Last reviewed: October 29, 2026 · Development audit
1. About Boxy AI and this notice
Boxy AI is developed by Ahmad Zubedat. The listed support contact is support@boxyaiapp.com. The mailbox owner confirmed receipt of a forwarded test message in Spam. A manual account-deletion process for real customers has not been established or tested; receipt of email does not establish that deletion is available. See Account Deletion for the current status.
2. Information handled by Boxy AI
The reviewed Development backend stores account and authentication details, inventory, box and item information, usage records, feedback, preferences and relevant billing metadata. Scan images are processed differently from saved inventory and feedback screenshots, as explained below.
3. AI scan photos and recognition results
In the reviewed Development implementation, AI scan photos are transmitted over HTTPS to Google Gemini for recognition. Boxy AI processes the image bytes in request memory and does not persist those scan photo bytes in its database or Supabase Storage. This does not guarantee immediate secure erasure from memory, and it is not a promise about Google's retention.
Structured recognition results, rather than the scan photo bytes, may be temporarily retained for a 24-hour retry-replay window. Inventory saved by the user remains until removed. This retry window is not a general deletion deadline for inventory, screenshots, backups or provider-held data.
4. Feedback screenshots
User-submitted feedback screenshots can be stored in private Supabase Storage. These are persistent support attachments, distinct from AI scan photos processed in request memory. There is no general automatic expiration deadline for attached feedback screenshots. Avoid including sensitive information that is unnecessary for your feedback.
5. Service providers and their processing
- Supabase provides authentication, databases and private storage.
- Google Gemini processes scan images for recognition.
- RevenueCat supports subscription management and billing records.
Google may independently retain submitted content under its applicable policies, including for abuse monitoring. Data use depends on the applicable service terms and provider configuration. We do not promise zero provider retention or unconditional exclusion from AI training. See Google's Gemini API terms and abuse-monitoring policy. The provider settings used in Production have not been comprehensively audited.
6. Retention and removal
Saved inventory remains until removed. The specific retry-replay window above applies to structured recognition results. Other retention durations have not all been verified, including the full lifecycle of audit records, backups and external-provider data. We do not state fixed deletion deadlines for these categories.
General customer account deletion is not currently enabled. Controlled Development testing of the deletion backend does not establish an available public deletion service. Do not assume that uninstalling the app, sending an email or a successful Development test removes customer data.
7. Account questions and subscriptions
Read the Account Deletion page for the current availability and limitations. Deleting a Boxy AI account does not automatically cancel Google Play or Apple subscriptions, erase all external-provider data, or immediately remove every audit record and backup. Subscription cancellation must be managed separately through the store that bills you.
8. Security and verification limits
The audit confirmed HTTPS transmission of scan photos and private storage for feedback screenshots in Development. These observations do not guarantee absolute security or establish all Production and mobile SDK behavior. Never send passwords, one-time codes, recovery codes or private deletion receipt secrets to support.
9. Updates
This notice must be reviewed against Production behavior and the operational request process before final publication. Changes to the verified information will be reflected in the review date and page content.