Legal
Confidentiality policy
What we hold, where it sits, and what we deliberately never write down.
Status of this document
This document is a working draft. BOXBIRDS is pre-launch: the operating company is not yet registered, no payments are processed, and identity verification is not yet in place. Where a clause depends on those, it says so plainly rather than leaving a blank. It will be reviewed by counsel and reissued before the service takes money.
What we collect
If you join the mailing list: your name, your email address and whether you said you want to send or to carry. This is stored on this website.
If you create an account: your email address and a password, held by Google as our authentication provider — we never see or store your password. Alongside it we keep a small profile: the name you gave, whether you signed up to send or to carry, your language, and a verification status which today is always "none".
If you post or answer a request: the two cities, the date, the reward, your note, and the first letter of your name. Plus, privately, the link between your account and that request so the board knows whose it is.
Your browser also keeps a small cookie recording whether you chose English or Russian, and the sign-in tokens Google issues so you are not asked for your password on every page.
What we deliberately do not collect
A request has no address field and no phone field. It carries the first letter of your name, never your email address — that is enforced in the code, not left to habit, because the board is public and a public record of where people live is not a thing worth building.
We do not hold payment card details, because no payment passes through BOXBIRDS. We do not hold identity documents, because verification is not yet running.
Analytics
No analytics or advertising tracking is active on this site today. An analytics plugin is installed but is not connected to any account and sends nothing. Before it is switched on you will be asked for consent, and you will be able to refuse without losing access to anything.
Where your data is
Account and request data is held in Google Cloud Firestore in the europe-west3 region — Frankfurt, Germany. Mailing-list entries are held with this website's host. Authentication is handled by Google, which may process sign-in data outside the European Economic Area under its own safeguards.
We do not sell your data, and we do not share it with anyone except the providers named above, who process it on our instructions in order to run the service.
How long we keep it
Mailing-list entries: until you ask us to remove them, or until launch, whichever comes first. Account and profile data: while your account exists. Requests: a completed request is kept, because the other party's ability to point to what was agreed should not disappear when you leave.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Write to privacy@boxbirds.app and we will answer within 30 days. If you are in the EEA or the UK you may also complain to your national data protection authority.
Deleting your account removes your profile and your sign-in credentials. Requests already completed keep the first letter of your name and nothing else identifying, for the reason given above.
The registered data controller will be named here once the operating company exists. In the meantime requests reach a real person at the address above and are answered the same way.