1. Who we are
2scale is a product of NiNaanu Ventures, a sole proprietorship based in Bengaluru, Karnataka, India ("we", "us"). For this policy we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023.
Contact and grievances: contact@2scale.in. Our Grievance Officer can be reached as set out in section 13.
2. What stays on your phone
Everything you enter or add in 2scale is stored only on your phone:
- Your name, if you give one, and your settings
- Saved properties, the File check and its answers, due-diligence answers and transactions
- Documents, property photos and AI readings of your documents
- Reminders and the property health calendar
- Rental records, including tenant details, rental agreements you add, and rental agreement drafts you create (made on your phone; a draft leaves it only if you share it yourself)
- Search history, cached area data and your purchase credits
How it is protected. Every one of these stores is encrypted with AES-256. Stored files (documents, photos, rental agreements) are each encrypted individually with AES-256-GCM. The keys are generated on your phone and kept in its secure hardware keystore (Android Keystore). They are never sent anywhere, including to us.
Not in Android's automatic backup. 2scale switches off Android's automatic app backup and device-to-device transfer, so your data is not copied to your Google account without you asking. The only backups are the ones you start yourself (section 3).
Other people's data. If you are a landlord and add a tenant's name, phone number or agreement, that is someone else's personal data. It stays encrypted on your phone and is never sent to us, but you are responsible for having a lawful reason to keep it and for deleting it when you no longer need it.
3. What leaves your phone, and when
Nothing leaves your phone in the background. Every item below happens only because you used the feature named. All connections are encrypted (HTTPS/TLS). Like any internet request, each one shows the receiving server your device's IP address.
| When you… | What is sent | Sent to |
|---|---|---|
| Ask for an AI reading of a document, and confirm | Images of the pages you picked, at most 8 pages, plus: the city you selected, your File check profile and the items you marked missing (answers only, no names or numbers), and the on-device check's findings | Google, as our AI processor (see 4.1) |
| Ask the AI assistant a question | The question you typed, and nothing else from your phone | Google, as our AI processor |
| Look up an area we have not researched | The area name | Google Places, to count nearby schools, hospitals and transport |
| Look up an area (any) | The area and city name. For an area we have not researched, its amenity counts and a search counter are saved to our shared area database so the next person gets them faster | Our database (Google Firebase) |
| Submit a community report | Area, city, the signals you tap (water, power, safety, flooding) and the price you paid or were quoted. No name, account or device ID | Our database (Google Firebase). Deleted automatically 30 days after submission |
| Start a Google Drive backup | One backup file, encrypted on your phone with a passphrase you choose | A private app folder in your own Google Drive (see 4.3) |
| Use Move to new device | Your data, encrypted with a one-time code shown on screen | Your other phone, directly over your local Wi-Fi. No server |
| Open City Pulse | A request for public headlines. No personal data | Economic Times Realty, The Hindu and Google News feeds |
| Use the free version | Ad requests (see 4.2) | Google AdMob |
| Buy a pack or plan | Handled entirely by Google Play. We receive only a purchase confirmation on your phone, never card or UPI details | Google Play |
The app's typefaces are downloaded from Google Fonts the first time they are shown. That request carries no personal data.
4. The three services that need more detail
4.1 AI reading and the AI assistant
Our AI features run on a paid Google Cloud service. Under Google's terms for paid use, Google does not use what we send to train or improve its models. It keeps requests for a limited period only to detect abuse, and then deletes them. We do not store your pages or questions on any server of ours; the reading is saved only on your phone.
An AI reading sees everything visible on the pages you send, including names, addresses and any ID numbers. Please cover or crop out Aadhaar, PAN and bank account numbers first; they are not needed for the reading, and 2scale tells the AI never to repeat them in full. The free on-device check reads a document on your phone and sends nothing.
4.2 Ads in the free version
The free version shows ads from Google AdMob. They are non-personalised: they are not chosen using a profile of you or your activity, and they are limited to general-audience content.
Non-personalised ads still use some data. On screens that show an ad, Google's ads software collects your device's advertising ID and app set ID, your IP address (from which it estimates your city), how you interact with ads and the app (such as taps and views), and app performance information. Google uses these to limit how often you see the same ad, to measure and report on ads, to pick ads relevant to your city and to prevent fraud. You can reset or delete your advertising ID in Android Settings. We never send Google your name, documents, properties or anything you enter in the app.
