions.
• Portal search history, always included with Backup: Bhulekh, khasra/owner-name, fasli-year and Vaad/RCMS searches, with the district, tehsil, village, khata/khasra/gata numbers, owner names you searched, the result you chose, and court-case details such as case numbers, parties (petitioner and respondent), dates and status.
• Document chats and voice notes: your saved document chats (questions, answers and which file and page each answer cites) and the recordings of your voice notes (section 3S).
• Text read from your files: the text the App read from a backed-up file (on your phone, by cloud AI or as you edited it) is backed up with that file, so search works after a restore (section 3L).
• Technical details: which phones use your backup (up to two; the random install identifier and the phone name already linked to your sign-in), file sizes and checksums, and backup times.

Other people’s data. Your backup can contain personal data of other people, such as landowners, applicants and parties to cases, taken from public land and court records or entered by you. We store and process it only to keep and restore your backup for you. We do not look at backup contents, search them, use them for analytics or advertising, or share them. Our support and admin tools show only counts and sizes, never file names or contents.

What is not backed up: anything while you are a guest or a free user, work files you mark “only this phone”, the App lock, survey state and settings. Files you keep only on your phone are never uploaded.

Security: backup data is sent only over HTTPS with signed requests, and stored encrypted at rest on Cloudflare’s servers in a private storage area that is not publicly reachable. The encryption keys are managed by us and our hosting provider, so this is not end-to-end encryption: our systems can technically read the data to provide the service.

Storage and devices: each Pro account has 25 GB and can use Backup on two phones at once; both stay in sync. Settings → Backup → Phones lists the phones signed in to your account (the phone name and when it was last used). Adding a third phone asks you to remove one: the removed phone keeps everything on it, its copy becomes view-only, and changes on it that were not backed up yet are kept as separate copies when it is added back. Replacing a phone counts as a move, limited to about three in 30 days without contacting support.

When both phones change the same thing: for notes, both versions are kept; the other one is saved as “<title> (conflict copy, <phone name>)”. For other items the later change is kept and the other version is listed under Settings → Backup → Sync conflicts, where you can use it instead. A deletion on one phone wins over an older edit on the other; the edited version goes to Recently deleted.

Recently deleted: items deleted on either phone are kept for 30 days in Recently deleted, on the phone and in your Backup, and can be restored. After 30 days they are removed.

When Pro ends: your backup becomes read-only for 30 days, so you can still restore or download it. After that the cloud copy is deleted. If Google Play puts your subscription on hold or pauses it, the backup is read-only but the 30 days start only when the subscription actually expires. Renewing before the deadline cancels the deletion. Files on your phone are never touched.

H. Emails from us

We use your Google account email address to send a few service emails about your account: when Khet Scan Pro has ended and your backup is read-only, reminders 7 days and 1 day before the cloud copy is deleted, when it has been deleted, when your account has been deleted, and when a friend you invited has made their first payment and free Pro days were added to your account (section 3N). These emails are in Hindi and English, contain no tracking or images, and are sent through Cloudflare. Every email has a one-click link to stop them; stopping them does not change when your backup is deleted. We do not send marketing emails. We keep a record of which email was sent and when, but not the email itself. When you delete your account, your address is kept only until the “account deleted” email is sent, and for 14 days at most.

I. Free daily limits

Some free tools have a daily limit. To apply it, the App counts on your phone how many times you used each limited tool today. If you are signed in and not on Pro, the App sends us these daily counts (for example “4 Bhulekh reports today”), so the limit cannot be reset by reinstalling the App. For every signed-in user it also sends a few daily service counters, such as how often the short free-limit break was shown or finished, taps on “Go Pro”, a completed restore to a new phone, or reaching the Pro fair-use level, so we can see in aggregate how these features work. Only numbers are sent, linked to your account and the date, never what you looked up. The App also counts how many pages it read text from each day (a number only). Guests’ counts stay on the phone. The counts are deleted with your account.

J. Live sharing

If you are signed in with Google, you can share a file, a case/job file (work file), a note or a measurement “live” instead of sending a copy. “Send a copy” works as before: it opens Android’s share sheet, and nothing goes through our servers.

What is uploaded. To share live, the App uploads the items you chose to your Khet Scan account: the files (for photos, a high-quality compressed copy and a small preview, with the location and date saved in the photo; for videos, a 720p copy with sound; documents as they are), and the details of the shared notes, work files and measurements (including measurement GPS points). A work file shared “including future items” also uploads items you add to it later, while the share is active.

• Khet Scan Pro: shared items come from your Backup (section 3G). They stay in your Backup after the share ends.
• Free accounts: you can have up to 3 active shares using up to 50 MB in total. These uploads exist only for the share. They are not a backup: when a share ends (you stop it, it expires, or the item is deleted), its uploaded content is deleted from our servers, normally within a day.
• Your portal search history and the text read from your files are never uploaded for sharing.

Who can see a share.

