Privacy

What we collect

• From Discord or Google when you sign in: your account id, email, name, username and avatar (and your Discord banner, if you have one). We keep a Discord refresh token, encrypted, only to keep your Discord picture up to date.
• What you add: your profile, shelves, ratings, links, socials, uploads, asks you send and answers you post.
• Visits: to count unique views we store a one-way hash of the visitor’s network address and browser for each day, plus the referring site, country and device type. Raw IP addresses are never stored.
• Anonymous asks: the sender isn’t shown to anyone, but we keep a hashed device id so blocks and rate limits work, and the account id if they were signed in.
• Messages to us: what you send through the contact form, the email to reply to (the one you type, or your account’s if you leave it blank), and a hashed network id that limits how many messages can be sent a day.
• Payments: Tebex sells and bills Boxly purchases as the merchant of record and handles card details, tax and receipts; we only see what you bought and whether it’s active.

Who helps us run it

Discord and Google (only to sign you in), Cloudflare (security and file storage), Tebex (payments, as merchant of record), Spotify and Apple (theme song players and previews), Lanyard (Discord status, only if you use it) and our web host, where the database runs. If enabled, asks are checked by OpenAI’s moderation service before anyone sees them. We don’t sell your data or use it for ads.

Cookies

One sign-in cookie to keep you logged in, and your light or dark mode choice saved in your browser. No advertising or tracking cookies.

Your choices

Download everything we have about your account, or delete your account, anytime in Settings. Deleting removes your box, shelves, asks and stats right away.

Contact

Privacy questions or requests: send us a privacy request