Privacy Policy

1.Who we are

Bookshelf (“the app”, “Bookshelf”) is developed and operated by Web House Nepal P. Ltd. (“we”, “us”, “our”), a private limited company registered in Nepal with its office at Sitapaila, Kathmandu, Nepal.

For the purposes of the EU and UK General Data Protection Regulation, Web House Nepal P. Ltd. is the data controller for the personal data described in this policy. Our contact details are in section 16.

This policy applies to the Bookshelf application on Android and iOS, the Bookshelf backend service it connects to, and this website. It does not apply to any third-party website or service you may reach through a link, or to documents you share with other people outside the app.

By creating an account and using Bookshelf, you confirm that you have read and understood this policy.

2.Information we collect

We collect only what the app needs in order to work. There are four categories.

2.1 Information you give us

2.2 The documents you upload

When you upload a file, we store the file itself and information about it: the original filename, a title you can edit, the file type (PDF, DOC or DOCX), the file size, the number of pages, and the date it was added.

Word documents (.doc and .docx) are automatically converted into a PDF so they can be displayed with proper pages on a phone. This conversion happens on our own server using open-source software. Both the original file and the converted copy are stored privately in your account, and both are deleted when you delete the document.

We do not read, index, analyse, mine or profile the contents of your documents, and we do not use them to train any machine-learning or artificial-intelligence system.

2.3 Your reading activity

This is the information that makes the app useful. For each document, we store: the page you are currently on, the total number of pages, your progress as a percentage, when you last opened it, when you last read it, and whether you have finished it.

This data is linked to your account so that your position follows you to any device you sign in on. It is not shared with anyone.

2.4 Technical information collected automatically

• Authentication token — a revocable access token issued when you sign in, stored securely on your device so you do not have to log in every time.
• IP address, device type, operating system version and app version — sent with each request and recorded in our server logs.
• Server and error logs — records of requests to our service, including timestamps and error messages, kept for security, abuse prevention and diagnosing faults.

We do not collect your precise or approximate location, your contacts, your calendar, your microphone or camera input (except a photo you deliberately take for your profile picture), your advertising identifier, or your activity in other apps or websites.

3.What we never do

Stated plainly, so there is no ambiguity:

• We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising as those terms are defined under California law.
• We do not show advertising in the app and do not integrate any advertising network.
• We do not embed third-party analytics or tracking SDKs in the app.
• We do not read the contents of your documents, and our administrators cannot open them. The internal administration tools show only counts and metadata — such as a document's title, size, format and processing status — never the file itself.
• We do not use your documents or reading habits to train AI models.
• We do not transfer your data to data brokers.

4.Device permissions

The app asks for as little as possible, and explains each request when it is made. You can refuse or later withdraw any optional permission in your device settings; the app continues to work, minus that feature.

The app does not request location, contacts, SMS, call logs, microphone, health data or background location, and does not use accessibility services.

5.How we use information, and our legal basis

We use your information for the purposes below and nothing else. Where the EU or UK GDPR applies, the legal basis for each purpose is given.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

6.How your data is stored and protected

Your documents are stored on our server in a private area that is not reachable from the public internet. There is no shareable link and no directory that can be browsed. A file can only be delivered through an authenticated request, and only after the server has verified that the signed-in account is the owner of that specific document.

Our safeguards include:

• Encryption of all traffic between the app and our server using HTTPS/TLS.
• Passwords stored as bcrypt hashes, never in readable form.
• Token-based authentication, with the token held in the device's secure keychain or keystore. You can revoke tokens by logging out or changing your password.
• Ownership checks on every request that touches a document or reading record.
• Server-side validation of every uploaded file's real type and size, independent of what the device claims.
• Rate limiting on sign-in and upload endpoints to slow down automated attacks.
• Access to production systems limited to a small number of authorised staff, for maintenance only.

No system can be guaranteed perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected users without undue delay, and in any case within 72 hours of becoming aware of it where the GDPR requires this.

Please help us keep your account safe: use a password you do not use anywhere else, and tell us immediately at support@webhousenepal.com if you think someone else has access to it.

7.Sharing and disclosure

We do not sell, rent or trade your personal information. We disclose it only in these limited situations:

• Service providers (processors). Companies that host our servers and deliver our transactional email act on our instructions under written contracts, may use the data only to provide their service to us, and must protect it to a standard at least equal to this policy. A current list of our processors is available on request.
• Legal requirements. Where we are required by applicable law, a valid court order or a lawful request from a competent authority, and only to the extent required. We will notify you of such a request unless we are legally prohibited from doing so.
• Protecting rights and safety. Where disclosure is necessary to investigate or prevent fraud, security incidents, or a threat to the safety of any person.
• Business transfer. If Web House Nepal P. Ltd. is involved in a merger, acquisition or sale of assets, your data may transfer to the successor entity. You will be notified before your personal data becomes subject to a different privacy policy, and you will be able to delete your account first.