• A person you invite with a one-time invite link or their exact Google email. They see the item in Khet Scan under “Shared with me” after they sign in and accept. Before accepting, they see your Google profile name and a partly hidden email address (for example sh•••@gmail.com), so they can check who sent it.
• Anyone with the link. A public link opens in any web browser at s.sugamdigital.com, with no app or sign-in. Anyone who has the link can open it, so send it only to people you trust. You can add a 4-digit PIN; send the PIN separately. Too many wrong PINs lock the link.
• Every share, a public link or an invite, lasts 7 days unless you choose otherwise. With Khet Scan Pro you can choose 1 day, 30 days or “until I stop”. Free shares always last 7 days.
• People you share with can’t share your item onward.

Downloads and copies. You decide for each share whether recipients may download (on by default). If downloads are allowed, a recipient can tap “Save to my files” to make their own copy, labelled as a copy from you. That copy belongs to them: it stays on their phone (and, if they have Khet Scan Pro, in their own Backup) even after you stop the share, and we cannot remove it. Screenshots and copies already saved can’t be blocked or recalled, whatever you choose. With downloads off, a photo shown on the web viewer can still be saved by the person viewing it.

Photo location and date. Shared photos keep the location and date details saved in them. Anyone who can view a shared photo (the person you invite, or anyone with a public link) can see these details, even if downloads are off. The App says this on the “Check before sharing” screen when a share includes photos, and the web viewer says it on pages that show photos.

Recipient offline copy. So a shared item opens without internet, the recipient’s App keeps a temporary copy. It is re-checked whenever they are online, deleted when the share is stopped or expires, and deleted after 7 days without a successful check. So if the recipient stays offline, the item may stay visible on their phone for up to 7 days after you stop the share. This temporary copy is not the same as “Save to my files”.

What you see as the owner. For each share: the Google profile name of the person who accepted it (once they accept), and for an email invite the partly hidden email address you typed; the email address of someone who accepted a one-time invite link is never shown to you. You also see how many times it was opened and when it was last opened. For public links we count views but do not record who viewed them.

Other people’s data. Land records, case papers and photos often contain personal data of other people (landowners, applicants, parties to cases). When you share them, you decide who receives that data, and you are responsible for sharing it lawfully and only with people who need it for the work (see our Terms, section 7A). We store shared items only to deliver the share. We do not look at, search or use their contents for analytics or advertising. Our support and admin tools show only counts and states, never file names or contents.

When a share ends. You can stop a share, remove a person or get a new link (the old link stops working) at any time. Access ends at the recipient’s next request. A share also ends when it expires, when you delete the shared item, or when you delete your account. If Khet Scan Pro ends, your shares keep working during the 30-day read-only period, but you can’t create more than the free allowance. When the backup is then deleted, only your 3 newest shares within 50 MB continue; the others end, and recipients see “This share has ended”.

Security. Shared content is sent only over HTTPS and stored encrypted at rest on Cloudflare, with keys managed by us and our hosting provider. This is not end-to-end encryption. Links and invites are long random codes; we store only a one-way hash of them. For an email invite we store a one-way hash of the address plus a partly hidden form (for example sh•••@gmail.com) so you can see whom you invited.

K. The share web viewer (s.sugamdigital.com)

Public links and invite links open at s.sugamdigital.com, run by us on Cloudflare. The page shows the sender’s first name, the item title and the shared content. It loads nothing from other companies: no analytics, ads, fonts, maps or trackers, and no cookies except a short-lived PIN cookie (12 hours) when a link has a PIN. Pages are marked so search engines don’t index them and browsers don’t pass the link on to other sites. Original full-size photos are never served on the web; the copies shown keep the photo’s location and date details, and pages with photos say so. Every page has a “Report this link” option, which opens an email to us naming only the page type and the share’s reference number, never the link itself or its PIN.

Visitors’ IP addresses are used briefly for rate limiting. Our own log entries never record link or invite codes or PINs. Our hosting provider’s standard request logs, which only we can see, include the page address and are kept for its retention period; we don’t link them to an account.

Invite links (s.sugamdigital.com/i/…) open the Khet Scan App directly when it is installed.

L. Text reading (OCR) and cloud AI

On your phone. The App reads printed Hindi and English text in the photos, scans, images and PDFs in your library, so that search can find words inside them. This uses Google’s ML Kit text recognition, which runs on your phone; the recognition models are downloaded once through Google Play services. Your images are not sent anywhere for this. For PDFs that already contain English text, the App can use that text instead. The text is saved in the App’s encrypted storage on your phone. It runs while the App is open and idle and in short background windows, and pauses on battery saver or low battery. It is free and has no daily limit.

With Khet Scan Pro Backup. If Backup is on, the text read from a backed-up file is backed up with that file, so search works after you restore to a new phone. Text of files in a work file you keep only on this phone is never uploaded, and people you share a file with never receive its text. It is stored like your other backed-up files: encrypted in transit and at rest, with keys managed by us.

Cloud AI (handwriting). Printed text is read on your phone, but handwriting needs cloud AI. If you are signed in, you can turn on “Use cloud AI” in Settings → Cloud AI. Nothing is sent until you do, and even then only when you tap “Read handwriting (AI)” on a page:

• The App sends an image of that page only (reduced to at most 2048 pixels) to our server, which passes it to Gemini on Google Cloud (Vertex AI). Google acts as our service provider.
• It is processed by Google Cloud, which may be outside India (Google chooses the location).
• Google does not use it to train its AI models.
• We do not store the AI request. Our servers keep neither the page image nor the text of the request or the answer; with Backup on, only the resulting text is stored with your files (see above). For each AI read we keep a record that it happened: your account, the time, your plan, the model and region used, the size of the request (token counts), the estimated cost, and whether it worked. We use this to count your monthly AI actions, to limit costs and to find faults.
• The text that comes back is saved with the file on your phone (and, with Backup on, backed up with your files). It is marked “AI-read text — check before use”, and you can edit it.
• Pages from a work file you keep only on this phone are never sent to cloud AI.
• You can turn “Use cloud AI” off at any time. That stops new reads; text already read stays with your files until you delete them.

