Privacy policy
What we collect about you, why, and who else ever sees it.
1. What we collect
Your email and how you sign in; your name, country, city and a short line about your town from your profile; and your delivery address — country, postal code, city, street, apartment and one phone number. We don't collect a second phone number for text messages: SMS alerts are not running yet, and if we turn them on, they will reuse this same address phone rather than ask for another.
2. Where things stand today
Boxcrossing does not yet take payment, buy shipping labels, or share your address with a shipping or payment provider — those pieces are still being built. Your delivery address is collected now so it's ready for when they go live; until then, nothing has been charged to you and nothing has been sent to a carrier or payment processor. Waitlist notifications work the same way: if you join a round's waitlist or subscribe for updates, that interest is recorded, but no automatic email is sent yet when a spot opens. This notice will be updated before any of that changes.
3. Why we collect it
To match you into a round and email you at each step today. Buying your shipping label with it — the reason we ask for a full address rather than just a country — is the next piece we're building (clause 2).
4. Who sees your address
In legible form, nobody but you and, for support and disputes, an administrator — every time an administrator looks at it, that access is logged. It is stored encrypted and is never shown to another member in the app; our hosting and database providers (clause 5) hold that encrypted blob as infrastructure, and cannot read it without the app's own encryption key.
5. Who we share data with
Three outside services hold or process your data today: Vercel, which hosts the app; Neon, which runs our database in Frankfurt, in the EU; and our email provider, which sends your sign-in code and other account email. Vercel and Neon see everything in this notice while it passes through or sits in the database, including the encrypted address — that's true of any host and database, for any app. We don't yet share anything with a payment processor or a shipping/label provider (clause 2) — when either goes live, this list is updated first.
6. How long we keep it
Your profile and address are kept for as long as your account is active. You can delete your account yourself, from your profile page: that removes your profile, your delivery address and your sign-in straight away, along with your place in any round you had joined. It happens immediately and cannot be undone. Payment and shipping records don't exist yet (clause 2); once they do, we'll keep them as long as accounting and carrier rules require.
7. Your rights
You can see, correct, export or delete your data, or ask any question about it, at any time. Deleting is self-service: your profile page has a Delete account button, and it removes your profile, your address, your sign-in and your place in any round you had joined, immediately and for good. For anything else — a copy of your data, or a correction you can't make in the app — write to hello@boxcrossing.com.