Where ads appear: a banner on Home (below the main card, never above it), and banners on the Guides list, City Pulse and the Explore area list. At most once a day, after you have opened the app a few times, one full-screen ad may appear over Home, with a close button. Ads never appear on the vault, documents, File check, AI, tax, transaction, rental, backup or payment screens. A paid plan removes all ads. The ads service starts only when an ad is about to be shown, never at app launch.
4.3 Google Drive backup
If you start a backup, you sign in with Google and grant access to one private app folder (drive.appdata). 2scale cannot see any other file in your Drive. The backup file is encrypted on your phone with AES-256-GCM, using a key made from a passphrase you choose (PBKDF2-HMAC-SHA256). The passphrase is never stored or sent anywhere; a key made from it is kept in your phone's secure keystore so later backups do not ask again. Neither we nor Google can read the backup, and we cannot reset or recover the passphrase: if you forget it, the backup cannot be opened. To restore on any phone, sign in to the same Google account and enter the passphrase.
The backup contains your properties, documents and photos, reminders, rentals, transactions, due-diligence answers, File check and basic settings (name, city). It does not contain purchase credits. We do not store your Google account email.
The backup stays in your Google account until you delete it: Google Drive → Settings → Manage apps → 2scale → Delete hidden app data. "Delete all data" in 2scale also disconnects 2scale from your Google account.
5. What we do not collect
- No account, and we do not collect your name, email or phone number
- No location permission; the app does not read GPS
- No contacts, call logs or SMS
- No analytics, usage tracking or crash reporting of our own. (The ads software in the free version collects the data described in 4.2.)
- No selling or renting of data, to anyone, ever
6. Phone permissions
| Permission | Why |
|---|---|
| Camera | To photograph a document or a property, only when you tap the camera |
| Notifications, run at start-up | To deliver the tax and deadline reminders you set, including after the phone restarts |
| Fingerprint / face unlock | For the optional app lock. Handled by Android; 2scale never receives biometric data |
| Internet, network and Wi-Fi state | For the online features in section 3, and to find your phone's local address for Move to new device |
| Storage (older Android versions only) | To let you pick a document file |
7. How long data is kept, and how to delete it
- On your phone: until you delete it. More → Delete all data permanently erases everything 2scale stores on the phone: every record, every document, photo and agreement file, temporary copies, scheduled reminders, stored keys other than the two storage keys, and the link to your Google account. Unused purchase credits are erased too and cannot be restored. Uninstalling the app also removes everything.
- Drive backup: until you delete it from Google Drive (4.3).
- Community reports: deleted automatically 30 days after submission. Because they carry no identity, we cannot find one person's report to delete it sooner. Combined area summaries built from many reports (such as a typical price range) may be kept longer; they contain no individual report.
- Area lookups: the shared area database holds area names, amenity counts and search counts, none of which identify you.
- AI requests: held by Google for a limited period for abuse detection only, as described in 4.1.
We cannot recover anything deleted from your phone, and we have no copy to restore from.
8. Your rights
Under the Digital Personal Data Protection Act, 2023 you can ask to access, correct or erase your personal data, withdraw consent, nominate someone to act for you, and have a grievance addressed. Most of this you can do yourself, because your data is on your phone: edit or delete it in the app, or use Delete all data. You can withdraw consent for any online feature at any time by not using it; doing so does not affect anything you did before.
For anything else, email contact@2scale.in. Because we hold no account or identity for you, we may not be able to link a request to any data, and we will tell you if that is the case. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
9. Security
AES-256 encryption of every store and file on the phone, keys in the hardware keystore, encrypted connections for every network request, an optional app lock, and no server-side copy of your data. No system is perfectly secure; if your phone is unlocked and in someone else's hands, they may see what you see.
10. Processing outside India
Google may process AI requests, ad requests and Drive backups on servers outside India, under its own safeguards. We do not send data to any country the Government of India has restricted.
11. Children
2scale is for adults. You must be 18 or older to use it, and we do not knowingly process children's data.
12. Changes to this policy
When we change this policy we update the version and date above and show the change in the app's "What's new". If a change widens what leaves your phone, we will ask before it applies to you.
13. Grievance Officer
Grievance Officer, NiNaanu Ventures, Bengaluru, Karnataka, India
Email: contact@2scale.in (subject line "Grievance")
We acknowledge every grievance within 24 hours and resolve it within 15 days.