M. Officials’ work tools: applications, inquiry reports and halka directory

Application tracker. You can record applications you have received for report (for example varasat, ansh correction and name correction applications from the RCCMS dashboard) with a due date, and the App can remind you before the due date (and, if you choose, every day after it until you mark the application done). You can add the applicant’s name, mobile number, village and gata, and the reminders on your phone show them. An application is stored like any other work file on your phone: it is backed up only if you have Khet Scan Pro with Backup turned on (section 3G), and others see it only if you share it (section 3J).

Pending applications from your RCCMS dashboard (lekhpals). If you are signed in to the RCCMS dashboard inside the App, you can tap “Get my pending applications”. The App then reads, on your phone, in your own RCCMS session and over your own internet connection, the pending varasat, name correction and share correction applications of each of your halkas, and the dashboard’s pending counts. It only views pages: it never fills, forwards, approves, records attendance or submits anything on RCCMS or Bhulekh. You review the list and choose which applications to add; only those you add are saved, as work files on your phone (applicant’s name, mobile number, village, khata, gata, application number and date), backed up only if you have Khet Scan Pro with Backup turned on. Nothing from the dashboard is sent to us, the App never reads Aadhaar numbers, and halka codes and portal sign-in details are never stored. The counts on the Home screen are kept in the phone’s memory only while you use the App. Our usage statistics record only whether a read worked.

Inquiry reports (जांच आख्या). Officials can make an inquiry report for an eDistrict application (caste, income, domicile and others) from a form in the App. The App makes the PDF on your phone and saves it, with the details you entered, in that application’s work file, so you can reopen and change it; each save is a new version. Like any work file, it is backed up only if you have Khet Scan Pro with Backup turned on, and others see it only if you share it; you can mark the work file “only on this phone”. On Android 10 and later a copy of the PDF is also saved in your phone’s Downloads/Khet Scan folder, so you can pick it in the portal’s upload box. When you open eDistrict from the report, you choose, type, attach and submit everything on the portal yourself: the App never fills in, uploads or submits the verification form. If you pick earlier certificates from an eDistrict search, only the ones you pick are printed in the report.

AI report drafts (Khet Scan Pro). If you have turned on “Use cloud AI” (Settings → Cloud AI) and tap “Draft with AI” on an inquiry report, the App sends to our server, which passes it to Gemini on Google Cloud (Vertex AI): the details in the report form (for example the application number, the applicant’s and father’s or husband’s name, the village and your inquiry details), the notes you type for the AI, and the text of up to three files you choose from that application’s work file. It is sent only when you tap “Draft now”, and never for a work file you keep only on this phone. The AI writes the chosen paragraphs in Hindi from that material only; where something is missing it leaves […] for you to fill, and the finding stays yours. The draft replaces the chosen paragraphs in the form (you can undo it) and is marked “AI draft — check before use”; the saved report remembers which paragraphs came from the AI and whether you changed them. The same terms as for handwriting reads apply (section 3L): Google acts as our service provider, may process the request outside India and does not use it to train its models; we do not store the request or the answer, and we keep only a record that a draft happened (account, time, plan, model, size, estimated cost, success) to count your monthly AI actions.

Halka directory. Officials can keep a directory of which lekhpal and revenue inspector covers which village, with their phone numbers, by importing their tehsil’s official list (a PDF) or typing it in. The list is read on your phone (its text, or on-device text reading for scanned pages); it is not sent to us or to any AI service. The directory is stored in the App’s encrypted database on your phone. If you have Khet Scan Pro with Backup turned on, it is backed up with your other work (section 3G); it is never shared through links. Call and WhatsApp buttons open your phone’s dialer or WhatsApp with the number; the App does not place the call or send a message itself. The directory holds officials’ work phone numbers: use it only for official work.

Home screen widget. The “Today’s work” widget shows counts only (for example reminders due, files waiting in the Inbox, applications due this week). It never shows names, khasra numbers or other details, because other apps on a phone can sometimes read widget images.

