Privacy Policy

1. The short version

Most privacy policies are long because the site behind them does a lot with your data. This one is long because we would rather explain a simple situation properly than hide it behind boilerplate. The situation is:

• This is a static website. There is no login, no user account, no server-side application and no database of visitors.
• We set no cookies of our own. None.
• Google Analytics is loaded on every page. It is the only thing here that collects anything about you, and you can decline it.
• The contact form does not send us your message — it has no backend. It validates in your browser and then points you at the operator's support channel.
• We never see, and cannot see, your gaming account, balance, deposits or losses.

2. Scope of this policy

This policy covers the website at bonu7.click and nothing else.

It does not cover the bonu7 game platform, its app, its website, or any account you hold with it. That platform is operated by a separate company with its own privacy policy, and it — not us — collects your identity documents, payment details, gameplay records and everything else associated with an account. When you leave this site by following a link, this policy stops applying and theirs begins.

It also does not cover Telegram. If you contact the support or community channel, Telegram's privacy policy and the operator's practices apply to that conversation.

3. What we collect

3.1 Through Google Analytics

Google Analytics 4 (property ID G-YDH0YX5VWR) is loaded on every page of this site. Through it, we receive aggregated reporting that typically includes:

• which pages were viewed, in what order, and for how long;
• approximate geographic location, derived from IP address and generally no more precise than city level;
• device category, operating system, browser and screen size;
• how visitors arrived — search engine, direct, or referring site;
• events such as outbound link clicks and file downloads.

Google processes your IP address to derive that location and to protect against abuse. Google states that IP addresses are not logged or stored in Google Analytics 4 in the way they were in earlier versions. We receive reports, not raw records, and we cannot query Analytics for an individual person.

3.2 Through your web server request

Like every website, serving a page requires our host to receive your IP address, the requested URL, your user-agent string and a timestamp. This is inherent to how the internet works rather than something we chose to collect. Our host may retain standard access logs for a limited period for security and diagnostic purposes. We do not use these logs to build profiles and we do not combine them with Analytics data.

3.3 Through local storage

If you make a choice on the cookie banner, we store a single value in your browser's localStorage recording that choice, so we stop asking. This value never leaves your device and is not readable by us. See section 6.

4. What we do not collect

Being explicit about absences is more useful than listing presences, so:

• No accounts. There is nothing to register for on this site, so there are no usernames, passwords or profiles.
• No email list. We do not run a newsletter and do not collect email addresses for marketing.
• No payment data. We never handle money. There is no checkout, no payment form and no card processing anywhere on this site.
• No identity documents. KYC is performed by the operator inside its app. We never see an ID, a selfie or a bank statement, and you should never send one to us.
• No gaming data. We cannot see whether you registered, what you deposited, what you played or what you won or lost. Affiliate commission is reported to us in aggregate totals only.
• No advertising or retargeting pixels. There is no Meta pixel, no ad network tag and no cross-site tracking script on this site.
• No fingerprinting. We do not use canvas fingerprinting or any similar technique to identify devices.
• No third-party fonts or CDNs. Fonts are self-hosted from this domain, so your browser makes no request to a font provider that would reveal your visit.

5. Google Analytics in detail

We use Analytics for one reason: to see which pages are actually read, so we know where to spend effort. Knowing that the download guide gets ten times the traffic of the about page tells us which one to keep improving. We do not use it for advertising, remarketing or audience building.

5.1 Who processes it

Google LLC and its affiliates act as the data processor. Data may be processed on servers outside India, including in the United States. Google's own privacy policy governs its handling of that data, and Google's Analytics data practices page describes the safeguards it applies.

5.2 How to opt out

You have several options, and all of them work:

• Decline on our banner. We then send a consent signal instructing Analytics not to use storage on your device.
• Install Google's opt-out add-on. Google publishes a browser extension that blocks Analytics across all sites.
• Block it in your browser. Content blockers and privacy-focused browsers block the Analytics script outright. Nothing on this site depends on it, so the experience is identical.
• Use private browsing. This limits persistence across sessions.

We do not treat visitors who opt out any differently, show them additional prompts, or restrict content.

6. Cookies and local storage

We set no cookies of our own. Not for sessions, not for preferences, not for analytics of our own making.

Google Analytics may set its own first-party cookies (typically named _ga and _ga_<id>) to distinguish one visit from another. If you decline on our banner, we signal Analytics to operate without device storage.

We use exactly one item of browser localStorage:

b7-consent

Stores the single word accepted or declined, recording your choice on the cookie banner so we do not show it again. It contains no identifier, is never transmitted anywhere, and is readable only by this site in your own browser. Clearing your browser's site data removes it and the banner will appear again.

7. The contact form

This is the part people most often assume works differently than it does, so it is worth stating clearly.

The contact form on this site has no backend. When you press submit:

1. JavaScript in your own browser checks that the required fields are filled and that the email address is well-formed;
2. if anything is wrong, an inline error appears next to the field;
3. if everything is valid, a confirmation appears with a link to the operator's Telegram support channel;
4. the form clears.

Nothing is transmitted to us and nothing is stored anywhere. What you typed never leaves your browser and is discarded when the form clears or the page is closed. There is no server to receive it, no inbox it lands in, and no database it is written to.

