Privacy policy

Version 2.0 · last updated 31 October 2026.

Status of this document

This document is a working draft. It describes how BOXBIRDS works today. It is being reviewed by counsel, and the operator’s company name, registration number and address will be added here. Until then, write to hello@boxbirds.app with any question about it.

Who is responsible

This policy explains how the operator of BOXBIRDS (“BOXBIRDS”, “we”) handles personal data when you use the BOXBIRDS website and apps. We decide how and why this data is used, so we are its “controller”. Write to privacy@boxbirds.app about anything in this policy.

This policy is a notice. You do not have to consent to it to use BOXBIRDS. Where we need your consent for something optional, such as marketing emails or analytics, we ask for it separately.

What we collect

• Account: your name, your email address and your password, which is held by Google, our sign-in provider, and never seen by us. If you sign in with Google or Apple, we receive the name and email address they share. We also keep your role, language and notification settings.
• Contact details: a phone number and a WhatsApp number, if you add them. They stay private until a deal is agreed (on a secure deal, until it is paid) and are then shared with the other side of that deal only.
• Requests, trips and routes: cities, dates, the item category and description, the reward and fees, the handover choices and your notes. These are public on the board, shown with the first letter of your name.
• Deals: offers, the agreed deal summary, handover and delivery confirmations, messages in the deal chat, reports and disputes, and the statements and evidence you add.
• A record of each deal step: the time, your account, the deal, your IP address and the type of your device or browser. We keep it to show who did what and when, to settle disputes and to prevent fraud.
• Payments on secure deals: the amounts, the payment status, refunds and payouts, and Stripe’s reference numbers. You enter your card number on Stripe’s page; we never see it.
• Payouts for carriers: whether payouts are set up, the payout country and the status Stripe reports. Stripe collects and holds your bank details and identity documents; we receive only status information and limited identifiers.
• Partner programme: whether you joined, your referral link, who registered through it and their completed deals.
• Support and mailing lists: the messages you send us, and your name and email address if you join a mailing list.

We do not ask for passport scans or identity documents ourselves, and requests have no address or phone fields. Do not put private information in a public field or a note.

How we use it, and on what basis

We use personal data to:

• create and run your account and sign you in;
• show requests and trips, suggest matches and email you about routes you follow;
• let you agree deals, chat, exchange contact details and confirm handovers;
• take payments and make refunds and payouts on secure deals;
• handle reports, disputes and support requests;
• keep the Service secure, prevent fraud and misuse, and check against sanctions lists;
• meet our legal, tax and accounting obligations;
• run the partner programme;
• send service emails, and marketing only if you chose to receive it.

Where EU or UK data protection law applies, we rely on: the performance of our contract with you (your account and your deals); our legal obligations (tax, accounting, sanctions and lawful requests from authorities); our legitimate interest in keeping the Service safe and preventing fraud, balanced against your rights; and your consent for optional marketing and non-essential cookies, which you can withdraw at any time.

Who we share it with

• The other side of your deal: your first name, the deal details and your messages, and, once the deal is agreed (on a secure deal, once it is paid), your phone number.
• Everyone, on the public board: your requests, trips and routes, with the first letter of your name.
• Service providers that process data on our instructions: Google (Firebase sign-in and the database), Stripe (payments, payouts and the identity checks for payouts), Apple (if you sign in with Apple), our website host, our email delivery provider, and security and content-delivery providers.
• Authorities and others, where the law requires it or where it is needed to protect someone’s safety, prevent fraud or enforce our Terms.
• A buyer of the business, if BOXBIRDS is sold or merged, under this policy.

We do not sell personal data and do not share it for advertising.

Where your data is

Account, request and deal data is stored in Google Cloud Firestore in the europe-west3 region (Frankfurt, Germany). Some providers, including Google, Stripe and our website host, may process data in the United States and other countries. When personal data from the EU or the UK is transferred elsewhere, we rely on an adequacy decision, such as the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.

How long we keep it

• Account and profile: while your account exists. When you delete it, we remove your profile and your sign-in details.
• Deals, deal messages, disputes and the record of each deal step: up to seven years after the deal ends, to deal with claims and meet legal obligations. We keep these even after you delete your account, and use them only for those purposes.
• Payment and payout records: as long as tax and accounting law requires, generally seven years.
• Support messages: up to three years.
• Mailing lists: until you unsubscribe.

Cookies and similar technologies

We use only what the Service needs to work:

• the sign-in tokens issued by Google, kept in your browser’s storage so you stay signed in;
• a small record of whether you have seen the introduction screens;
• cookies Stripe sets on its payment page to process the payment and prevent fraud;
• security cookies our website host or content-delivery provider may set.

Your language comes from the address (/ru/ for Russian), not from a cookie.

We do not use analytics or advertising cookies. If we ever add analytics or other optional cookies, we will ask first where the law requires it, and saying no will not stop you from using BOXBIRDS.

Your rights

Depending on where you live, you may have the right to see the data we hold about you and get a copy, to correct it, to delete it, to restrict or object to how we use it, to take it to another provider, and to withdraw your consent. You can delete your account yourself in your profile. For anything else, write to privacy@boxbirds.app. We answer within 30 days and may ask you to confirm who you are. If you are in the EEA or the UK, you can also complain to your data protection authority.

If you live in California, you can ask what personal information we collect, use and disclose, and ask us to correct or delete it. We do not sell personal information or share it for cross-context behavioural advertising, and we will not treat you differently for using these rights.

Security

Database rules and server checks limit who can read account and deal data: only the people in a deal can see its private details. Card data is handled by Stripe. No system is completely secure. If a breach affects your data, we will tell you and the authorities where the law requires it.

Children

BOXBIRDS is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a child has an account, tell us at privacy@boxbirds.app and we will delete it.

Changes to this policy

We will post any change here with a new date, and tell you about significant changes before they take effect.

The operator’s company name, registration number and address will be published here.