N. Invite & earn (referrals)

Signed-in users can invite others to Khet Scan from Settings → Invite & earn. A friend who joins with your invite gets a discount on their first purchase, and when they make their first payment you get free days of Khet Scan Pro (see our Terms, section 5C). To run this we handle the following:

• Your invite code. The first time you open Invite & earn we create a random 6-character code for your account. It is not made from your name, email, phone number or employee code. We keep the code, the date it was created and, if it stops working (for example when you delete your account), the date it stopped.
• The code in your links. Your invite link (s.sugamdigital.com/app?r=<code>) carries your code. While Invite & earn is on for your account, the same link with your code is added to the install line in captions of files you send from the App, and the “Get the app” link on the web pages of your live shares (section 3K) uses it too. So anyone who receives that file or opens that share can see your code. The link only opens Khet Scan on Google Play. We don’t record who follows it (our hosting provider’s standard request logs, described in section 3K, include the link).
• Google Play install referrer. When the App starts for the first time after it is installed, it asks Google Play once for the “install referrer”, the short text Google Play passes on from the link the App was installed from. The App keeps only an invite code found in it, on your phone, and discards the rest. Nothing is sent to us unless the App was installed from an invite link and you then sign in with Google: the code is sent with your first sign-in and the phone’s copy is cleared.
• Who invited whom. When a new account signs in with an invite code, or types one later in Settings → Invite & earn → Have a code? (or in the code field of the survey sign-in), we keep a record linking the new account to the inviter’s account: the code used, how it arrived (install link, typed code, or the sign-in code field) and the time. We also keep the code exactly as it was sent at sign-up with the new account. Each account can have only one inviter: the first code recorded counts.
• Rewards. When an invited account makes its first payment (a pass or Khet Scan Pro, through Google Play or our website), we record a reward for the inviter: which payment it is tied to (an internal order reference), when it was paid, when the reward can be added (after a 7-day hold), its state (waiting, added, cancelled, or not added because of the yearly limit), how many Pro days it gives and the rules version that applied. An added reward appears as a Pro grant on the inviter’s account. To check a payment and whether it was refunded, we use the purchase records described in section 3F; we never receive payment details. If the payment looks like it came from the inviter (for example a matching hashed payer email, mobile number or UPI ID on a website order, or a Google Play purchase linked to the inviter’s own), the reward waits for a manual review instead of being added.
• The friend discount. To show an invited account the discounted Pro offer or member pass price, the App asks our server whether the account is still eligible (invited, no payment yet, within 30 days of sign-up). If a discounted Google Play Pro offer is bought by an account that was not eligible, the purchase is honoured and we keep a note of it (order reference and reason) for review.
• What each side sees. In Invite & earn, the inviter sees only counts: how many people joined with their code, how many paid, rewards waiting and Pro days earned. When a reward is added, the inviter gets an in-app message and an email (section 3H) that names the friend by their first name from their Google account. A friend who types a code is shown the inviter’s first name. Nobody is shown the other person’s email address, and we never show what anyone bought.

Why. We use these records only to run Invite & earn: to give the friend’s discount, add the inviter’s Pro days, apply the 7-day hold and the yearly limit, prevent self-invites, duplicate accounts and other abuse, answer support questions, and count in aggregate how many people join through invites. We do not sell them or use them for advertising. Our admin tools let our support staff see who invited whom and the reward states, so we can answer questions and investigate abuse.

How long. The records are kept while the accounts exist. When you delete your account your code stops working, and the records of who invited whom and of rewards are kept linked only to random internal IDs, no longer to your email or Google account, for as long as needed to stop the same person earning or receiving a reward twice, and for accounting and disputes (section 7).

O. Partner programme (website)

People who apply to our partner programme on sugamdigital.com/partner (“partners”) earn a commission when customers they introduce pay for Khet Scan (see our Terms, section 5D). The App never asks for any of the details below; they are collected only from partners, on our website.

What we collect from partners.

• From Google sign-in: your email address and Google account ID. If you also have a Khet Scan account with the same Google account, we link the two so your own purchases can’t earn you commission.
• From the application form: your name, mobile number, PAN, and your payout details: either a UPI ID, or a bank account number, IFSC and account holder name; your answer to “Are you a serving government employee?”, your post if you give it, and the time you confirmed that your service conduct rules allow you to take part; how you plan to introduce Khet Scan, if you tell us; and that you accepted the terms.
• Records we create: your application status and its dates (applied, approved, not approved, suspended), who in our team made each decision and why; your partner code; the commission terms that apply to you and their history; the record of our conduct-rule check for serving officials (who, when and a note); when your payout details were last changed and who verified them, and when; each commission (the product and plan, payment date, price, GST, fee, net amount, rate, amount, its state and the hold date); each payout (amounts, TDS, payout reference, payment date and the bank reference number, UTR); and your TDS totals for each financial year.
• Keyed hashes: a one-way keyed hash of your PAN, so we can total TDS by PAN and stop one PAN joining twice, and one-way keyed hashes of your email address, mobile number and UPI ID, which we compare with the hashed payer details of website orders (section 3F) to spot commissions paid for by the partner themselves.

How these details are protected. Your PAN, mobile number, UPI ID, bank account number, IFSC and account holder name are stored encrypted, field by field, with a key held only as a secret on our server; the copies kept with each monthly payout are encrypted the same way. Your name and email address are stored readable so our team can find your record. The encrypted details can be read only by authorised staff in our admin tool, which sits behind an additional sign-in, and only when needed (to verify your details, make a payout or prepare TDS returns). Every such view and every export of payout or TDS details is logged with the staff member’s name. This is encryption on our servers with keys managed by us, not end-to-end encryption: we can decrypt these details because we need them to pay you. Your own statement page shows your payout details only partly (for example the last 4 digits of an account number).

