Privacy policy
What we collect about you, why, and who else ever sees it.
1. What we collect
Your email and how you sign in; your name, country, city and a short line about your town from your profile; and your delivery address — country, postal code, city, street, apartment and one phone number. We don't collect a second phone number for text messages: SMS alerts are not running yet, and if we turn them on, they will reuse this same address phone rather than ask for another.
2. Where things stand today
Boxcrossing does not yet take payment, buy shipping labels, or share your address with a shipping or payment provider — those pieces are still being built. Your delivery address is collected now so it's ready for when they go live; until then, nothing has been charged to you and nothing has been sent to a carrier or payment processor. This notice will be updated before any of that changes.
3. Why we collect it
To match you into a round and email you at each step today. Buying your shipping label with it — the reason we ask for a full address rather than just a country — is the next piece we're building (clause 2).
4. Who sees your address
In legible form, nobody but you and, for support and disputes, an administrator — every time an administrator looks at it, that access is logged. It is stored encrypted and is never shown to another member in the app; our hosting and database providers (clause 5) hold that encrypted blob as infrastructure, and cannot read it without the app's own encryption key.
5. Who we share data with
Three outside services hold or process your data today: Vercel, which hosts the app; Neon, which runs our database in Frankfurt, in the EU; and our email provider, which sends your sign-in link and other account email. Vercel and Neon see everything in this notice while it passes through or sits in the database, including the encrypted address — that's true of any host and database, for any app. We don't yet share anything with a payment processor or a shipping/label provider (clause 2) — when either goes live, this list is updated first.
6. How long we keep it
Your profile and address are kept for as long as your account is active. There's no self-service deletion yet — write to hello@boxcrossing.com and we remove either by hand. Payment and shipping records don't exist yet (clause 2); once they do, we'll keep them as long as accounting and carrier rules require.
7. Your rights
You can see, correct, export or delete your data, or ask any question about it, at any time — today, by writing to hello@boxcrossing.com. A self-service page for this is planned but not live yet. Deleting your account removes your profile and address by hand, the same way.