Privacy Policy
Last updated: November 13, 2026
Who we are
BUONO! is made by The Bad Lemon (thebadlemon.com), the data controller for the processing described here. You can reach us at contact@thebadlemon.com.
What BUONO! does
BUONO! lets you scan a book's barcode (its ISBN) or search for a title, and shows you prices for that book from bookshops and marketplaces so you can find the cheapest copy — new or second-hand.
Data that stays on your device
There are no user accounts, no sign-up, no analytics trackers, and no advertising SDKs. Your scan history and your saved list are stored only on your phone, in the app's local storage. They are never uploaded for any purpose other than the price-drop alerts described below, which you opt into. Deleting the app permanently erases this local data.
Price-drop alerts — the one thing we store
If you save a book and allow notifications, the app registers with our server so we can warn you when a saved book gets cheaper. Apart from the ad click ID described further down, this is the only personal data we hold:
| What | Why |
|---|---|
| An anonymous push token issued to your device by Apple or Google | It is the address we send the notification to. It contains no name, email, phone number, or location, and we cannot link it to you. |
| The books you saved — each one's ISBN, its title, and its price at the time you saved it | Once a month we re-check those books' prices and notify you if one dropped; the title lets us name the book in the notification. |
The legal basis for this is your consent (Art. 6(1)(a) GDPR) — you give it by enabling notifications and saving books, and you can withdraw it at any time:
- Remove your saved books in the app, or turn off notifications in your phone's settings — our server copy is deleted on the next sync.
- Delete the app — the token stops working and is automatically removed from our server the next time we try to use it.
Notifications are delivered through Apple Push Notification service (for iPhones) or Google Firebase Cloud Messaging (for Android), acting as delivery providers. Apple's and Google's own terms apply to that delivery step; we send them only the token and the notification text.
Camera access
BUONO! asks for camera permission for one purpose only: reading book barcodes. The camera image is processed on your device in real time to detect the barcode. No photos or video from the camera are recorded, saved, or transmitted. You can revoke camera access at any time in your phone's settings; you can still search for books by typing the title.
Sharing a Reel, a post or a screenshot
You can share an Instagram or TikTok post, a link, or up to four screenshots to BUONO! to find the books they mention. This only happens when you choose to share something. When you share screenshots, the app shrinks them and sends them to our server, which passes them to Anthropic (the maker of the Claude AI model), acting as our processor, to read the book titles and authors on them. The screenshots are used only for that, are not stored by us, and are not used to train AI models. If one screenshot names a single book by its ISBN, the app opens that book directly and sends no image. When you share a link, our server fetches the post's public caption to read the books it names. We keep the list of books found, so the same post loads faster next time, and a short record of the share (the creator's public @handle, the platform, how many books were found, and your country) to see which posts readers share. None of this identifies you.
Price lookups and search
To show you current prices, the app requests price information for the book you scanned or the words you type into search. These requests contain the book's ISBN (or your search text) and your device's region — the country set in your phone's settings, such as “GB” or “IT” — which we use only to pick the right local shops and currency. They never include your name, your precise location, or your scan history. Our own server code does not log or store your IP address; it exists only to route the request back to you (the one time we pass it on is described in the next section). Our hosting provider, Render, automatically keeps standard infrastructure-level HTTP request logs (which include IP addresses) for every request, to keep the service running and secure. Render retains these logs for a limited window — 7 to 30 days depending on our hosting plan — and then deletes them. We do not read these logs to identify you, and we do not use them to build any profile.
If you installed BUONO! from a Google ad (Android)
We advertise BUONO! on Google. When someone installs the Android app from one of our Google ads, Google Play gives the app that ad's click ID — a code that identifies the ad click, not you or your phone. The app keeps it on your phone for up to 180 days and sends it to our server when you first open the app and when you open a book. Our server stores it with those anonymous records and reports to Google Ads that the ad led to an install and to a book view, so we can tell whether our advertising reaches people who actually use the app.
- We do not use your phone's advertising ID or any other device identifier.
- We do not tell Google which books you looked at — only that a book was opened.
- For that report, our server passes your IP address on to Google, as Google's interface requires. We do not store it.
- If you installed BUONO! any other way, there is no click ID and none of this applies. It does not apply to the iPhone app.
The legal basis is our legitimate interest in measuring our own advertising (Art. 6(1)(f) GDPR). You can object at any time by emailing us, and we will delete the click ID records linked to your install. Deleting the app removes the click ID from your phone.
When you tap through to a shop
When you choose an offer, we send you to the retailer's or marketplace's own website or app (for example a bookshop, eBay, or a second-hand marketplace). From that moment on, that company's privacy policy applies — we don't control what they collect. Some outbound links may be affiliate links (through affiliate networks such as Awin), meaning the retailer may pay us a small commission on your purchase. This never affects the price you pay, and we pass no personal data to the retailer or the network.
Your rights
Under the GDPR you have the right to access, correct, delete, or receive a copy of your data, to restrict or object to its processing, and to withdraw consent at any time. Because the push token is anonymous, the practical way to exercise deletion is the in-app route above — but you can also email us and we will help. You also have the right to lodge a complaint with your local data protection authority (in Italy, the Garante per la protezione dei dati personali).
Children
BUONO! is suitable for all ages. We collect no personal data beyond what is described above, and none of it identifies anyone — child or adult.
Changes to this policy
If we change how the app handles data, we will update this policy first and clearly note the change here before it takes effect. The core promise stays the same: no accounts, no profile of you, and your scan history stays on your phone.
Contact
Questions about privacy? Contact us at contact@thebadlemon.com.