Privacy Policy

Boxhound helps you make stashes for your stuff and find it later. Your stashes and items live on your device by default. This page explains what we process when you sign in, use optional cloud backup, store stash photos, or use photo scan.

Account & authentication

Sign-in is handled by Clerk. We do not run our own password system.

On our servers we keep a small account record so authenticated features can work. That typically includes your Clerk user ID, the email associated with your Clerk account, a one way hash of that email, your plan (free or pro), and basic activity timestamps (first seen / last seen). We may also store a pause flag and short reason if an account is suspended for abuse. If you use encrypted cloud photos, we also store a photo encryption key for your account (see below).

Optional cloud backup

If you use cloud backup or restore, we store a copy of the stashes and items you send, tied to your account. That copy can include names, notes, locations, quantities, and local photo path strings. If you have uploaded a cover photo, it also includes an object key that points at the file in our photo storage. You can stop using backup at any time; local data remains on your device.

Stash photos

Stash photos are optional. When you add one, your device uploads it to Cloudflare R2 using a link from our API that expires soon. We do not proxy the image bytes through our servers. Object keys are tied to your account and stash. New uploads are limited in size (currently 1 MB) and stored as stash photos only, not as a general photo library.

New uploads are encrypted on your device before they leave it (AES-256-GCM). Cloudflare stores the ciphertext, not a viewable JPEG. To restore photos on a new device without a separate passphrase, we store a copy of your account's photo master key with your account record. That means we (and anyone with access to our database) could decrypt those files. This is encryption at rest so the storage provider does not see plaintext. It does not hide photos from Boxhound. The key is returned only to you when you are signed in, for example during restore. Older uploads may still be unencrypted JPEGs until replaced.

Stored stash photos are separate from photos you send to photo scan (next section). We do not send your stored stash photos to Google.

AI photo scanning

When you use AI recognition, the photo you submit is sent to our API and processed by Google's Gemini API to suggest items in the image. That scan photo is not the same as a stored stash photo. It is sent in a form the model can read, used only to return suggestions to you, and is not kept as a permanent photo library. We do not use your photos to train our own models, and we do not sell them.

We do not keep uploaded photos as a permanent photo library. For a short period (about 24 hours) we may cache the text recognition result (suggested item names and related metadata) under an idempotency key you provide, so a retry after a network failure does not consume another scan. After that window, those cached results are removed.

Google processes the image to run the model. Their handling of API data is described in Google's Privacy Policy and Gemini / Google AI API terms.

Usage limits & billing status

Free and paid plans include monthly AI scan limits. We store counters for the current month (scans used, any support-granted bonus scans, and capped refunds for photos marked unusable) so we can enforce those limits and show you remaining scans.

Those counters are keyed to a hash of your email when available, so deleting an account and signing up again with the same address does not reset the current month's quota. Past months are purged as newer periods begin.

Security, abuse prevention & support

We apply rate limits to reduce abuse (for example, repeated failed sign-in attempts or excessive API calls). That may involve temporary counters tied to your account or to network identifiers such as IP address.

A small number of developer / support accounts may access account tools (for example plan, scan usage, and pause status) to operate the product and respond to abuse or support requests. Those tools are restricted to designated operator accounts. They are not a photo browser. Stash images live in R2 as ciphertext for new uploads.

Account deletion

When you delete your account, we remove your cloud stashes and items for that user ID, delete your stash photos from R2, clear the photo master key, and ask Clerk to delete the Clerk user. We clear the email from our account record and mark the row deleted.

We retain the email hash (not the email itself) and the current month's scan counters as needed to prevent quota resets through deleting your account and signing up again. We may also retain a pause flag tied to that hash if the account was suspended for abuse. Those records are not used for marketing.

What we do not do

• We do not sell your data.
• We do not use your stashes, stash photos, or scan photos for advertising.
• We do not track you across other apps or sites for ads.
• We do not send stored stash photos to Google or other AI providers.

Third parties

We rely on third parties to run the product. They process data only as needed to provide those services under their own policies:

• Clerk: authentication and account identity
• Vercel: hosting the API and website
• Neon: Postgres database (account records, cloud stashes, usage counters)
• Cloudflare: R2 object storage for optional stash photos (encrypted for new uploads)
• Google: Gemini AI, only for photos you submit to scanning

Cloudflare receives encrypted stash photos for new uploads. Google receives scan photos only when you use AI recognition.

Contact

Questions about this policy: reach out through the contact method published with the Boxhound app listing or project page.