Privacy Policy

Amended 27 September 2026. The Service is now directed to a general audience of learners, adults and children alike, rather than to children alone (Section 7), and the iPhone and iPad application no longer uses accounts or transmits a learning record (Sections 3 and 4). The categories of information collected are otherwise unchanged.

1. Scope and controller

This Privacy Policy governs the collection, use, disclosure and retention of personal information in connection with the nepalibuddy.com website and the Nepali Buddy application for iPhone, iPad and the web (together, the "Service"). References to "we", "us" and "our" are to Nepali Buddy, which determines the purposes and means of that processing.

This Policy does not extend to the Content Studio, a separate access-controlled editorial tool used internally to author and review lesson material. The Content Studio forms no part of the Service, is not made available to the public, and holds no information relating to users of the Service.

2. Information stored on the device

In the course of ordinary use, the Service records learning progress locally so that a session may be resumed. That record comprises:

1. lessons started and completed, together with awards earned;
2. checkpoints within an incomplete lesson;
3. words practised or collected; and
4. application preferences, including whether romanised hints and celebration sounds are enabled.

This record is held in the application's local storage on iPhone and iPad, or in the browser's local storage on the web. The device remains the authoritative copy at all times. Where an account has been created, a duplicate of this record is additionally retained against that account in the manner described in Section 4.

3. Information transmitted by the application

Lesson content, audio and artwork are bundled within the application. No lesson material is streamed or retrieved while a lesson is in progress.

Where a user elects to check for updated lesson material, the application retrieves publicly available lesson data and media from our servers. No learning record, preference or user identifier is transmitted with that request. As with any request made over the internet, our servers and intermediate network providers necessarily receive the technical information required to return a response, including the originating IP address, the time of the request and basic device or client information. Such information is processed solely for the operation and security of the Service.

The application incorporates no advertising software development kit, no analytics software development kit, no tracking pixel and no social media integration. It does not access the microphone, camera, contacts, photograph library or location.

On the web, the remaining transmissions from the device are those arising from authentication and progress synchronisation, which are addressed in Section 4. The iPhone and iPad application makes no such transmission.

4. Accounts and synchronisation

4.1 Authentication

The iPhone and iPad application has no account: it offers no sign-in, and learning records remain on the device. Access to the application on the web requires an account. That account is established and held by an adult, being either an adult learner or, where the learner is a child, a parent or legal guardian, and never by the child. Authentication is effected through Sign in with Apple or through Google. We neither receive nor process any password.

From the relevant identity provider we receive, and retain, the following:

1. an account identifier;
2. the email address released by that provider;
3. a name, where the provider supplies one; and
4. the identity of the provider used.

Where Sign in with Apple is used together with the Hide My Email facility, the address received is an anonymised @privaterelay.appleid.com relay address and the underlying address is not disclosed to us. No permissions are requested from either provider beyond those necessary to establish identity. Authentication records and sessions are maintained on our behalf by Supabase.

4.2 Synchronisation of learning records

An account enables a learning record to be carried between a user's devices. For that purpose, a copy of the record described in Section 2 is retained against the account, comprising lesson identifiers, completion and practice counts, checkpoints and application preferences.

That copy contains no other category of information. In particular it contains no name, no text entered by a child, no handwriting or tracing, and no audio recording. Synchronisation operates by reconciliation rather than replacement: the record held on the device is combined with the record held against the account, and where the account cannot be reached the application continues to operate from the device.

Access is restricted at the record level such that an account may read and write only its own learning record. The retained copy is deleted upon deletion of the account.

A user may sign out from within the application at any time. Requests for deletion of an account should be directed to [email protected].

5. The website

nepalibuddy.com is a static website served by Cloudflare Pages. It sets no cookies and operates no analytics. No third-party analytics service is employed and no third-party script is served from these pages.

Cloudflare processes requests as our hosting provider and maintains standard server logs, including IP addresses, for the purposes of delivery, security and the prevention of abuse. Cloudflare's processing in that capacity is governed by its own commitments as a processor.

6. Notification list

Where an adult submits an email address through the notification form on this website, we retain the address, the date and time of submission, and the two-letter country code derived by Cloudflare from the request. The originating IP address is not retained.

That information is held in Cloudflare KV storage and is used for the sole purpose of sending a single notification upon release of the application. We operate no newsletter. The address is not sold, licensed, disclosed or otherwise made available to any third party, and is not used for any promotional purpose.

An address may be removed at any time, without the provision of any reason, by written request to [email protected].

7. Children

The Service is directed to a general audience of learners, adults and children alike, and is designed so that children may use it, preferably in the company of an adult. No personal information is collected from a child. The Service provides no messaging facility, no user profile, no social feature and no means by which a child may communicate with any other person.

The account constitutes the sole exception and is held by an adult. The authentication interface is intended for completion by an adult, and where the learner is a child, by a parent or legal guardian. At no point is a child invited to create an account or to supply an email address, a name or any other personal detail. The information described in Section 4.1 is that of an adult and is provided knowingly by that adult.

We do not knowingly collect personal information from children under the age of 13, as defined by the United States Children's Online Privacy Protection Act, or from children below the applicable age of digital consent in other jurisdictions. The notification form described in Section 6 is intended for adults only. Where we become aware that an address relates to a child, that address is deleted. Any person who believes that a child has supplied information to us should contact [email protected], and the information will be removed.

8. Processors and disclosures

The following third parties process information in connection with the Service:

1. Cloudflare, which hosts this website, delivers lesson updates and stores the notification list;
2. Supabase, which stores authentication records, sessions and the learning record described in Section 4.2;
3. Apple, which distributes the application and provides Sign in with Apple; and
4. Google, which provides Google authentication where elected.

Activity conducted within the App Store, including downloads and any aggregated reporting made available to us by Apple, is governed by Apple's own privacy policy. Use of a Google account is governed by Google's own privacy policy.

We do not sell personal information and do not share personal information for advertising or for cross-context behavioural advertising.

9. Retention

Authentication records and the associated learning record are retained for the duration of the account and are deleted upon its deletion. Addresses held on the notification list are retained until the notification has been sent or until removal is requested, whichever occurs first. Server logs are retained only for the period necessary for security and operational reliability.

10. Rights of data subjects

Subject to the law of the relevant jurisdiction, an individual may hold rights of access, rectification, portability and erasure in respect of personal information held about them, and a right to object to its processing. The information we hold is limited to an authentication record, the associated learning record and, where applicable, an address on the notification list. Any such request may accordingly be satisfied by disclosure of that information and its deletion.

Requests should be addressed to [email protected] and need not be accompanied by any reason.

11. Amendment

This Policy may be amended from time to time. The date stated at the head of this page reflects the current version. Where an amendment materially alters the categories of information collected or the purposes of processing, that amendment will be stated expressly on this page rather than effected by silent revision.

12. Contact

Enquiries concerning this Policy: [email protected].
All other enquiries: [email protected].