Why. To review your application; to issue your code and link customers to it; to calculate, hold and pay your commission by UPI or bank transfer; to deduct TDS under section 194H, file TDS returns against your PAN and issue Form 16A; for our accounts and audits; to check serving officials’ conduct-rule position before paying them; to prevent fraud, self-referral and duplicate partner accounts; and to answer your questions. We do not use these details for advertising and never sell them.

Who we share them with. The Income Tax Department (your PAN, name, amounts credited and TDS, in our TDS returns); our bank or UPI provider, which receives the payee details and amount of each transfer we make to you; our accountant or tax adviser, who prepares the TDS returns for us; Cloudflare, which hosts our servers and database (section 6); and authorities where the law requires it. Nothing is sold.

Customers who use a partner code. When a customer enters a partner code in the App, we record the link between their account and the partner (the code, how and when it was entered and when the attribution window ends), in the same way as an invite (section 3N), and the customer is shown the partner’s first name. For each payment that earns a commission we keep the internal order reference, the customer’s internal account ID and the amounts listed above. The partner sees only aggregate information: how many customers are linked to their code and how many have paid, earnings by month, and a list of their commissions showing the date, product and amount, never the customer’s name, email address, phone number or account.

How long. We keep your partner record while you are a partner. Payment, commission, TDS and tax records (including your name, PAN and the payout and UTR records) are kept for at least 8 years after the end of the financial year they relate to, or longer where tax law or a dispute requires it. When you leave the programme, you can ask us to delete your other details, such as your mobile number, payout details and how you planned to introduce Khet Scan; we do so once nothing is left to pay or settle. Deleting your Khet Scan account in the App does not close your partner account: to close it, email us from the Google account you applied with.

P. Usage statistics (analytics)

To learn which parts of the App are used, where people get stuck and whether a new version works better, the App can send usage statistics to PostHog (PostHog Inc.), which stores them for us in its EU cloud (Frankfurt, Germany). The App sends them directly to PostHog over HTTPS, in small batches; if you are offline, they wait on your phone (at most 500 events) and are sent later.

What is sent. Only events from a fixed list built into the App, each with a few fixed-choice values or numbers:

• the App was opened; which screen was shown, as the screen’s name in the App’s code (for example “/bhulekh/[id]”, never what is on it); which tool was opened or added to the Home shortcuts;
• that a portal lookup was made and whether it found results, failed or found nothing (which portal, never what you searched for or the results);
• that a photo, scan, PDF or other file was saved, a report was made, files were sent with Android’s share function (how many, and whether WhatsApp was used), a live share was created, a reminder was added (its type), and how many AI-drafted paragraphs were kept or edited (counts only);
• sign-in and sign-out (method only), the Pro or season-pass screen being viewed, and a Google Play purchase being started, completed or failing (product, plan and a reason such as “cancelled”, never prices, order numbers or payment details); whether an App update was installed;
• your answers to short questions the App sometimes asks: a rating from 0 to 10 and one choice from a fixed list of what we should work on next. There is no box to type in. Answers are sent with the other usage statistics;
• with each event: the App version and update, your Android version, your phone’s language setting and the App’s language, and whether you are signed in, have Khet Scan Pro or a season pass.

What is never sent. Your name, email address, phone number or employee code; khasra, khata, village or case numbers; anything you type or search for; file names or contents, photos or documents; GPS or any other location; your contacts; or the Android advertising ID. The App does not record your screen or sessions and does not collect taps automatically.

How you are identified. If you are not signed in, statistics carry a random number created by the App for this purpose only (a new one is made when you sign out). If you are signed in, they carry a one-way keyed hash of your internal account ID, not the ID itself and not your email address; when you sign in, the statistics from before sign-in on that phone are linked to it, so we can see, for example, how many people sign in after first trying the App.

Purchase records from our server. If you are signed in, our server also records, under the same keyed hash, when a season pass or Khet Scan Pro is bought, renewed, cancelled, expires or is refunded (product, plan, price, whether it is your first purchase and whether it was made through Google Play or our website), and whether a referral reward you earned is held, given or cancelled. It never sends order numbers, payment or UPI details, and it sends these only after your phone has told it that usage statistics are on: turning off Settings → Share usage statistics stops them too.

Cloud AI usage records. When you use a cloud AI feature (section 3L, section 3M), our server also sends PostHog, under the same keyed hash, a record of the request: which AI feature was used, the model, the number of tokens in and out, how long it took and whether it failed (with the error type). It never includes the page image, the document, your notes, the request or the AI’s answer. These records are sent only for accounts whose phone runs an App version that sends usage statistics.

Billing records for analysis. To understand sales, renewals and refunds, we copy our billing records to PostHog: the product, plan, amounts, dates and status of each season pass, Khet Scan Pro purchase or refund. They carry the same keyed hash of your account ID and never your name, email address, phone number or payment, card, bank or UPI details. For accounts whose phone has not sent usage statistics (for example an older App version), the rows are copied without the keyed hash, so they cannot be linked to you or to your other statistics.

IP address. Like any internet service, PostHog receives your phone’s IP address when the statistics are sent. The App asks PostHog not to record it, and our PostHog project is set to discard client IP data, so it is not stored and is not used to work out your location.

No off switch. Usage statistics are part of how the App works: App versions that send them do so whenever the App is used, and there is no setting to turn them off (earlier versions had one; a choice made there no longer applies). They never include the content listed above. You can ask us to delete the statistics linked to your account (section 11).