8.International data transfers

Our service is operated from Nepal, and our servers and service providers may be located in Nepal or in other countries. If you use Bookshelf from the European Economic Area, the United Kingdom or another region with data-transfer restrictions, your personal data may be transferred to and processed in a country that has not been recognised as providing an equivalent level of data protection.

Where that happens, we rely on appropriate safeguards — including Standard Contractual Clauses with our processors — and we apply the protections described in this policy to your data wherever it is held. You may request a copy of the relevant safeguards by writing to us.

9.How long we keep your data

If your account is inactive for 24 consecutive months, we will email you at the address on file before deleting the account and its contents.

10.Deleting your data and your account

10.1 Deleting a single document

Open the document in the app, choose Delete, and confirm. The original file, the converted reading copy and your reading progress for that document are all removed. This cannot be undone.

10.2 Deleting your whole account

You can permanently delete your account and everything in it. There are two routes, and both are free:

1. In the app: Profile → Settings → Account → Delete account, then confirm.
2. From the web: use the request form at bookshelf.webhousenepal.com/delete-account, or email support@webhousenepal.com from the address registered to your account with the subject “Delete my Bookshelf account”.

We complete deletion requests within 30 days and confirm by email when it is done. We may ask you to verify your identity before acting, to make sure someone else cannot delete your library.

11.Your privacy rights

Whatever country you are in, you can ask us to give you a copy of your data, correct it, or delete it. Write to support@webhousenepal.com and we will respond within 30 days.

11.1 If you are in the EEA, the UK or Switzerland

Under the GDPR and UK GDPR you have the right to: access your personal data; have inaccurate data corrected; have your data erased; restrict or object to processing based on legitimate interests; receive your data in a portable, machine-readable format; and withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal.

You also have the right to lodge a complaint with your national data protection authority. We would appreciate the chance to address your concern first.

11.2 If you are in California

Under the CCPA as amended by the CPRA, you have the right to know what personal information we collect and how it is used and disclosed, to request deletion, to request correction, to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. You have the right not to be discriminated against for exercising these rights.

We have not sold or shared personal information in the preceding twelve months, and we do not use or disclose sensitive personal information for purposes other than providing the service. We do not knowingly sell the personal information of anyone under 16.

11.3 If you are in Nepal

Your personal data is protected under the Individual Privacy Act, 2075 (2018), which requires your consent before personal data is collected and used, and gives you the right to obtain and correct data held about you. This policy, and the consent you give when you create an account, are how we meet that obligation.

11.4 Other regions

If your country grants you additional rights over your personal data, contact us and we will honour any right you are legally entitled to exercise.

12.Children's privacy

Bookshelf is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions where that is the applicable age of digital consent without parental authorisation).

If you are a parent or guardian and believe your child has created an account or given us personal data, contact us at support@webhousenepal.com and we will delete the account and its contents promptly. If we become aware that we have collected such data without the required consent, we will delete it.

13.Cookies and this website

The mobile app uses no cookies and no tracking technologies. It stores a login token and a copy of your reading position on your own device so it can work offline; this data never leaves your device except to sync with your account.

This website is a set of static pages. It sets no cookies, runs no analytics and embeds no third-party trackers. Fonts are loaded from Google Fonts, which means Google receives your IP address when the font files are requested; this is necessary to display the page and is not used by us to identify you.

Our web server keeps standard access logs (IP address, time, page requested, browser type) for security, as described in section 9.

14.Third-party services we rely on

These providers act as processors on our behalf and are not permitted to use your data for their own purposes. Document conversion is performed by open-source software running on our own server — your files are not sent to any third-party conversion service.

15.Changes to this policy

We may update this policy as the app changes or the law requires. When we do, we will revise the “Last updated” date at the top of this page.

If a change materially affects how we handle your personal data — for example, if we ever begin collecting a new category of data or sharing it with a new type of recipient — we will notify you in the app or by email before the change takes effect, and where the law requires it, ask for your consent. Continuing to use Bookshelf after a change takes effect means you accept the revised policy.

Previous versions are available on request.

16.How to contact us

For any question about this policy, your data, or to exercise a privacy right, contact us. Please put “Bookshelf privacy” in the subject line so it reaches the right person.

17.Store disclosure summary

This section summarises the same facts in the form used by the app stores, so that what you see here matches what is declared in Google Play's Data safety section and Apple's App Privacy labels.

All data listed above is encrypted in transit. You can request deletion of any of it, or of your entire account, as described in section 10.