Privacy Policy

Alexandre Rémy – Scan Your Boxes
Last updated: May 27, 2026

Thank you for choosing Scan Your Boxes. We are committed to protecting your personal information and your right to privacy. This policy explains what information we collect, how we use it, and what rights you have in relation to it.

If you have questions or concerns, please read this policy carefully. If you disagree with its terms, please discontinue use of the app. For questions, contact us at scanyourboxes@gmail.com.

1. Information We Collect

Information you provide directly:

Name, email address, username, and password when you create an account
Content you add to the app: box names, item names, descriptions, labels, and photographs
Communications you send us (e.g. support requests)

Information collected automatically:

Device information (model, operating system version, language preference)
App usage events (screens visited, features used) — collected via Firebase Analytics
Crash reports and diagnostic data — collected via Firebase Crashlytics
Performance metrics — collected via Firebase Performance Monitoring
Approximate location inferred from your IP address by Firebase Analytics. We do not request or collect GPS or precise device location.

Device permissions we may request:

Camera – to photograph items stored in your boxes
Photo library – to select existing photos for items
Local storage – to save data and images on your device

2. How We Use Your Information

The legal basis for each processing activity under GDPR Art. 6 is indicated in brackets.

To provide and maintain the app and its features [contract performance — Art. 6(1)(b)]
To sync your data across devices (paid subscribers) [contract performance — Art. 6(1)(b)]
To enable box sharing with people you invite [contract performance — Art. 6(1)(b)]
To process and manage your subscription via Apple [contract performance — Art. 6(1)(b)]
To send administrative communications (account, security notices) [legitimate interest — Art. 6(1)(f)]
To prevent fraud, abuse, and unauthorized access [legitimate interest — Art. 6(1)(f)]
To diagnose crashes and improve app stability [legitimate interest — Art. 6(1)(f)]
To understand how features are used and improve the product [legitimate interest — Art. 6(1)(f)]
To comply with legal obligations [legal obligation — Art. 6(1)(c)]

3. Third-Party Services

The app uses the following third-party services that may collect and process your data. Each service is governed by its own privacy policy.

Service	Provider	Purpose	Privacy Policy
Firebase Authentication	Google LLC	Stores and verifies your email address and password	firebase.google.com/support/privacy
Firebase Firestore	Google LLC	Stores your box and item data in the cloud (paid subscribers and sharing guests)	firebase.google.com/support/privacy
Firebase Storage	Google LLC	Stores item photographs in the cloud	firebase.google.com/support/privacy
Firebase Analytics	Google LLC	Collects anonymous usage events, screen views, and approximate location from IP	firebase.google.com/support/privacy
Firebase Crashlytics	Google LLC	Collects crash reports including device model, OS version, and app state	firebase.google.com/support/privacy
Firebase Performance Monitoring	Google LLC	Collects app performance metrics (startup time, network latency)	firebase.google.com/support/privacy
Firebase Remote Config	Google LLC	Delivers remote app configuration; transmits a Firebase installation identifier to Google on each fetch	firebase.google.com/support/privacy
iCloud Drive	Apple Inc.	Optional user-initiated backup of your local database to your personal iCloud Drive	apple.com/legal/privacy
App Store / StoreKit	Apple Inc.	Processes subscription purchases; we never receive or store your payment details	apple.com/legal/privacy

All Firebase services listed above are provided by Google LLC, headquartered in the United States. Your data may therefore be transferred to and processed in the United States. Google LLC participates in the EU–U.S. Data Privacy Framework and uses Standard Contractual Clauses to provide appropriate safeguards for transfers of personal data from the EEA, UK, and Switzerland to the United States, as required by GDPR Art. 46.

4. Sharing Your Information

We do not sell your personal data. We may share it only in these circumstances:

With your consent – when you explicitly authorize sharing
With people you invite – when you share your boxes using an invite token, the invited person gains read access to your box and item data (names, descriptions, photographs) stored in Firebase
Service providers – the third-party services listed in Section 3, acting as data processors under our instructions
Legal compliance – when required by law, court order, or governmental authority
Business transfer – in connection with a merger, acquisition, or sale of assets, with advance notice to you
Protection – to prevent fraud, enforce our agreements, or protect the rights and safety of users

5. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy, or as required by law. When you delete your account, your data is removed from our Firebase systems. Locally stored data (Core Data) is deleted when you uninstall the app. iCloud backups are governed by your own iCloud settings.

6. Security

We implement technical and organizational measures to protect your information, including encrypted transmission (HTTPS/TLS) and Firebase App Check to prevent unauthorized API access. However, no electronic transmission or storage system is 100% secure. We encourage you to use a strong, unique password.

7. Children's Privacy

The app is not directed at children. In the United States, we do not knowingly collect personal information from children under 13 (COPPA). In the EEA and UK, users under the age of 16 require verifiable parental or guardian consent before creating an account, as required by GDPR Art. 8 (individual member states may lower this threshold to a minimum of 13). If you believe a child has provided us with personal data without appropriate consent, please contact us at scanyourboxes@gmail.com and we will delete it promptly.

8. Your Privacy Rights

All users may:

Access, correct, or delete their account information within the app
Request deletion of their data by contacting us at scanyourboxes@gmail.com

EEA, UK, and Switzerland residents (under GDPR) additionally have the right to:

Access a copy of your personal data
Rectify inaccurate data
Request erasure ("right to be forgotten")
Restrict or object to processing
Data portability
Lodge a complaint with your local supervisory authority
Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal (GDPR Art. 7(3))

California residents (under CCPA) additionally have the right to:

Know what personal information is collected and how it is used
Request deletion of personal information
Opt out of the sale of personal information (we do not sell personal information)
Non-discrimination for exercising your rights

To exercise any of these rights, contact us at scanyourboxes@gmail.com.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the revised policy.

10. Contact

Alexandre Rémy
scanyourboxes@gmail.com