Privacy Policy

1. Information you give us

• Your account: your mobile number or email address, your first and last name, and the username we create for you (you can change it). If an invite code is needed, we keep a protected (hashed) copy of the code and a record of who invited you. If you set a password, we store only a secure hash of it. We also ask your connection to Bangladesh (section 7).
• Your profile (optional): date of birth (to confirm you are 18 or over), gender, profile photo, cover photo, bio, and About details such as city, home town, work, education, family, relationship status, languages, contact details, hobbies and interests. You choose who sees each About detail.
• What you create: posts, photos, videos, reels, stories, live broadcasts and their replays, comments, reactions, messages (text, voice messages, photos, videos and files), groups and communities, events, Haat-Bazaar listings (title, description, price, condition and area — division, district and upazila, never exact coordinates), jobs and job applications (including a CV you attach), songs, playlists, and Pages you run.
• Places you add: the name and kind of a place you add from the location picker and where it is. It is shown to others after our staff review it.
• Requests you send us: verification requests, reports, appeals, copyright appeals and messages to our team.

2. Information we collect when you use Be Social

• Sessions and devices: for each signed-in device we keep a device label, the browser or app version (user agent), when it was last used and when the session expires, so you can see and end your sessions.
• Sign-in security: each time you sign in, and when the address you use changes, we record the IP address and the approximate location it points to (city, region, country and the network provider). This location is worked out on our own servers from a downloaded IP database — never from GPS — and is only approximate. We use it to show you where you are signed in, to warn you about a sign-in from a new device, and to investigate account takeovers and abuse. It is deleted after 90 days.
• Notifications: if you use the Android app we store an installation ID, the notification token from Google Firebase Cloud Messaging, your platform, app version, language and your notification choices. Up to 10 devices are kept per account.
• Calls: sound and video pass through our own servers in real time to the people in the call. We do not record calls. We keep a call history: who called whom, audio or video, when, how long, and whether it was answered, missed or declined.
• Activity: who you follow and are friends with, what you react to, save, search for, and watch (video views); the songs you play, like and save (for your library and recently played); notifications; and message delivery and read receipts.
• Content ID: we create an audio fingerprint of every song uploaded to Be Social Music. The sound of new videos, audio posts and reels is compared with those fingerprints to find copyright matches; for these we keep only the result of the check, not a fingerprint. We keep records of matches and appeals.
• Safety records: reports, moderation cases and enforcement actions, and our staff audit log.
• Verification payments: if you pay for the verified badge (BDT 500 a year, for a person or a Page), we keep a record of each payment: the amount, the date, its status and the payment gateway's reference. You pay on the payment gateway's own page; your card or mobile-wallet details are handled by the gateway and we never see them.

3. Visitors who are not signed in

Anyone can read our public pages without an account. On the website, a visitor who is not signed in can listen to one song free every 24 hours. To keep to that limit we set one cookie, bs_free_song (signed, HttpOnly, used only for Music, expires after 24 hours), and keep a one-way hashed key made from the visitor's IP address, browser and language settings, which is deleted within 48 hours. We do not use this to identify anyone.

4. What we do not collect

We do not ask for your contacts. The app asks for permission to use your location once, when you first open it (the website asks the first time you add a location to a post). We read your location only when you open the location picker in a post, round it to about 100 metres, and use it only to list places near you. It is not saved, not logged and not attached to your post: the post shows only the place you pick. Without permission you can still pick from your recent places or search. We remove location and camera details (EXIF and video metadata) from photos and videos when we process them. We show no ads, use no advertising ID, and include no third-party analytics, tracking or crash-reporting tools. We never see or store card numbers or mobile-wallet details. We do not sell your information.

5. Phone permissions (Android app)

• Camera and microphone — for calls, live video, and photos, videos and voice messages you take.
• Photos and videos — only the ones you choose, through Android's picker.
• Notifications — for messages, calls and activity. Incoming calls can show full screen.
• Bluetooth — so calls can use your headset.
• Running in the background — to keep a call or music playing while you use other apps.

