boxie

Privacy policy

Last updated 7 October 2026

This policy explains what Boxie collects, why, and what you can do about it. In short: the planner works without an account, we keep only what's needed to run it, and we don't sell data or show ads.

  1. 1.Without an account

    Your drawer is kept in your browser's local storage and doesn't leave your device. We also remember the language you picked, in a cookie and in local storage. There are no analytics, advertising or tracking cookies.

  2. 2.With an account

    When you sign up we store your name, email address and a hash of your password (never the password itself). If you sign in with Google, we get your name, email address and profile picture from Google. Your drawers are saved to your account so you can open them on any device. Signing in sets a session cookie; each session records the IP address and browser it started from, for security.

  3. 3.Emails

    We send a welcome email after you sign up and, when you ask for it, a link to confirm your address. No newsletters or marketing.

  4. 4.Language

    On a first visit we pick Ukrainian or English from your browser's languages and the country our hosting provider works out from your IP address. The country isn't stored.

  5. 5.Who processes data

    Boxie runs on services that process data on our behalf: Vercel (hosting), MongoDB Atlas (accounts and saved drawers), Resend (emails), Cloudflare (catalog files) and Google (if you sign in with Google). Tips go through Ko-fi, which has its own privacy policy. Some of these providers keep data outside Ukraine and the EU, under their own safeguards.

  6. 6.How long we keep it

    Your account and drawers are kept until you delete them or ask us to. A deleted drawer is gone at once. Sessions expire on their own.

  7. 7.Your rights

    You can see and delete your drawers on My drawers. To get a copy of your data, correct it or delete your account, write to [email protected] from the address on the account; we'll reply within 30 days.

  8. 8.Children

    Accounts aren't meant for children under 13. If you think a child has given us their data, write to us and we'll delete it.

  9. 9.Changes

    If this policy changes, we'll update the date at the top and tell signed-in users about significant changes.