Privacy Policy

Last updated: October 20, 2026

This policy explains what information the Boxes app collects, why, who it’s shared with and what your rights are. We collect only what we need to run Boxes.

1. Who is responsible

The data controller is [Company name, kennitala, address]. Contact us about your data at [contact email].

2. What we collect

• Your phone number, to sign you in with a code sent by text message, and to keep each person to one account.
• The name you choose, shown with gifts you give away.
• Account details: your account ID, the app’s language, your time zone (so new boxes arrive at midnight where you are), and when you accepted the terms.
• Your boxes: which boxes you opened and when, what they held, and your streak.
• Your gifts: the gifts you’ve found, kept, given away or received, whether they’ve been used, and any message you add when giving one away.
• Notifications: if you allow them, a token from Apple or Google that lets us send notifications to your phone.
• Technical information: like any online service, our servers record requests, including your IP address and app version, to keep the service working and secure.

We don’t collect your location, contacts or photos, we don’t use advertising or tracking, and we don’t sell your information. The app uses your phone’s motion sensor only to make the boxes sway when you shake it. That stays on your phone and is never sent to us.

3. Why we use it

• To run Boxes and your account (performing our contract with you): signing you in, your daily boxes, your gifts, giving gifts away, and letting businesses check and redeem them.
• To keep Boxes fair and secure (our legitimate interests): preventing cheating, multiple accounts and abuse, and fixing problems.
• To send notifications, only if you allow them on your phone.
• To meet legal obligations, where the law requires us to keep or share information.

4. Who sees it

• Businesses see a gift’s offer and code when their staff check or redeem it, and totals such as how many of their gifts have been handed out and used. They don’t see your phone number or your name.
• People you give a gift to see your name, your message and the offer.
• Service providers that process data for us:
  • Google Firebase, which sends sign-in codes by text message and delivers notifications on Android;
  • Apple, which delivers notifications on iPhone and stores gifts you add to Apple Wallet;
  • Hetzner Online, which hosts our servers in the EU.

Google may process data outside the European Economic Area. Where it does, it uses safeguards the law recognizes, such as the EU–US Data Privacy Framework or standard contractual clauses.

5. How long we keep it

• We keep your information while you have an account.
• When you close your account in Settings, we delete your boxes, your gifts, your name and your phone number. Gifts you’ve given away stay with the people who have them, together with the name and message you sent with them.
• We keep your account ID and the date you closed your account, so that closing and reopening an account can’t be used to get around the rules of Boxes.
• Server logs are kept for a limited time and then deleted.

6. Your rights

Under the GDPR and Iceland’s Data Protection Act (No. 90/2018) you can ask to see the information we hold about you, have it corrected or deleted, get a copy to take elsewhere, or object to or limit how we use it. You can change your name and close your account yourself in Settings. For anything else, contact us at [contact email]. You can also complain to the Icelandic Data Protection Authority, Persónuvernd (personuvernd.is).

7. Children

Boxes is for people aged 13 and over. If you think a child under 13 has an account, contact us and we’ll delete it.

8. Security

Your information is sent encrypted, and access to it is limited to those who need it to run Boxes.

9. Changes

We may update this policy. If a change matters, we’ll tell you in the app.