The app does not request access to your contacts. It asks for location permission once, at first start; it reads your location only when you add a location to a post.

6. How we use your information

• To run Be Social: your profile, feed, Pages, messages, calls, live video, music, Haat-Bazaar, jobs, events and notifications.
• To verify your mobile number or email address with a one-time code, and to keep your account secure.
• To stop spam, fraud and abuse, to check uploads against Content ID, to review reports and to enforce our Terms.
• To answer you when you contact us.

7. Safety checks: fake accounts, nudity and ban evasion

To keep Be Social safe we run some automatic checks. They run on our own servers; no photo, face or result is sent to anyone else.

• Connection to Bangladesh: Be Social is currently only for people connected to Bangladesh. At sign-up we ask your connection — by birth, nationality, ethnicity, or ancestry or descent — and keep your answer with your account. We do not ask for documents.
• Fake-account checks: when an account is created, and when its name or profile photo changes, we look for signs of a fake account: a name of random letters or mostly numbers, the same name as a verified account, a profile photo copied from another account (we keep a short fingerprint of each profile photo to compare), many sign-ups from similar mobile numbers at the same time, a disposable email address, and a new account following or messaging very many people. A high score holds the account for our staff to review: it can still read, but cannot post or message until they approve it.
• Automated nudity scanning: every photo and video you upload — posts, reels, stories, profile and cover photos, messages and Pages — is checked automatically for nudity before anyone else can see it; videos are checked about once a second and at scene changes. If the check finds nudity, the upload is not published, you are told it goes against our rules, and our staff review it. We keep the check's score with the photo or video.
• Face matching, only for ban evasion and impersonation: when an account is banned we keep a numerical description of the face in its profile photo (a face template, not the photo). When a profile photo changes, its face is compared only with the templates of banned accounts. A match does not ban anyone; it holds the account for our staff to review. We do not use face templates for anything else, and we do not recognise people in posts.
• Banned accounts: when an account is banned we also keep a protected (keyed hash) copy of its mobile number, and of a National ID (NID) number if one was given for verification, so that the same person cannot open a new account while the ban lasts. We do not block anyone by device or IP address.

How long: a blocked upload is kept only while it is reviewed and is deleted 14 days after the decision (90 days if it may show a child, so that it can be reported to the authorities). Face templates and mobile number and NID records are kept while the ban lasts — even if the banned account is deleted — and are deleted when the account is unbanned. Fake-account scores and holds are deleted with the account.

Appeal: if you think a check got it wrong — a blocked upload, an account held for review, or a ban — appeal in the app or write to info@besocial.bd. A person on our staff reviews every blocked upload and every held account; the automatic checks alone never ban anyone.

8. Who can see your information

• Everyone: your name, username and profile photo. Everything else follows the audience you choose and your privacy settings. Public posts and the public profiles of Pages and verified accounts can appear in search engines.
• Messages: only the people in the conversation. Messages are encrypted in transit but are not end-to-end encrypted. When you "unsend" a message it disappears from the conversation, but we keep its text with your account for safety.
• Our moderators: content that is reported to them. For a reported message they see that message and up to 20 messages before it and 20 after it. In serious cases (for example a legal request or a threat to someone's safety), a senior staff member can be given time-limited access to one conversation; every such access is logged, and the people in the conversation are told afterwards.
• Authorised staff: an account's sign-in history (IP addresses, approximate locations and devices) when protecting the account or investigating abuse. Staff see contact details only partly masked. Staff access to accounts is recorded in our audit log.
• You: your signed-in devices and their approximate locations in Settings → Password & security, and a copy of your information through Settings → Download your information.
• The law: we may disclose information when the law of Bangladesh requires it.

