Privacy policy

Mohalla Shop is an app for finding offers from the shops on your own street, asking those shops for a price, and collecting what you ordered at their counter. This policy covers the Mohalla Shop website at www.mohalla.shop and the Mohalla Shop Android and iOS apps.

Mohalla Shop is run by AIPath DigiNext. “We”, “us” and “our” below mean AIPath DigiNext.

AIPath DigiNext can be reached at 659, Ganga Vihar, Lucknow 226101, Uttar Pradesh, India, and at admin@mohalla.shop.

FOR AIPATH DIGINEXT TO ADD — the full legal name including its suffix (Pvt Ltd, LLP or otherwise) and the registration number (CIN/LLPIN/GSTIN). The Lucknow address above is the registered one and is the only address this policy names.

When you make an account, and while you use the app, we store:

• Your email address and name. Both are required to make an account. Your name is shown to shopkeepers on your orders and next to any comment you leave.
• Your phone number, if you choose to add one. It is optional.
• Your password, stored only as a one-way hash. We cannot read it, and neither can anyone who obtains a copy of our database.
• An approximate location — a latitude and longitude, and an area name such as a locality or neighbourhood. This is what makes “shops near you” mean anything; see section 3.
• Photos you upload. A profile photo if you set one. If you run a shop: a shopfront photo, photos on your offers, a UPI QR code if you add one, and photos you send while packing an order. If you are buying: a photo attached to a price request, and a voice note if you record one.
• What you do in the app, because the app cannot work otherwise: shops you follow, offers you like or comment on, price requests you send, quotes you receive, and orders you place — their items, totals, status and history.
• Device information for notifications. If you allow notifications, we store a push token for that installation, whether it is an Android, iOS or web device, and the language you were reading in, so a notification arrives in a language you understand.
• A record of each signed-in device — a short description such as “Chrome on Windows”, and when it was last used — so you can see your sessions and end one you do not recognise.
• Your language choice, stored in a cookie in your browser and against your device for notifications.

If you sign in with Google or Apple, we receive your email address and name from them and store those in the same way. We do not receive your Google or Apple password.

Location is used for one thing: ordering the list of shops so that the nearest ones come first, and hiding shops that are too far away to walk to. A shop stores its own location for the same reason. We do not track where you go, we do not keep a history of where you have been, and we do not build a movement profile — the app stores one approximate point for your account and replaces it when you change it.

You can use the app without giving a precise location. The shops you follow, your orders and your price requests all work; only the “near you” ordering becomes a guess.

Mohalla Shop does not take payments. There is no wallet, no checkout, no card on file and no commission. You pay the shop directly — in cash at the counter, or by UPI straight from your bank app to theirs. We never see your card details, your bank account or your UPI transaction, because none of them ever reach us.

When a shop shows a UPI QR code on its page, that image is a file the shopkeeper uploaded. We do not verify it, we cannot confirm that it belongs to the shop, and we are not a party to any payment you make with it. Check the name your UPI app shows you before you confirm a payment, exactly as you would with a QR code taped to a counter.

• Shopkeepers you deal with see your name, the items you asked for, and your order — the same things they would know if you had walked in and asked. They see your phone number only if you have added one to your account.
• Anyone using the app can see your name and photo next to a comment you leave on an offer, and the name and details of any shop that is live, including on its public page.
• Anyone at all, without an account, can see a shop’s public page — its name, category, area, opening hours, current offers, price list and UPI code — because that page exists to be scanned off a poster and forwarded. A shopkeeper who does not want that should not publish the shop.
• The services that run the app: our hosting and database provider, the service that sends our email, and the push notification service that delivers alerts to phones. They process this data on our instructions and for no other purpose.
• Google Analytics, only if you have accepted it, only on the website, and only about the visit rather than about you: which pages were opened, in which order, roughly where in the world from, and on what kind of device. Your name, your email address, your orders and your messages are never sent to it. The Android app sends nothing to it at all.
• An AI writing service, where a shopkeeper uses the assisted offer composer. The text of the offer being drafted is sent to it to be rewritten. Nothing about a buyer is sent, and a shopkeeper who does not use the composer sends nothing.

We do not sell your data, and we do not use it for advertising.

Four cookies are ours. Two hold your session (mohalla_token and mohalla_refresh); they are marked httpOnly, which means no script on the page — ours or anybody else’s — can read them. The third (mohalla_lang) remembers which of the app’s languages you chose.

A fourth (mohalla_consent) remembers your answer to the question below, so that you are asked once a year rather than on every visit. It holds one word — whether you said yes or no — and nothing else.

The website — not the Android app — asks whether it may use Google Analytics, and does not load it unless you say yes. Until then, and permanently if you say no, no analytics script is sent to your browser at all: not held back, not loaded in a limited mode, simply not there. Saying no costs you nothing — every page works exactly the same way.

If you accept, Google Analytics sets its own cookies (_ga and one beginning _ga_). They hold a randomly generated number that lets Google count a repeat visit as the same browser rather than as two people. We use it to see which screens get used and where people give up, and for nothing else: the property is not linked to Google Ads, and there are no advertising cookies on this site. Google receives your IP address in order to answer the request at all, and discards it rather than storing it against the measurement.

Changed your mind? Clearing this site’s cookies in your browser removes your answer along with them, and the question comes back on your next visit.

Your account and its history are kept for as long as the account exists, because your past orders and price requests are things you can look back at. Signing out of a device deletes that device’s session record. Removing a device from notifications deletes its push token. A password reset link is stored only as a hash and stops working once it is used or after it expires.

• Change or correct your details — name, phone, photo, area and language — from the profile screen at any time.
• Turn notifications off in your phone’s settings, which stops the push token being used.
• End other sessions from the app, which signs out every other device immediately.
• Ask us to delete your account and its data by writing to the address in section 11. There is no self-service delete button in the app yet; until there is, we do this by hand on request.

Mohalla Shop is operated from India and India’s Digital Personal Data Protection Act, 2023 applies to it. Under that Act you may ask us for a summary of the personal data we hold about you and what we do with it, ask us to correct or complete anything inaccurate, ask us to erase it, withdraw a consent you previously gave, and nominate someone to exercise these rights if you die or become incapacitated. Write to us at the address in section 11 and we will answer.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India. The Act asks you to raise it with us first, so please give us the chance to put it right before you do.

FOR AIPATH DIGINEXT TO REVIEW — the DPDP Rules were notified on 13 November 2025 and the substantive obligations on a data fiduciary phase in over eighteen months, so most of them bite around May 2027 rather than today. The paragraph above is written to be true now and to stay true then. If you take users in the EU or UK you need a separate GDPR paragraph, which this is not. Check it with your own adviser.

You must be at least 16 to make a Mohalla Shop account. The app is not aimed at children, and we do not knowingly collect anything from anyone under 16. If you believe a child has made an account, write to us at the address in section 11 and we will delete it.

FOR AIPATH DIGINEXT TO CONFIRM — 16 is stated above as chosen. Note that India’s Digital Personal Data Protection Act treats everyone under 18 as a child and requires verifiable parental consent before their data is processed, which this app does not currently collect. Either raise this to 18, or add a parental consent step for 16- and 17-year-olds in India. This is a note about the law, not legal advice — check it with your own adviser before launch.

If this policy changes we will update the date at the top of this page, and the current version will always be the one published here at www.mohalla.shop/privacy.

For privacy questions, to exercise any of the rights in section 8, or to ask us to delete your account, write to admin@mohalla.shop or to AIPath DigiNext, 659, Ganga Vihar, Lucknow 226101, Uttar Pradesh, India.