Why and how long. We use usage statistics only in aggregate, to improve the App and decide what to build or fix; never for advertising, and we do not sell them. PostHog processes them on our behalf under its data processing agreement and does not use them for its own purposes. They are kept for PostHog’s standard retention period for our plan, and you can ask us to delete the statistics linked to your account (section 11).

Q. Your WhatsApp number (optional)

After you sign in with Google, the App asks once whether you want to add your WhatsApp number. It is optional: you can skip it, and nothing in the App depends on it. You can also add it later in Settings → WhatsApp number. We check only that it looks like an Indian mobile number; we do not send a code to verify it.

• What we use it for. To help you when you contact us about your account or payments, and to send you service updates on WhatsApp, such as your season pass or Khet Scan Pro ending or renewing, and new features or a new survey season.
• Offers only if you say yes. We send offers and promotions on WhatsApp only if you tick “Also send me offers on WhatsApp”. This box is separate and starts unticked. We record whether it is ticked and when you last changed it, as a record of your consent.
• Where it is kept. With your account on our servers (hosted by Cloudflare), with the date you last changed it. Our staff use it only for the purposes above.
• Never shared or sold. We do not share or sell your number, and it is never sent with usage statistics (section 3P) or to any analytics or advertising service. Messages to you are sent through WhatsApp, which handles them under its own privacy policy.
• Your choice, any time. In Settings → WhatsApp number you can change the number, untick offers (we stop sending offers), or remove the number (we stop all WhatsApp messages and delete it from your account). You can also ask us by email at contact@sugamdigital.com or WhatsApp us at the number below.
• Deletion. The number and your offers choice are deleted when you remove the number or delete your account (section 7).

R. Website statistics (sugamdigital.com)

To count visits to our website and see which pages help people, sugamdigital.com uses PostHog in cookieless mode, stored in PostHog’s EU cloud (Frankfurt, Germany). The script is served from our own website and sends the data through our website (hosted by Cloudflare), which passes it straight on to PostHog without logging or storing it.

• What is recorded. Each page view and when you leave a page; tapping a Google Play link (which page it was on); on the buy page, that a payment window was opened and that a payment went through (the plan and product only); and on the partner page, that an application was sent. With these, the page address without anything after “?” or “#”, the referring website, and your browser, device type, screen size, language and time zone.
• What is never recorded. Your name, email address, phone number, PAN, UPI ID or bank details, anything you type into a form, order or payment IDs, promo codes, or what you click apart from the steps above. Visitors are never identified or linked to a Khet Scan account. There is no session recording and no heatmaps.
• No cookies. The website sets no analytics cookies and stores no identifier in your browser (no local or session storage), so there is no cookie banner. To count unique visitors, PostHog works out on its servers a one-way hash of your IP address and browser details with a secret that changes every day; it cannot be reversed, and the same visitor is not recognised on another day.
• IP address. PostHog receives your IP address when the page sends data. Our project is set to discard client IP data, so it is not stored and is not used to work out your location.
• Why and how long. Only to understand, in aggregate, how the website is used and improve it; never for advertising, and we do not sell it. It is kept for PostHog’s standard retention period for our plan.

Google sign-in, Razorpay (on the buy page) and Facebook videos you choose to play (section 3E) are run by those companies under their own policies.

S. AI organiser, document chat and voice notes

The AI organiser and document chat are cloud AI features: they work only if you are signed in and have turned on “Use cloud AI” (Settings → Cloud AI), and only when you tap them. “Use cloud AI” is one choice for your whole account: turning it on (from any of these features, or in Settings → Cloud AI) turns it on for handwriting reads, report drafts, the AI organiser and document chat, on every phone you sign in on, and turning it off stops all of them. Each run counts towards your monthly AI actions. The same terms as for handwriting reads apply (section 3L): the App sends the request to our server, which passes it to Gemini on Google Cloud (Vertex AI); Google acts as our service provider, may process it outside India and does not use it to train its models; our servers do not store the request or the answer, and we keep only a record that it happened (account, time, plan, model, size, estimated cost, success). Files in a work file you keep only on this phone are never sent.

