The short version
- We collect the account details you give us (name, email, password), the books you upload and the notes you write in the app.
- We record which page you are on in each book or note, so the app can put you back there.
- Everything is stored privately. Nobody else can open it — not other users, and not our administrators — unless you share it yourself.
- Sharing is always something you do deliberately, one item at a time. Nothing is shared automatically, and you can stop sharing at any time.
- There is no advertising, no analytics SDK and no tracking in the app. We do not sell or share your personal information.
- You can delete any book or note at any time, and delete your whole account and all its data from inside the app or from this website.
This summary is for convenience. The sections below are the policy itself.
1.Who we are
BoNo (“the app”, “BoNo”) is developed and operated by Web House Nepal P. Ltd. (“we”, “us”, “our”), a private limited company registered in Nepal with its office at Sitapaila, Kathmandu, Nepal.
For the purposes of the EU and UK General Data Protection Regulation, Web House Nepal P. Ltd. is the data controller for the personal data described in this policy. Our contact details are in section 16.
This policy applies to the BoNo application on Android and iOS, the BoNo backend service it connects to, and this website. It does not apply to any third-party website or service you may reach through a link, nor to what happens to a file after you send it out of the app to someone else.
By creating an account and using BoNo, you confirm that you have read and understood this policy.
2.Information we collect
We collect only what the app needs in order to work. There are five categories.
2.1 Information you give us
| Data | When | Why we need it |
|---|---|---|
| Name | At registration | To address you in the app and identify your account |
| Email address | At registration | To sign you in, reset your password and contact you about your account |
| Password | At registration | To protect your account. We store only a one-way hash — we cannot read your password |
| Profile photo (optional) | If you choose to add one | Shown only to you, in your own profile |
2.2 The books and notes you add
There are two ways something enters your library, and we store both the same way.
Files you upload. When you upload a file we store the file itself and information about it: the original filename, a title you can edit, the file type (PDF, DOC or DOCX), the file size, the number of pages, and the date it was added.
Notes you write. When you write a note in the app we store the text and any images you place in it, together with its title and the date it was created and last edited. Each note is converted into a PDF so it can be read with proper pages and shared as an ordinary file. Both the note and its PDF are stored privately in your account.
Word documents (.doc and .docx) are automatically converted into a PDF for the same reason. All conversion — notes and Word files alike — happens on our own server using open-source software; your content is never sent to a third-party conversion service. Both the original and the converted copy are stored privately in your account, and both are deleted when you delete the item.
We do not read, index, analyse, mine or profile the contents of your books or notes, and we do not use them to train any machine-learning or artificial-intelligence system.
2.3 Your reading activity
This is the information that makes the app useful. For each book or note, we store: the page you are currently on, the total number of pages, your progress as a percentage, when you last opened it, when you last read it, and whether you have finished it.
This data is linked to your account so that your position follows you to any device you sign in on. It is never shared with anyone — including with people you share a book or note with, who see the file only, never your progress in it.
2.4 Technical information collected automatically
- Authentication token — a revocable access token issued when you sign in, stored securely on your device so you do not have to log in every time.
- IP address, device type, operating system version and app version — sent with each request and recorded in our server logs.
- Server and error logs — records of requests to our service, including timestamps and error messages, kept for security, abuse prevention and diagnosing faults.
We do not collect your precise or approximate location, your contacts, your calendar, your microphone or camera input (except a photo you deliberately take for your profile picture), your advertising identifier, or your activity in other apps or websites.
2.5 Records of what you share
When you share a book or a note, we record what was shared, when, and — if you shared it to another BoNo account — which account it went to. We keep this so that both of you can see the item in your libraries, and so that you can withdraw a share later.
If instead you send the PDF out of the app through WhatsApp, email or any other app on your phone, the file leaves BoNo and we keep only the record that you used the share action. What happens to the file after that is outside our control and outside this policy — it is governed by the app you sent it through, and by whoever received it. Please think about this before sharing anything confidential.
We do not read the contents of what you share, and we do not build a social graph, suggest people to you, or use your sharing history for any purpose other than operating the feature.
3.What we never do
Stated plainly, so there is no ambiguity:
- We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising as those terms are defined under California law.
- We do not show advertising in the app and do not integrate any advertising network.
- We do not embed third-party analytics or tracking SDKs in the app.
- We do not read the contents of your books or notes, and our administrators cannot open them. The internal administration tools show only counts and metadata — such as an item's title, size, format and processing status — never the file itself.