9. Services we use

• SMS provider (Bangladesh) — receives your mobile number and the code to send you.
• Email provider — delivers sign-in codes and account email if you use an email address.
• Google Firebase Cloud Messaging — delivers push notifications to the Android app. It receives your device's notification token and the notification text. For messages that includes a preview of the message unless you turn off "Show notification previews" in the app's notification settings.
• Google Play — distributes the Android app and its updates.
• A licensed payment gateway in Bangladesh — processes payments for the verified badge. It receives the amount, an invoice number, and the name, mobile number and email address of the person paying, and handles the card or mobile-wallet details itself.
• IP location database — approximate locations come from the free IP Geolocation by DB-IP database (CC BY 4.0), which we download and use on our own servers. Your IP address is never sent to DB-IP or anyone else.
• Place names — place names include data © OpenStreetMap contributors (ODbL), which we download and use on our own servers. Nothing you type and no location is sent to OpenStreetMap.

Calls and live video run on software we operate on our own servers. Fonts and other website files are served from besocial.bd.

10. Cookies and browser storage

The website does not use advertising or tracking cookies. It uses your browser's storage for these purposes only:

• Staying signed in — your sign-in token (kept only for the browser session unless you choose "Remember me"), and which Page you are acting as.
• Preferences — theme (light or dark) and language.
• Messages — drafts and messages waiting to be sent.
• Small reminders — whether you have seen the Android app suggestion, whether call sounds are muted, and when a video view was last counted.
• Music for visitors — the bs_free_song cookie described in section 3.

11. Where it is stored and how it is protected

Your information is stored on servers we operate in Bangladesh. Connections use HTTPS, passwords are stored only as secure hashes, and sign-in tokens are kept in your phone's secure storage. You can turn on two-step verification with an authenticator app in Settings, and you are alerted when your account is signed in on a new device.

12. How long we keep it, and deleting your account

• While you have an account we keep your information so Be Social works for you.
• Sign-in records: IP addresses, approximate locations and sign-in history are deleted after 90 days, whether or not you keep your account.
• Visitor music limit: the hashed key is deleted within 48 hours, and the cookie expires after 24 hours.
• Video originals uploaded only for editing are deleted after 24 hours.
• Deleted posts: a post you delete, or move to Trash in your Activity log, disappears for everyone at once and is kept for up to 3 days for safety review (you can restore it from Trash during that time), then permanently removed with its comments, reactions and photos and videos.
• When you delete your account it is switched off immediately, and after 30 days it is deleted: your contact details, password, sessions, settings, profile (including your name, date of birth, gender and cover photo), posts, photos, videos, stories, reels, listings, songs and playlists, the events and jobs you posted and the job applications you sent, reactions, saved items, views, friends, follows and blocks, invites, verification requests and payment records. Photo and video files are removed from our storage, not only from the app. Reactivating your account within the 30 days cancels the deletion.
• What stays: messages you sent (with the photos and files in them) and comments you left on other people's posts stay, because they are part of someone else's conversation, but your name is removed and they show as "Deleted account". A group you created stays for its other members, without your name. A Page you own passes to its longest-serving admin (or editor), or is deleted with your account if nobody else manages it. Records of reports, rule enforcement and appeals, and our staff audit log, are kept for safety. If the account was banned, the ban records described in section 7 are kept until it is unbanned.

How to delete: besocial.bd/delete-account. You can also deactivate your account for a while instead (besocial.bd/reactivate to come back).

13. Your choices and rights

• See and edit your profile, and choose who sees your posts and profile details.
• Download a copy of your information (Settings → Download your information).
• Turn notifications, and notification previews in the app, on or off.
• Block, mute, restrict or report people and content.
• Deactivate or delete your account.
• Ask us anything about your information at info@besocial.bd.

14. Age

Be Social is for people aged 18 and over. We do not knowingly allow anyone younger, and we remove accounts that belong to anyone under 18.

15. Changes and contact

We will post changes on this page with a new effective date and tell you in the app about important ones. Questions or requests: info@besocial.bd. BengalStack, Dhaka, Bangladesh.