• AI organiser. When you select files and tap “Organise with AI”, the App sends, for up to 50 files: the file name, the date it was saved, its type and where it came from, and the text already read from its first page (at most 2,000 characters), plus the names of your work files. The AI suggests a work file, a title and tags for each file. Nothing changes until you review the suggestions and tap Apply; applying them is done on your phone.
• Document chat (“Ask AI”). When you ask a question, the App searches the text of your files on your phone and sends only the question, the best-matching excerpts (at most 8 pages and 6,000 characters), the names of those files and of the work file you asked about, and up to your last 6 questions and answers in that chat, so follow-up questions make sense. If nothing matches, nothing is sent. The answer cites the file and page it came from. Your chats are kept on your phone, and in your Backup if you have Khet Scan Pro with Backup on (section 3G); they are never shared.
• Ask AI over your records. When this is on for your account, document chat also searches your records on your phone — notes and report drafts, Khatauni and eKhasra search history (what you searched, not the result), saved court cases, reminders, measurements and work files — and the best-matching ones are sent in the same way as file excerpts (together at most 8 pages or records). Records can contain people’s names. Records in a work file you keep only on this phone are never sent. The App shows a one-time notice about this before your first question, even if you had already turned on cloud AI.
• Cloud search index (Khet Scan Pro with Backup). With Pro and “Use cloud AI” on, the App can answer questions from all your backed-up files and records, not just those on this phone. For this we build a search index from the text already in your Backup (the text read from your files, and your backed-up records listed above): the text is split into short passages, which are stored with a numeric representation of their meaning (an “embedding”) in Cloudflare Vectorize, kept separately for each account. The embeddings are made by Cloudflare Workers AI, inside Cloudflare; this text is not sent to Google to build the index. When you ask a question, the matching passages (and the first pages of files whose names match your question) are sent with it to Gemini as described above. Files and records you keep only on a phone are not indexed. The index entries for a file or record are deleted when it is deleted, and the whole index is deleted when you turn off “Use cloud AI”, when you turn Backup off, when you delete your account, and with your Backup 30 days after Pro ends. If you turn cloud AI on again, the index is rebuilt from your Backup.
• Voice notes. If you record a voice note, your phone’s own speech recognition turns it into text. When the language is downloaded on your phone for offline use, this happens on the phone. Otherwise your phone’s speech service, a system service of your phone (usually Google’s), may send the audio to Google over the internet and process it under Google’s own terms; Khet Scan never receives your voice for recognition and does not send it to Google or anyone else itself. On Android 13 and newer the recording is kept with the note on your phone and, if you use Pro Backup, in your backup; on Android 12 and older only the text is kept, with no recording. Deleting a note does not delete its recordings: they stay in Files until you delete them there or from the note.

4. Permissions

The App asks for permissions only when you use the related feature:

You can deny or revoke permissions in Android Settings. Features that depend on them may then not work.

5. How we use information

• to provide the App’s features, including the survey tools, free trial, season passes, Khet Scan Pro, Backup, live sharing and cloud AI reads;
• to apply free daily limits and send the service emails described in section 3H;
• to run Invite & earn (section 3N): record who invited whom, give the friend’s discount and the inviter’s Pro days, and prevent abuse;
• to run the partner programme (section 3O): review applications, pay commission, deduct and file TDS, and prevent fraud;
• to keep your local work and settings on your device;
• to secure our services, prevent fraud and repeated trial claims, fix errors and keep the App compatible with government portals;
• to understand, in aggregate, where and how the survey tools are used, so we can improve them;
• to understand, in aggregate, how the App is used through usage statistics (section 3P);
• if you give your WhatsApp number (section 3Q): to help you with your account and payments and send service updates on WhatsApp, and to send offers only if you ticked the separate offers box; and
• to answer support, privacy and deletion requests.

We do not sell personal information, do not use it for targeted advertising, and do not make automated decisions that have legal or similar effects on you.

6. Sharing

We share information only:

• with the government portal you choose to use (sent directly from your phone);
• with service providers who run the App’s services for us: Cloudflare (hosting, database, Backup storage, the cloud search index and its embeddings, logs, email delivery, Turnstile), Google (sign-in, Maps, ML Kit, Google Play), Expo (app updates), Sentry (crash reports), PostHog (App usage statistics and website statistics, stored in the EU; sections 3P and 3R), Google Play (payments for season passes and Khet Scan Pro in the App) and Razorpay (payments for season passes and Khet Scan Pro on our website). They may process information only to provide their services;
• only for pages you ask cloud AI to read (section 3L), inquiry-report drafts you ask for (section 3M), and files you ask the AI organiser to sort or questions you ask about your documents and records (section 3S), with Google Cloud (Vertex AI), which processes them for us and does not use them to train its models;
• with the people you choose when you share an item live, or with anyone who has a public link you created (section 3J). They see your Google profile name and a partly hidden email address;
• within Invite & earn, only a first name: the inviter sees the first name of a friend whose payment earned them a reward, and a friend who types a code sees the inviter’s first name (section 3N);
• for partners only (section 3O): with the Income Tax Department for TDS, with our bank or UPI provider to make the transfer, and with our accountant or tax adviser for TDS returns;
• with the app or person you pick when you use Android’s share function; and
• when required by law or valid legal process, or to protect users, the public or our services from fraud, abuse or security threats.

7. Retention and deletion

On your device

Local data stays until you delete it in the App, clear the App’s storage, or uninstall the App. The App does not use Android backup, so uninstalling normally removes its local data. Copies you saved to the gallery or shared elsewhere are not removed.

• Saved portal logins stay on your phone until you delete them in Settings → Saved portal logins, sign out of Khet Scan, remove this phone’s work from the App, or uninstall the App.
• eDistrict pending lists and the RCCMS dashboard counts are not stored: they are gone when the App is closed.
• The halka directory stays on your phone until you delete it, remove this phone’s work from the App, or uninstall the App.