- We do not use your books, notes, reading habits or sharing history to train AI models.
- We do not share anything on your behalf. Nothing in your library is visible to another person unless you deliberately share that specific item.
- We do not transfer your data to data brokers.
4.Device permissions
The app asks for as little as possible, and explains each request when it is made. You can refuse or later withdraw any optional permission in your device settings; the app continues to work, minus that feature.
| Permission | Platform | Why | Required? |
|---|---|---|---|
| Internet / network access | Android, iOS | To sign you in and sync your documents and reading position with our server | Yes |
| Network state | Android | To detect when you are offline so your progress can be queued and synced later | Yes |
| Document picker | Android, iOS | To let you choose a specific PDF or Word file to upload. The app receives only the file you pick — it cannot browse your storage | Yes |
| System share sheet | Android, iOS | Only when you tap Share, to hand the PDF to another app you choose. BoNo cannot see which app you pick or what you do there | No |
| Photo library | Android, iOS | Only if you choose a profile picture from your photos | No |
| Camera | Android, iOS | Only if you choose to take a new profile picture | No |
The app does not request location, contacts, SMS, call logs, microphone, health data or background location, and does not use accessibility services.
5.How we use information, and our legal basis
We use your information for the purposes below and nothing else. Where the EU or UK GDPR applies, the legal basis for each purpose is given.
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and maintaining your account | Name, email, password hash | Performance of a contract |
| Storing your books and notes and showing your library | Uploaded files, notes and their metadata | Performance of a contract |
| Converting Word files and notes into readable PDFs | Uploaded file or note content | Performance of a contract |
| Sharing a book or note with a person you choose | The item you selected, and the recipient you named | Performance of a contract (you asked us to send it) |
| Saving and restoring your reading position | Reading progress | Performance of a contract |
| Sending account emails (password reset, security notices) | Email address | Performance of a contract |
| Keeping the service secure, preventing abuse, enforcing limits | IP address, logs, account identifiers | Legitimate interests |
| Diagnosing errors and improving reliability | Error logs, app and device version | Legitimate interests |
| Displaying your profile photo | Photo you upload | Consent (you choose to add it) |
| Responding to legal requests and protecting legal rights | As strictly necessary | Legal obligation / legitimate interests |
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.
6.How your data is stored and protected
Your books and notes are stored on our server in a private area that is not reachable from the public internet. There is no directory that can be browsed. A file can only be delivered through an authenticated request, and only after the server has verified that the signed-in account is either the owner of that specific item or a person the owner has shared it with.
Our safeguards include:
- Encryption of all traffic between the app and our server using HTTPS/TLS.
- Passwords stored as bcrypt hashes, never in readable form.
- Token-based authentication, with the token held in the device's secure keychain or keystore. You can revoke tokens by logging out or changing your password.
- Ownership and share checks on every request that touches a book, a note or a reading record.
- Server-side validation of every uploaded file's real type and size, independent of what the device claims.
- Rate limiting on sign-in and upload endpoints to slow down automated attacks.
- Access to production systems limited to a small number of authorised staff, for maintenance only.
No system can be guaranteed perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected users without undue delay, and in any case within 72 hours of becoming aware of it where the GDPR requires this.
Please help us keep your account safe: use a password you do not use anywhere else, and tell us immediately at support@webhousenepal.com if you think someone else has access to it.
7.Sharing and disclosure
7.1 When you share a book or note with someone
This is the only way anything in your library reaches another person, and it happens only because you asked for it.
- You choose each item. Sharing works one book or note at a time. There is no setting that shares your library, and no default that shares anything.
- What the other person receives is the PDF of that item and its title. They do not receive your reading progress, your other books or notes, your email address, or anything else about your account beyond the name on your profile.
- Inside BoNo: if you share to another BoNo account, the item appears in that person's library and they can read it. You can withdraw the share at any time, which removes their access — see section 10.3.
- Outside BoNo: if you send the PDF through WhatsApp, email or another app, that copy leaves our service entirely. We cannot recall it, track it or delete it, and the receiving app's own privacy policy applies from that point on.
- Share only what is yours to share. Sending a copyrighted book to other people may infringe the rights of its author or publisher, and is your responsibility, not ours. See the Terms of Service.
Sharing at your direction is not us sharing or selling your data. We act only as the messenger for the item you selected. We never initiate a share, and we never disclose your library to another user for any purpose of our own.
