Privacy Policy

When you create or use an account on NEBians, we collect the information needed to operate your account and profile. Depending on how you sign in, this includes your display name, username, email address (and any pending email address awaiting verification), Google or GitHub account identifier if you use social sign-in, or a one-way password hash and hashed six-digit verification or reset codes if you use email sign-in. Passwords and verification codes are never stored in plaintext.

You may optionally add profile, education, and portfolio details such as your role (Student, Teacher, Institution, or Explorer), profile photo, banner, or custom NEBians avatar settings, date of birth, gender, education level and status, program or course, academic term, completion year, subjects, teaching subjects, province, district, linked school or college, headline, skills, open-to preferences, bio, social links, and portfolio entries (courses, work, projects, and achievements).

We also store the content and activity you create on the platform: forum posts, replies, polls and poll votes, uploaded study resources, resource requests, comments on resources and announcements, inline images, voice notes and media attachments, bookmarks, personal notes, Study Space or Canvas boards, and interactions with the Neby AI study assistant. If you connect a personal Bring-Your-Own-Key (BYOK) LLM provider, your API key is encrypted at rest using AES-GCM and only ever shown to you in masked form.

If you apply to verify and claim an educational institution, we collect the applicant contact details (name, role, email, phone, registration number) and supporting verification documents, which are stored in private non-public storage accessible only to authorized staff reviewers. If you buy or sell paid study resources or courses in the Marketplace, we collect payment verification proofs (QR payment screenshots and eSewa, Khalti, Mobile Banking, or ConnectIPS transaction reference IDs) and seller payout account details solely to verify purchases, credit seller balances, and process withdrawals.

NEBians measures post and resource reach, list impressions, and member analytics using first-party signals rather than third-party advertising trackers. In internal analytics and reach tables, viewer and actor identifiers are stored as one-way HMAC-SHA256 keyed tags (with guest viewer tags rotating daily) rather than raw IP addresses or advertising IDs. Coarse device attributes (device class, OS family, browser or app version, and country) power aggregate creator and member insights, while detailed device context in internal security rows is sealed with AES-GCM encryption.

The NEBians Android app requests only the permissions required for its features: network access (INTERNET and ACCESS_NETWORK_STATE) to sync content and support offline caching; notifications (POST_NOTIFICATIONS and Firebase Cloud Messaging tokens) to deliver replies, announcements, and optional new-resource alerts; microphone access (RECORD_AUDIO) exclusively when you actively record a voice attachment in a comment or post composer (never in the background); and local on-device storage (Room database and file cache) for offline reading, notes, bookmarks, and downloaded PDFs.

We use the information we collect to operate, maintain, and improve NEBians: displaying your profile and academic portfolio; hosting and delivering library resources, forum discussions, polls, interactive lessons, NEB and SEE result lookups, and the Nepal Institutions Directory; and powering AI study features such as summaries, quizzes, flashcards, mindmaps, and Ask Neby.

We also use your information to review teacher and institution verification claims, verify marketplace payment proofs and process seller withdrawals, send verification codes and service notifications (respecting quiet hours, daily caps, and your notification preferences), and protect platform security through rate limiting, WAF anti-abuse checks, and community moderation.

We do not sell, rent, or trade your personal information to third parties or advertisers. By default, public profile details such as your display name, username, role and verification badges, photo or avatar, bio, portfolio entries, and public contributions are visible to the community. If you post or comment using the anonymous option, your contribution is shown under an anonymized handle to other members.

If you lock your profile in Settings, your personal details, portfolio entries, statistics, and activity are hidden from non-followers, new followers require your approval, and your profile page is excluded from search engine indexing. Your email address, pending email, password hash, verification code hashes, session tokens, encrypted BYOK API keys, private institution verification documents, and payment proof screenshots or payout details are never shared publicly. We may disclose information only when required by applicable law or valid legal process, or to protect the safety and rights of our members and platform.

We apply technical and organizational safeguards including HTTPS-only transport in production, CSRF and WAF challenge protections, one-way password and verification-code hashing, hashed bearer tokens for web and mobile sessions, AES-GCM encryption at rest for personal LLM keys and internal signal payloads, private filesystem storage for institution verification documents, rate limiting, and restricted staff-only administrative access. However, no method of electronic transmission or storage is 100% secure.

You can edit your profile, role, education details, linked school, social links, and portfolio at any time from Edit Profile. From Settings on Web or Android, you can lock or unlock your profile to control visibility, approve or decline follow requests, toggle inline images in composers, switch new-resource push alerts on or off, manage or remove personal LLM provider keys, change your password, and request or cancel account deletion.

We retain your account data for as long as your account remains active. You can request account deletion directly from Settings on the website or Android app. When you submit a deletion request, your account enters a 30-day grace period during which you may cancel the request at any time to restore normal access.

Once the 30-day window completes, your personal profile, photos, posts, replies, likes, follows, bookmarks, notifications, push tokens, edit history, and poll votes are permanently deleted from our databases. Any study resources or resource requests you uploaded remain in the library so other students do not lose access to educational materials, with all authorship permanently anonymized to "Anonymous". Unreferenced inline content images older than 48 hours are purged automatically.

NEBians is designed for students, educators, and learners aged 13 and above. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete the account and associated data promptly.

We may update this Privacy Policy from time to time as NEBians adds features or updates its practices. We will notify you of significant changes by posting the updated policy on this page and in the app with a revised "Last updated" date.

If you have questions about this Privacy Policy, your personal data, or a privacy request, please contact Consica Labs at support@nebians.consica.com.np.