Your account

We keep your account while it is active. You can delete it at any time (see below). When you do:

• your email address and Google account ID are removed, and all device sessions are ended;
• your survey run history, your employee-code hash bindings, your daily usage counts and any record copied from our earlier eKhasra app are deleted;
• your Backup is deleted: the backed-up records are removed at once and the backed-up files within about a day. Deleting your account does not cancel a Google Play subscription; cancel Khet Scan Pro in Google Play first;
• any unused trial or pass time is forfeited. Deleting your account does not refund a Google Play purchase; refunds follow Google Play’s process;
• records of survey actions (locks, AgriStack and RI approvals), pass grants and Google Play and website (Razorpay) purchase records are kept, linked only to a random internal ID and no longer to your email or Google account, for accounting, tax, refunds and disputes, fraud prevention and aggregate statistics; and
• every share you created ends immediately, and shares others made with you are removed from your list. Shared content uploaded by a free account is deleted with it. Your Google profile name is removed, and so are the share titles, which items were shared, link and invite codes, PINs and the invite email addresses (hashed and partly hidden) on your shares and on invites you received;
• your WhatsApp number and your offers choice (section 3Q) are deleted;
• cloud AI: your cloud search index is deleted (section 3S), the monthly counts of your AI actions are deleted and your “Use cloud AI” choice is cleared; the per-read records (which hold no image or text) are kept only as anonymous cost records, no longer linked to you;
• Invite & earn: your invite code stops working, and rewards still waiting for you are cancelled. Records of who invited whom, the code used, how and when, and reward records are kept, linked only to random internal IDs, so the same person cannot earn or receive a reward twice; and
• a one-way hash of your Google account ID is kept so the free trial cannot be claimed again by the same Google account.

Backup

Your backup is kept while Khet Scan Pro is active. When Pro ends, it is read-only for 30 days and then deleted (see section 3G). A file you delete in the App is also removed from your backup; we keep the deleted copy for 30 days to protect against accidental deletion, then delete it. A small marker that a record was deleted (without its content) is kept for up to 180 days so your other phones stay in step. Our hosting provider may keep encrypted system backups of its storage for a short period after deletion. Text read from a file (section 3L) is deleted from your phone with the file at once, and from your backup with the file within 30 days.

Shares

Free accounts’ shared content is deleted when the share ends (normally within a day). While your account exists, an ended share’s record (including the item title, shown to you in Shared by me) stays in your account. When you delete your account, only a bare record of each share remains: its type (file, work file, note, measurement), audience (person or link), whether downloads were allowed, its state, its dates and its view count, plus the event log (event type, time, who acted: owner, recipient or system). No title, no record of which items were shared, no link or PIN hashes and no invite email addresses remain. These records are kept for abuse prevention and statistics. Copies recipients saved with “Save to my files” are on their own phones and are not affected.

Partner programme

Partner records are kept as described in section 3O: tax, payment and TDS records for at least 8 years after the end of the financial year they relate to. Deleting a Khet Scan account does not close a partner account.

Other records

Deleted sync records are removed from our servers 30 days after deletion. Diagnostics, crash reports, usage statistics and service logs are kept for the retention periods of our providers (Cloudflare, Sentry, PostHog), and we may keep limited security records longer where needed for security, fraud prevention or legal compliance.

8. Delete your account

In the App: open Survey → Settings → Delete my account and confirm.

Without the App: email contact@sugamdigital.com or sugamedutech@gmail.com from the Google account you signed in with, with the subject “Delete my Khet Scan account”. We will confirm and complete the request within 30 days. See also our account deletion page.

To ask about data that is not tied to an account (for example sync records for an install), email us with as much detail as you can. Because these records are linked only to a random install identifier, we may need information from the App to find them.

9. Security

We use reasonable safeguards, including encrypted local storage, Android Keystore-backed secure storage for tokens, signed requests between the App and our servers, signed update bundles, HTTPS, encryption at rest for Backup data (with keys managed by us and our hosting provider; not end-to-end encryption), and restricted access to our infrastructure. Share links and invites are random codes stored only as one-way hashes, and PIN attempts are limited. Cloud AI requests go over HTTPS from the App to our server and from our server to Google Cloud; our server and its logs do not keep the page image or the AI request and answer. Portal passwords you save are encrypted on your phone with a key held by Android’s secure hardware and are unlocked only after your fingerprint or phone PIN; we never receive them. The App fills a saved password only into the portal’s own web pages on its government address, never submits the form for you, and blocks screenshots and screen recording while a saved password is shown. No method of storage or transmission is completely secure, so please don’t put passwords or sensitive identifiers in labels, reminder titles or note names.

10. Children

The App is a work tool for adults and is not directed to children. Google sign-in for the survey tools is intended only for adult revenue staff.

11. Your rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may ask to access, correct or erase personal data we hold about you, withdraw consent (for example by signing out and deleting your account), and raise a grievance with us. You may also decline permissions, delete local records, clear the App’s data or uninstall it, and open portals in your own browser instead of the in-app browser.

Send requests and grievances to contact@sugamdigital.com or sugamedutech@gmail.com. We aim to respond within 30 days. If you are not satisfied with our response, you may be able to complain to the Data Protection Board of India or another relevant authority.

12. Changes to this policy

We will update this policy when the App, its services or the law change, and publish the new version here with a new “Last updated” date. If a change materially affects how we handle your information, we will also tell you in the App.

13. Contact

Sugam Edutech Private Limited (Sugam Digital)
Email: contact@sugamdigital.com or sugamedutech@gmail.com
Phone / WhatsApp: +91 84102 42335