This means two things. First, the form cannot leak your message, because it never travels. Second — and more practically — if you need an actual reply, use the Telegram channel the confirmation points you at, because the form itself does not deliver a message to anyone.

Please do not enter identity documents, payment details, passwords or one-time passwords into any form on this site, or into any message to anyone claiming to represent us. We never need them and we never ask for them.

8. Why we are allowed to do this

India's Digital Personal Data Protection Act, 2023 governs the processing of digital personal data in India. Our position under it is straightforward because we process so little:

Analytics

Processed on the basis of your consent, requested through the banner and withdrawable at any time by the methods in section 5.2.

Server logs

Processed as a technical necessity of serving a web page and for security purposes. They cannot be avoided while still delivering the site to you.

Local storage

Your consent choice is stored to give effect to a preference you actively expressed. It stays on your device.

Where the DPDP Act applies to us as a Data Fiduciary, we handle requests under it as set out in section 12. Where you are covered by another regime such as the GDPR, we will honour equivalent rights in practice — though given we hold no identifiable records, most requests resolve to "we do not have anything about you".

9. Who we share data with

We do not sell, rent or trade personal data. There is no audience-sharing arrangement, no data broker relationship and no advertising co-operative.

Data reaches exactly two categories of third party:

• Google, as our analytics processor, as described in section 5.
• Our hosting provider, which necessarily receives the request that delivers each page and may keep standard access logs.

We may disclose information if compelled by a valid legal process, a court order or a lawful request from a competent authority. In practice, we hold almost nothing that could be disclosed.

Affiliate tracking deserves a specific mention because people reasonably assume it works like retargeting. When you follow one of our links, the operator can attribute a resulting registration to us. That attribution flows to us in aggregate — a count and a commission total. It does not tell us who you are, and we send no personal data about you to the operator.

10. How long anything is kept

Analytics data

Retained by Google according to the property's configured retention window, which is a maximum of 14 months for user-level and event-level data under GA4. Aggregate reporting persists beyond that as summary statistics.

Server access logs

Retained by our hosting provider for a short period, typically measured in weeks, for security and diagnostics.

Your consent choice

Stored on your device until you clear your browser's site data. We cannot delete it for you, and we cannot read it either.

Contact form submissions

Not applicable. Nothing is transmitted or stored. See section 7.

11. Security

This site is served over HTTPS, so traffic between your browser and our host is encrypted in transit. All assets — fonts, scripts, stylesheets and images — are served from this domain rather than from third-party CDNs, which reduces the number of parties who can observe your visit.

Because the site is static and holds no user data, the usual catastrophic outcomes do not apply here: there is no user database to breach, no credentials to steal and no payment data to lose. The strongest privacy control available to a website is not collecting things in the first place, and that is essentially the whole of our security posture.

No transmission over the internet is ever completely secure, and we cannot guarantee absolute security of data in transit.

12. Your rights

Under the DPDP Act, and equivalently under other regimes that may apply to you, you have the right to:

• access a summary of personal data we process about you;
• request correction of inaccurate or misleading data;
• request erasure of your personal data;
• withdraw consent you previously gave;
• nominate another person to exercise your rights in the event of death or incapacity;
• raise a grievance with us, and escalate to the Data Protection Board of India if unresolved.

To raise a grievance about this website, use the contact page. We aim to acknowledge substantive privacy enquiries within two working days.

13. Children

This site is intended strictly for adults aged 18 or over and is not directed at children. We do not knowingly collect data from anyone under 18, and given we collect no identifiable data at all, we have no mechanism to do so.

Real-money gaming by minors is prohibited without exception. If you are a parent or guardian concerned about a minor's access to gambling content, device-level parental controls and content filtering software are considerably more effective than anything a website can implement. We would encourage you to use them.

14. External sites and the operator

This site links to the gaming platform, to an APK download, and to Telegram channels. Following any of those links takes you outside this policy's scope.

The platform operator is a separate data fiduciary. It collects considerably more than we do — necessarily so, because it holds your account: identity documents for KYC, payment details, transaction history, gameplay records, device information and communications with support. All of that is governed by the operator's own privacy policy, which you accept when you register. We are not a party to it, we cannot see any of it, and we cannot exercise your rights against it on your behalf.

We would encourage you to read the operator's privacy policy properly before registering. It is the document that actually matters for your personal data; ours covers a static website that barely collects anything.

15. Changes to this policy

We may update this policy to reflect changes in the site, our tooling or applicable law. The revised version takes effect when published here, and the "last updated" date at the top will change.

If we ever begin collecting something materially new — a mailing list, a working contact-form backend, or an additional third-party script — we will say so prominently rather than quietly amending a clause. Since we have no way to email visitors, prominence on the page is the only honest notification method available to us.

16. How to contact us

For privacy questions, corrections or grievances about this website, use the contact page and select the privacy topic. Bear in mind the form has no backend — the confirmation will direct you to a channel that can actually receive a message.

For anything about your gaming account or your data held by the operator, contact the operator's support channel directly. We cannot access, retrieve, correct or delete anything held there.

Please never send identity documents, payment details, passwords or one-time passwords to us, or to anyone claiming to represent us. We have no use for them and no legitimate reason to ask.