Privacy policy

Stow is operated from Koteshwor, Kathmandu, Nepal. For anything in this policy, including requests about your data, contact us at bookstow7@gmail.com or +977 9815085749.

Only what the app needs to do its job:

• Account details. Your name and email address. Your password is never stored as you typed it — we keep only a one-way cryptographic hash, which cannot be reversed back into your password.
• Your library. The books you save, which shelf each one is on, any rating you give, and the dates you started and finished reading.
• Reading progress. The page numbers you log against a book.
• Feedback you send. If you use Send feedback in the app, we receive your message along with the name and email on your account at that moment, so we can reply.
• Waitlist signups. If you join the waitlist before launch, we collect your email address and which platform you read on, plus a phone number only if you choose to give one. This list is separate from your account — joining it does not create one — and we use it for nothing but telling you the app is available. Ask us and we will remove you from it.
• Technical logs. Our servers record ordinary request information — IP address, timestamp, which endpoint was called and whether it succeeded. These logs exist to keep the service running and to investigate abuse, and are kept only as long as they are useful for that.

• No advertising identifiers, and no advertising of any kind.
• No advertising or attribution services.
• No precise location. Our analytics infers only an approximate country and region from your IP address; the app never asks your device for GPS or location permission.
• No access to your contacts, photos, files or other apps.
• We never sell or rent your personal information, and we do not share it for anyone else’s marketing.

• To show you your library, on whichever device you sign in from.
• To sign you in and keep you signed in securely.
• To answer feedback and support messages you send us.
• To tell you when the app launches, if you asked us to by joining the waitlist.
• To keep the service working, secure and free of abuse.
• To meet legal obligations where they apply to us.

We do not use your reading history to profile you, and we do not make automated decisions about you.

We keep the list of third parties as short as we can. Today it is:

• Amazon Web Services. Our servers and database run on AWS infrastructure. Your account and library are stored there.
• Sentry. When the app hits an error or crashes, we send Sentry a diagnostic report: what went wrong, where in the code, your device model and the app version, and your account identifier so we can tell whether a fault hit one reader or many. We do not send your name, your email address or the contents of your library, and the app does not record your screen. Deleting your account stops any further reports being linked to you.
• Mixpanel. We send Mixpanel a record of how the app is used — signing in, adding a book, finishing one, sharing a shelf — together with your account identifier, your name and email address, and your device model and app version. Mixpanel also derives an approximate country, region and city from the IP address of the request; we never send your precise location, because we never have it. This data is processed on Mixpanel’s servers in the United States. We use it to understand which features are worth keeping and where our readers are, and for nothing else. Deleting your account deletes your Mixpanel profile with it.
• Open Library. When you search for a book, your search text is sent to openlibrary.org (a project of the Internet Archive) to fetch results. Book covers are loaded directly from their servers, which means your device makes requests to them while you browse. We do not send them your name, email or account identifier.
• Apple. Stow is distributed through the App Store. Apple handles the download and applies its own privacy policy to that transaction, and reports anonymous, aggregated install and crash figures to us — never anything that identifies you.
• Google Play. When Stow reaches the Play Store, Google will handle the download on Android and apply its own privacy policy to that transaction.
• Tally. Our pre-launch waitlist form is built and hosted by tally.so, so what you type into it is stored on their servers on our behalf. The form is embedded on the waitlist page only — no other page on this site, and no part of the app, loads anything from them.

We may also disclose information if the law requires it, or where it is necessary to protect our rights or someone’s safety. We will not do so quietly if we are permitted to tell you.

Our infrastructure is provided by Amazon Web Services and may store and process your information on servers located outside Nepal. Wherever it sits, the protections in this policy travel with it.

We hold your account and library for as long as your account exists. You can delete the whole thing yourself, from inside the app: Profile → Delete account. You will be asked to confirm, and you may optionally tell us why you are leaving. If you can no longer get into the app, our account deletion page explains how to request it by email instead.

Deleting your account permanently erases:

• Your account, including your name, email and password hash.
• Every book on every shelf, with its ratings and dates.
• All of your logged reading progress.

One record survives, and we would rather say so plainly: a deletion receipt containing the email address of the closed account, the reason you gave (if any), the date you joined and the date you left. We keep it so we can recognise a returning signup and learn from why people leave. It contains no name, no library and no password hash. Ask us at bookstow7@gmail.com and we will erase that too.

Feedback you sent us before deleting is kept as a snapshot of the message and the address it came from, so that support conversations remain readable.

You can ask us to give you a copy of your data, correct it, or delete it. Your name is editable in the app, and deletion is a button in the app; for anything else, email bookstow7@gmail.com. We will respond within 30 days. Depending on where you live you may also have the right to complain to a data protection authority.

Passwords are hashed with scrypt using parameters at current OWASP guidance, so they cannot be recovered even by us. All traffic between the app and our servers is encrypted in transit with HTTPS. Sign-in tokens are short-lived, refresh tokens are single-use, and they are held in your device’s secure keystore rather than ordinary app storage.

No system is perfectly secure. If a breach ever affects your personal information, we will tell you and any regulator that must be told, without unreasonable delay.

Stow is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has given us personal information, contact us and we will delete it.

If we change this policy we will update the date at the top of this page. For changes that materially affect how we handle your information, we will give notice in the app before they take effect.