7.2 Disclosure by us
We do not sell, rent or trade your personal information. We disclose it only in these limited situations:
- Service providers (processors). Companies that host our servers and deliver our transactional email act on our instructions under written contracts, may use the data only to provide their service to us, and must protect it to a standard at least equal to this policy. A current list of our processors is available on request.
- Legal requirements. Where we are required by applicable law, a valid court order or a lawful request from a competent authority, and only to the extent required. We will notify you of such a request unless we are legally prohibited from doing so.
- Protecting rights and safety. Where disclosure is necessary to investigate or prevent fraud, security incidents, or a threat to the safety of any person.
- Business transfer. If Web House Nepal P. Ltd. is involved in a merger, acquisition or sale of assets, your data may transfer to the successor entity. You will be notified before your personal data becomes subject to a different privacy policy, and you will be able to delete your account first.
8.International data transfers
Our service is operated from Nepal, and our servers and service providers may be located in Nepal or in other countries. If you use BoNo from the European Economic Area, the United Kingdom or another region with data-transfer restrictions, your personal data may be transferred to and processed in a country that has not been recognised as providing an equivalent level of data protection.
Where that happens, we rely on appropriate safeguards — including Standard Contractual Clauses with our processors — and we apply the protections described in this policy to your data wherever it is held. You may request a copy of the relevant safeguards by writing to us.
9.How long we keep your data
| Data | Retention period |
|---|---|
| Account details (name, email, password hash, profile photo) | Until you delete your account |
| Books, notes and their converted PDF copies | Until you delete the item, or delete your account |
| Reading progress records | Deleted together with the book or note they belong to |
| A book or note you delete | Removed from active systems immediately; purged from encrypted backups within 30 days |
| A share you have withdrawn, or an item you deleted that was shared inside BoNo | Access ends immediately; the recipient's copy is removed with it |
| A PDF you sent out of the app to another service | Not ours to delete. It is held by the app you sent it through and by the person who received it |
| Records of what you shared and with whom | Until you delete the item or your account |
| An account you delete | All associated data erased within 30 days, including from backups |
| Server and security logs (including IP addresses) | Up to 90 days, then deleted or anonymised |
| Support correspondence | Up to 24 months after the enquiry is closed |
| Records we must keep by law (e.g. tax or accounting) | For the period required by Nepali law |
If your account is inactive for 24 consecutive months, we will email you at the address on file before deleting the account and its contents.
10.Deleting your data and your account
10.1 Deleting a single book or note
Open the item in the app, choose Delete, and confirm. The original file or note, the converted reading copy, your reading progress for it, and any share you made of it inside BoNo are all removed. This cannot be undone.
10.2 Withdrawing something you shared
Open the item in the app, choose Shared with, and remove the person. Their access ends immediately and the item disappears from their library. Deleting the item outright does the same thing for everyone you shared it with.
This works only for shares made inside BoNo. If you sent the PDF out through another app, that copy is beyond our reach and cannot be withdrawn by us or by you.
10.3 Deleting your whole account
You can permanently delete your account and everything in it. There are two routes, and both are free:
- In the app: Profile → Settings → Account → Delete account, then confirm.
- From the web: use the request form at bono.webhousenepal.com/delete-account, or email support@webhousenepal.com from the address registered to your account with the subject “Delete my BoNo account”.
What is deleted: your name, email address, password hash, profile photo, every book you uploaded, every note you wrote, every converted copy, all reading-progress records, every share you made inside the app, and your access tokens.
What may briefly remain: encrypted backups, which are rotated and fully purged within 30 days, and anonymised server logs that can no longer be linked to you. Files you sent out of the app to other services are not affected by account deletion, because they are no longer ours. We may also retain the minimum records required by law, or needed to resolve a dispute or enforce our agreements.
We complete deletion requests within 30 days and confirm by email when it is done. We may ask you to verify your identity before acting, to make sure someone else cannot delete your library.
11.Your privacy rights
Whatever country you are in, you can ask us to give you a copy of your data, correct it, or delete it. Write to support@webhousenepal.com and we will respond within 30 days.
11.1 If you are in the EEA, the UK or Switzerland
Under the GDPR and UK GDPR you have the right to: access your personal data; have inaccurate data corrected; have your data erased; restrict or object to processing based on legitimate interests; receive your data in a portable, machine-readable format; and withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal.
You also have the right to lodge a complaint with your national data protection authority. We would appreciate the chance to address your concern first.
