Privacy policy
What we collect about you, why, and who else ever sees it.
1. What we collect
Your email and how you sign in; your name, country, city and a short line about your town from your profile; and your delivery address — country, postal code, city, street, apartment and one phone number. We don't collect a second phone number for text messages: SMS alerts are not running yet, and if we turn them on, they will reuse this same address phone rather than ask for another.
2. Where things stand today
Card payments are processed by Stripe: you pay on Stripe's checkout page, and we never see your card details. Until launch, Stripe runs in test mode. Boxcrossing does not yet buy shipping labels or share your address with a shipping provider — that piece is still being built. Your delivery address is collected now so it's ready for when labels go live; until then, nothing has been sent to a carrier. “Notify me” works the same way: if you ask to hear when rounds open in your country, that request is recorded, but no automatic email is sent yet when they do. This notice will be updated before any of that changes.
3. Why we collect it
To match you into a round and email you at each step today. Buying your shipping label with it — the reason we ask for a full address rather than just a country — is the next piece we're building (clause 2). We also record the key steps of taking part — signing in, completing your profile, joining or leaving a round, asking to be notified — by your internal account number, never your e-mail, name or address; the events carry only your country and, where relevant, the round you joined or left, to understand where Boxcrossing works and where it doesn't. That is our legitimate interest in running the service. Page views, clicks and recordings of your visit are tied to you only if you accept analytics cookies (see the Cookie notice). When something breaks, we send an error report — what failed, where in our code, and on which page, with e-mail addresses removed — to PostHog so we can fix it; for a signed-in member, an error on our side carries their internal account number, and an error in their browser does so only if they accept analytics cookies. If you join through a friend’s invitation link, we link your account to theirs: the friend who invited you sees your first name and whether your invitation counts, and you see their first name. No other member sees a surname, photo, city or e-mail address through an invitation.
4. Who sees your address
In legible form, nobody but you; for support and disputes, an administrator — every time an administrator looks at it, that access is logged; and, once labels go live (clause 2), the member sending you a parcel, printed on their shipping label and nowhere else. It is stored encrypted and is never shown to another member in the app; our hosting and database providers (clause 5) hold that encrypted blob as infrastructure, and cannot read it without the app's own encryption key.
5. Who we share data with
Six outside services hold or process your data today: Vercel, which hosts the app; Neon, which runs our database in Frankfurt, in the EU; our email provider, which sends your sign-in code and other account email; PostHog, in the EU (Frankfurt), which runs our analytics; Stripe, which processes card payments and receives your email and the payment (test mode until launch); and Cloudflare, whose Turnstile check on the sign-in form makes sure a person, not a bot, is asking for a sign-in code — it sees your IP address and some details of your browser for that check, and sets no advertising cookies. PostHog is set to discard IP addresses. Vercel and Neon see everything in this notice while it passes through or sits in the database, including the encrypted address — that's true of any host and database, for any app. We don't yet share anything with a shipping/label provider (clause 2) — when one goes live, this list is updated first.
6. How long we keep it
Your profile and address are kept for as long as your account is active. You can delete your account yourself, from your profile page: that removes your profile, your delivery address and your sign-in straight away, along with your place in any round you had joined. It happens immediately and cannot be undone. Deleting your account also asks PostHog to delete your analytics history, which PostHog completes within a few days. Payment records are kept as long as accounting rules require. Shipping records don't exist yet (clause 2); once they do, we'll keep them as long as carrier rules require.
7. Your rights
You can see, correct, export or delete your data, or ask any question about it, at any time. Deleting is self-service: your profile page has a Delete account button, and it removes your profile, your address, your sign-in and your place in any round you had joined, immediately and for good. Deleting your account also asks PostHog to delete your analytics history, which PostHog completes within a few days. For anything else — a copy of your data, or a correction you can't make in the app — write to hello@boxcrossing.com.
8. Photographs in the gallery
The gallery shows photographs of parcels members received. We publish one only with the permission of the person who took it. A photograph in the gallery never carries a member's name, only the two countries the parcel travelled between, and before it is stored we remove the file's hidden details, such as the place and the camera it was taken with. If a photograph of yours is in the gallery and you want it gone, write to us at hello@boxcrossing.com, the contact address on the Imprint page, and we will take it down.