Privacy and cookies

Last updated: 28/09/2026

Boncho keeps your receipts and warranties. We collect only what that takes, show no ads and never sell data.

Who runs Boncho

Boncho is a non-commercial personal project. The data controller is Ахмет Ахмедов. For anything about your personal data, write to ahmedovv123@gmail.com.

What we collect

Account: Email, name and photo, if you enter them or sign in with Google or Facebook.
Purchases: What you enter: product, store, date, price, warranty, notes, photos of receipts, warranty cards and products, and the data in the receipt's QR code.
Families: The family's name and its members. Purchases in a family archive are visible to all members.
Handing over a purchase: The buyer's email that the seller enters, and the seller's name that the buyer sees.
Technical data: IP address, browser and request time in server logs, for security and troubleshooting.
Visit statistics: Anonymous: which page was opened, where you came from (for example Reddit), country, device type, browser and operating system. No cookies and no IP address; page addresses are stripped of parameters and purchase ids. A visitor is recognised for 24 hours only, so they aren't counted twice.
Messages to us: The email and text you write in the contact form, and a hash of your IP address for 24 hours, to stop spam.

Why, and on what legal basis

To provide the service you asked for: keeping and showing your purchases and documents (performance of a contract, Art. 6(1)(b) GDPR).
For security and abuse prevention (legitimate interest, Art. 6(1)(f) GDPR).
The buyer's email when a purchase is handed over: the legitimate interest of getting the documents to the new owner. We send them one email with a link, and they decide whether to accept.
Email reminders 30 days before a warranty ends, as part of the service. If you sign up and don't add a purchase, we also send at most two emails, after 3 days and after 10. Turn each kind off with one click from the email or in Settings.
Anonymous visit statistics: the legitimate interest of knowing which pages are used and where people come from, to improve Boncho.
Messages from the contact form: to reply to you (legitimate interest).

We don't use your data for advertising or profiling, and we don't sell it.

Who helps us process it

We use trusted providers that process data only on our instructions:

Clerk

Account, sign-in and families

USA, under the EU–US Data Privacy Framework and standard contractual clauses.

Vercel

Hosting the app, storing files and anonymous visit statistics

Frankfurt, Germany (Vercel Inc., USA)

Neon

Database of purchases

Frankfurt, Germany (Neon Inc., USA)

Resend

Sending emails (handed-over purchases, warranty reminders, first-purchase emails and contact form messages)

USA, under standard contractual clauses.

Cloudflare

Bot protection at sign-in, via Clerk

Global network

How long we keep it

For as long as you have a Boncho account.
A deleted purchase is removed from the database right away, with its files. A file stays only if another purchase uses the same receipt.
Deleting your account removes your personal archive and families where you are the only member.
Database backups may keep deleted data for up to 7 days. Server logs are kept briefly.

Your rights

Access and portability: download your whole archive as a ZIP in Settings.
Correction: edit any purchase at any time.
Erasure: delete a purchase, or your whole account in Settings. A Facebook login can also be removed from Facebook, as described below.
Objection and restriction: write to us at the email above.

You can lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg) or your local authority.

Signing in with Facebook

If you sign in with Facebook, we receive your name, email address, profile photo and an identifier that Facebook assigns to you for Boncho. We use them only to create your account and to recognize you the next time you sign in.

We don't post anything to Facebook, we don't see your friends or posts, and we don't use this data for advertising.

To delete it, delete your account in Settings, or write to the email above. You can also ask from Facebook: Settings and privacy → Settings → Apps and websites → remove Boncho and request data deletion. We then delete the account and the purchases and files that belong only to you. Facebook shows a confirmation code and a link where you can see the result. Shared family archives stay with the other members.

Cookies

We only use cookies that sign-in needs to work and ones that remember your choice. There are no ads, and visit statistics are anonymous and use no cookies, so we don't ask for consent.

Cookie: __session
From: Clerk
Purpose: Short-lived token for the signed-in session
Duration: 1 minute, renewed

Cookie: __client, __client_uat
From: Clerk
Purpose: Keeps you signed in and checks the session is valid
Duration: Until sign-out or the session expires

Cookie: _cfuvid
From: Cloudflare
Purpose: Bot protection at sign-in
Duration: Until the browser closes

Cookie: NEXT_LOCALE
From: Boncho
Purpose: Remembers your language, only if you change it
Duration: 1 year

In the browser's local storage we keep only your chosen theme and whether you dismissed the install prompt.

Changes

If we change this policy in a meaningful way, we'll let you know in the app.