← BoxAtlas

Privacy Policy

Effective September 1, 2026 · BoxAtlas is operated by ReVu Doc LLC, 6041 S Brightwater Trl, Springfield, MO 65810, USA, [email protected].

What BoxAtlas is

BoxAtlas is a hosted home-inventory service: you print QR labels for storage totes, photograph what is inside, and search the results. A "household" is an account shared by the people you invite.

Information we collect

• Account data: email address, name (optional), phone number (optional, for text-message sign-in), password hash, passkey public keys, sign-in timestamps.
• Inventory data you create: box names, locations, item lists, notes, label numbers, and the photos you upload.
• Billing data: handled by Stripe. We store your Stripe customer and subscription identifiers, plan and status — never card numbers.
• Technical data: IP address and request logs kept for security and rate limiting, retained for up to 30 days; error logs.
• Email delivery events: bounces and complaints from our email provider, kept to avoid mailing addresses that reject our messages.

How photos are processed

Photos are stored per household in access-controlled object storage (Backblaze B2) and are served only to signed-in members of that household through short-lived links. When you (or your household's auto-analyze setting) ask for an analysis, a copy of the photo is sent to our AI provider — Anthropic, and for households past their monthly allowance a vision model hosted on DigitalOcean — solely to produce the item list and description. We do not use your photos to train models, and our providers' API terms prohibit them from doing so. Analyses are stored as editable text in your household; you can delete photos and items at any time (deleted photos sit in your Trash for 30 days, then are removed).

How we use information

• To provide the service: sign-in, sharing within your household, search, label printing, AI analysis.
• To bill you and send transactional email (sign-in links, invitations, trial reminders, payment notices). We do not send marketing email without a separate opt-in.
• To keep the service secure and prevent abuse (rate limits, fraud checks, suppression of bouncing addresses).
• To support you: platform administrators can open a read-only view of a household when you ask for help; every such access is logged.

Sharing

We share data only with the processors needed to run BoxAtlas: DigitalOcean (hosting, database, overflow AI inference), Backblaze (photo and backup storage), Cloudflare (network), Stripe (payments), EmailIt (email), Twilio (text-message codes, if you add a phone number), Anthropic (AI analysis). Each is bound by its own terms and data-processing agreement. We do not sell personal data.

Retention and deletion

Your data is kept while your household exists. A household owner can delete the household in Settings; this removes every box, photo, item and invitation immediately and cancels the subscription. Database backups are retained for 30 days and then expire. Photo storage keeps prior versions for 90 days for disaster recovery, after which they are purged.

Your rights

You can export everything (Settings → Export), correct your details in Settings, and delete your household. Residents of the EU/UK, California and other jurisdictions with privacy laws may have additional rights (access, portability, erasure, objection); email [email protected] and we will respond within 30 days.

Children

BoxAtlas is not directed at children under 13 (16 in the EEA) and we do not knowingly collect their data.

Security

HTTPS everywhere (the .app domain is HTTPS-only), passwords hashed with Argon2id, passkeys (WebAuthn), per-household row-level isolation in the database, encrypted storage at rest, audit logging of administrative actions. No system is perfectly secure; report concerns to [email protected].

Changes

We will post changes here and, for material changes, email household owners at least 14 days before they take effect.