11.2 If you are in California
Under the CCPA as amended by the CPRA, you have the right to know what personal information we collect and how it is used and disclosed, to request deletion, to request correction, to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. You have the right not to be discriminated against for exercising these rights.
We have not sold or shared personal information in the preceding twelve months, and we do not use or disclose sensitive personal information for purposes other than providing the service. We do not knowingly sell the personal information of anyone under 16.
11.3 If you are in Nepal
Your personal data is protected under the Individual Privacy Act, 2075 (2018), which requires your consent before personal data is collected and used, and gives you the right to obtain and correct data held about you. This policy, and the consent you give when you create an account, are how we meet that obligation.
11.4 Other regions
If your country grants you additional rights over your personal data, contact us and we will honour any right you are legally entitled to exercise.
12.Children's privacy
BoNo is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions where that is the applicable age of digital consent without parental authorisation).
If you are a parent or guardian and believe your child has created an account or given us personal data, contact us at support@webhousenepal.com and we will delete the account and its contents promptly. If we become aware that we have collected such data without the required consent, we will delete it.
13.Cookies and this website
The mobile app uses no cookies and no tracking technologies. It stores a login token and a copy of your reading position on your own device so it can work offline; this data never leaves your device except to sync with your account.
This website is a set of static pages. It sets no cookies, runs no analytics and embeds no third-party trackers. Fonts are loaded from Google Fonts, which means Google receives your IP address when the font files are requested; this is necessary to display the page and is not used by us to identify you.
Our web server keeps standard access logs (IP address, time, page requested, browser type) for security, as described in section 9.
14.Third-party services we rely on
| Category | Purpose | Data involved |
|---|---|---|
| Hosting and infrastructure provider | Runs the servers and storage that hold your account and documents | All data described in section 2 |
| Transactional email provider | Delivers password-reset and account emails | Email address, message content |
| Google Fonts (website only) | Serves the typefaces used on these web pages | IP address of your browser |
| Google Play / Apple App Store | Distribute the app and handle installation | Handled by those platforms under their own privacy policies |
These providers act as processors on our behalf and are not permitted to use your data for their own purposes. Document conversion is performed by open-source software running on our own server — your files are not sent to any third-party conversion service.
15.Changes to this policy
We may update this policy as the app changes or the law requires. When we do, we will revise the “Last updated” date at the top of this page.
If a change materially affects how we handle your personal data — for example, if we ever begin collecting a new category of data or sharing it with a new type of recipient — we will notify you in the app or by email before the change takes effect, and where the law requires it, ask for your consent. Continuing to use BoNo after a change takes effect means you accept the revised policy.
Previous versions are available on request.
16.How to contact us
For any question about this policy, your data, or to exercise a privacy right, contact us. Please put “BoNo privacy” in the subject line so it reaches the right person.
| Data controller | Web House Nepal P. Ltd. |
|---|---|
| Privacy & support email | support@webhousenepal.com |
| General enquiries | info@webhousenepal.com |
| Postal address | Web House Nepal P. Ltd. Sitapaila, Kathmandu Nepal |
| Telephone | +977 1 4794680 · +977 9801 194 962 |
| Response time | Within 2 working days for support; within 30 days for formal data requests |
17.Store disclosure summary
This section summarises the same facts in the form used by the app stores, so that what you see here matches what is declared in Google Play's Data safety section and Apple's App Privacy labels.
| Data type | Collected | Linked to you | Used for tracking | Purpose |
|---|---|---|---|---|
| Name | Yes | Yes | No | App functionality, account management |
| Email address | Yes | Yes | No | App functionality, account management |
| Photos (profile picture) | Optional | Yes | No | App functionality |
| Files and documents (books you upload) | Yes | Yes | No | App functionality |
| Other user content (notes you write, and their PDFs) | Yes | Yes | No | App functionality |
| App activity (reading progress, sharing records) | Yes | Yes | No | App functionality |
| Diagnostics / crash logs | Yes | Yes | No | App functionality, security |
| Approximate or precise location | No | — | — | — |
| Contacts, messages, health, financial info | No | — | — | — |
| Advertising ID / marketing data | No | — | — | — |
All data listed above is encrypted in transit. You can request deletion of any of it, or of your entire account, as described in section 10.
On sharing. BoNo lets you send a book or note to another person. This is a user-initiated transfer of your own content at your request, not disclosure of your data to a third party by us, and it is declared to the stores on that basis. We do not share any user data with third parties for their own purposes.