Last updated 4 October 2026
Privacy policy
Plain words first: we collect very little, show other students only your first name and class, and never use ads or tracking.
What Bithoo is
Bithoo is a marketplace where students in classes 6–12 buy, sell, swap and give away used textbooks and notes with other students of their own school, and where a parent can link to their child's account. This policy explains what personal data the Bithoo app and website use, why, and what choices you have. "We" means Bithoo.
What we collect and why
| Data | Why | Who can see it |
|---|---|---|
| Personal email address | To sign you in with a one-time code | Nobody. We keep only a one-way scrambled code (a keyed hash), never the address itself. Our email provider sees it while sending the code. |
| First name and class | Shown on your listings | Students and the coordinator of your school |
| School | Keeps the marketplace inside one school | Your school's coordinator |
| Admission number | Lets your school confirm you are a student there | Your school's coordinator only |
| School email (optional) | The same | Your school's coordinator only |
| Photo of your school ID card (optional) | The same. Your phone first reads the card to check that your school's name, first name and admission number are on it; this only decides the order in which the coordinator reviews new students, and never approves anyone. | Your school's coordinator only, through a link that works for 5 minutes |
| Listings and their photos | The books you offer | Students and the coordinator of your school |
| Messages (only when messaging is switched on) | Talking to a buyer or seller | The two people in the conversation, and the coordinator if a message is reported |
| Reports | Safety and moderation | Your school's coordinator |
| Parent link and consent status | Letting a parent link to and, where the school asks, approve their child's account | The linked parent and child, and the coordinator |
| School requests sent from this website (school, your name, role, email, optional phone) | To reply to you and set up your school | The Bithoo team only |
We do not use advertising, analytics, tracking or third-party SDKs, we do not build profiles, and we do not sell or share data for marketing. Photos, including the ID card photo, are shrunk and stripped of location and camera details on your phone before upload. The text your phone reads from the ID card is never sent to us; only whether the details matched. Our website sets no cookies and loads nothing from other companies.
Children's data
Most people who use Bithoo are under 18. We collect only what the app needs to work and to keep it a closed school community:
- Other users only ever see a first name and class: never a surname, email address, phone number, photo of the person or address.
- Phone numbers, email addresses, links and similar contact details are refused in listings and hidden in messages.
- Students can only see students of their own school, and only after the school has approved them.
- Where a school requires it, a parent must link to and approve their child's account.
- We never use children's data for advertising, tracking or behavioural monitoring.
Who we share it with
- Your school's coordinator, as described in the table above.
- Amazon Web Services (Mumbai region, India), which hosts our servers, database and photo storage, and sends sign-in code emails (Amazon SES). AWS processes the data only on our instructions.
- Authorities, only where the law requires it.
We share nothing with anyone else.
How long we keep it
- Your account: until you delete it. Delete it in the app at any time (students: Me → Delete my account; parents: account menu → Delete my account). This removes your name, class, sign-in hash, admission number, school email, ID card photo, listings, photos and parent links, and blanks your messages. A message that is part of an open report is kept only until the coordinator resolves the report.
- ID card photo: deleted as soon as the coordinator approves or rejects you, or after 30 days, whichever is sooner.
- Sign-in codes: expire after 5 minutes.
- School requests: kept while we talk to you and set up your school, then deleted; ask us to delete yours at any time.
- Backups: encrypted database backups are kept for up to 7 days, so deleted data disappears from them within 7 days.
Your rights
You, and a parent for a child, can ask to access, correct or delete personal data, withdraw consent, or nominate someone to act for you. Most of this you can do in the app; for anything else, email us from the address you sign in with. We reply within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.
Security
All traffic is encrypted (HTTPS). Data is stored encrypted in AWS in India. Photos are private and shown only through links that expire within minutes. Staff access is limited to what is needed to run the service.
Contact and grievances
Questions, requests or complaints about privacy: hello@bithoo.in. We will acknowledge a grievance within 48 hours and resolve it within 30 days. See also how we keep students safe.
Changes
We will update this page when anything changes, and tell users in the app about important changes.