Privacy Policy

Bolta Punjab · last updated 29 October 2026

Bolta Punjab is a messaging and calling service built and operated by Apits Network, an IT company based in Lahore, Pakistan. This page describes what the service stores, why it stores it, how long it keeps it, and who can see it. It describes how the service actually works rather than what it might do in principle.

The most important thing to know: your messages are not end-to-end encrypted. They are encrypted while travelling between your device and our servers, and they are stored on the service's servers in a form the service can read. Treat Bolta Punjab as a record the service holds, not as a private channel that nobody but you and the recipient can read.

Who is responsible

Apits Network operates this service and is responsible for the information it holds.

Apits Network · 516, 5th Floor, High-Q Tower, 1 Jail Road, Gulberg V, Lahore, Pakistan · info@apitsnetwork.com · +92 313 4038839

Questions, requests and complaints about your information can be sent to that address.

What the service stores

What	Why	How long
Your phone number, and your email address if you added one	They are how you sign in — there is no password. People you chat with can see your number; your email address is never shown to other users. Someone who already knows your whole number or address can find you in search unless you turn off Let people find me.	While your account exists
Your profile — name, photo, "about" text, optional username and links	So the people you talk to can recognise you. You choose all of it and can change or remove it.	While your account exists
Your messages, and the photos, videos, documents and voice notes you send	To deliver them, and so that your chat history is there when you sign in on another device.	Until you delete them, or for ever if you do not — see Keeping messages
Who you talked to and when; call records and their length	To show your chat list and call history.	Until you clear them
Phone numbers your app sends to find which of your contacts use the service	To tell you who you can already message. Your contacts' names are not sent — the app sends numbers only, and keeps the names on your phone. The exception is a contact card you choose to share in a chat: that carries the name and numbers you picked, because sharing them is the point of it.	Until you remove the contact or delete your account
Your devices — model, platform, app version, when each was last active	To deliver notifications, and so you can see and sign out of your own sessions.	Until the device is removed
Verification codes sent by SMS or email	To confirm you hold the number or address you are signing in with.	The code expires within minutes. A record that one was sent — the number or address, the time and how it was delivered — is kept for one year for SMS and 30 days for email
Passkeys you register	So you can sign in with your phone's or computer's screen lock. Only the public half of each key is stored; the private half never leaves your device.	Until you remove the passkey
Status updates	To show them to the audience you chose.	24 hours, then deleted automatically
Shared locations	To show them in the chat. A live location ends by itself when the time you chose runs out.	With the message
Notification delivery records	To diagnose notifications that do not arrive.	30 days
Reports you make about other users	So the service can act on abuse.	The report is kept; any messages attached to it are deleted 90 days after the report is resolved
Records of administrative actions, such as blocking or deleting an account	So that every action an administrator takes can be accounted for.	Kept. After one year, any phone number, email address or IP address in them is removed
Database backups	So the service can be restored after a failure.	30 days

Keeping messages

The service keeps your messages on its servers so that your history follows you to a new device. There is no separate "chat backup" to turn on or off, because the server already holds them. If you delete a message for yourself it goes from your copy; if you delete it for everyone it is removed from the chat for all participants. A chat you clear or delete is emptied from your side — the other participants keep their own copies, as they would with a letter you had sent them.

You can set a disappearing-message timer on a chat, after which new messages in it are deleted automatically.

Calls

Voice and video calls are carried through this service's own media server. That has two consequences worth stating plainly. First, the call's audio and video are encrypted in transit but pass through the service's own infrastructure. Second, because the call never goes directly between the two devices, the other person never learns your device's IP address.

Who can see your information

The people you send things to. That is the point of the service.
Other users, as far as your privacy settings allow. You control who can see your profile photo, your "about" text, when you were last seen, whether you appear online, who may add you to groups, and who sees your status updates.
Authorised administrators of the service, who can see account details and act on reports of abuse. Administrative actions are recorded in an audit log.
Nobody else, for advertising. The service shows no advertising and sells no information to anyone.

Other services involved

These are the only third parties the service passes anything to, and why:

Google (Firebase Cloud Messaging) delivers notifications to Android phones, and to iPhones by way of Apple's notification service. A notification carries who wrote to you and a short preview, so that your phone can show it while the app is closed. For a locked chat, and when you turn previews off, the notification deliberately carries no sender and no preview.
Apple (Apple Push Notification service) delivers notifications and incoming-call alerts to iPhones. An incoming-call alert carries the caller's name and a link to their photo, so that a locked iPhone can ring and show who is calling.
Microsoft (Microsoft 365) sends the service's emails — sign-in codes and two-step recovery codes — to your address.
An SMS provider delivers your sign-in code to your number.
OpenStreetMap supplies the map picture shown with a shared location. Your location is not sent to them; the server asks for map tiles for the area and caches them, so the same area is fetched once however many people share a location there.

What you can do

See everything held about you — Settings → Account → Request account info.
Delete your account — Settings → Account → Delete my account. Your profile, your contacts, your devices, your group memberships and your own messages' authorship are removed. Messages you have already sent to other people remain in their copies of those chats.
Change your number, keeping your chats and groups, or remove your email address.
Stay out of search — Settings → Privacy → Let people find me.
Export a chat as a text transcript.
Control your privacy settings, including hiding your last seen, your photo and your "about" text, and silencing calls from people you have not saved.
Sign a device out from any other device you are signed in on.

Children

The service is not intended for children under 13. If you believe a child under 13 is using it, please tell us at the address below and the account will be removed.

Security

Traffic between your device and the service is encrypted with TLS. Media files are served through short-lived links rather than public URLs. Passwords for administrators, two-step verification PINs and chat-lock PINs are stored hashed and cannot be read back. Access to the service's administrative tools is restricted and logged. No service can promise perfect security, and this page does not.

Changes to this page

If what the service does with your information changes, this page changes with it and the date at the top is updated.

Questions or requests about your information: info@apitsnetwork.com