Privacy Policy (boxes.dev)

We collect information you provide directly, such as:

• Account information. When you sign in via Google OAuth or Sign in with Apple, we receive basic profile information (such as name, email address, and profile photo, depending on what you authorize).
• Allowlist information. If you are added to an allowlist, we collect your email address and related timestamps.
• Communications. If you contact us, we collect the information you include in your message.

When you access the Service, we and our service providers may collect:

• Device and usage data. Such as IP address, device identifiers, browser type, operating system, app/CLI version, and logs about how the Service is used.
• Diagnostics and operational telemetry. For example, remote-machine heartbeat events, timestamps, and metadata needed to operate the Service, and event data related to active sessions and detected services (like port open/close events and basic protocol guesses such as HTTP/HTTPS).
• Product analytics and session replay. We may collect navigation and interaction events and privacy-masked representations of application screens to diagnose usability problems, screen flicker, animation issues, errors, and performance. Native mobile replay is configured to mask standard text inputs before upload. Replays may include ordinary displayed text, layout, motion, interactions, and other visual elements.

We process metadata required to create and manage remote machines and projects, such as:

• machine identifiers, names, aliases, and timestamps,
• project identifiers and timestamps,
• optional repository metadata you provide (such as a repo URL or default branch/ref),
• local project paths that may be recorded by the CLI (these can sometimes include username or machine path information).

Depending on how you use the Service:

• the CLI stores certain credentials locally on your device (for example, an infrastructure access token you provide),
• we may store and use tokens needed to operate the Service on your behalf (for example, to authorize relay connections and manage remote machines),
• if you upload SSH public keys, we store public keys only (not private keys),
• mobile apps may store authentication tokens in your device's secure storage when available; web apps may use browser storage.

The Service is designed so that most of your repositories, working files, and terminal logs primarily reside on your remote-machine filesystem (hosted by our infrastructure provider). However, certain content may be processed by the Service:

• Session history streaming. If you use session viewing features, session history may be streamed on-demand from files on your remote machine to your client (for example, mobile/web) via our relay. The relay is designed as a pass-through and is not intended to persist the byte stream.
• Small stored snippets for UX. For usability, we may store limited snippets associated with an agent session (for example, the first user message and first assistant message, truncated) and a short, generated one-line session title.

We share information with vendors that help us operate the Service, such as:

• Authentication providers: Google and Apple (for sign-in).
• Backend infrastructure: Convex (authentication, database, and APIs).
• Relay/proxy infrastructure: Cloudflare Workers (to proxy connections between clients and remote machines).
• Push notifications: Expo Push Service (to deliver push notifications; we store push tokens and send notifications that may include short snippets and session identifiers for deep-linking).
• AI processing for titles: OpenAI (to generate a short one-line session title from limited initial messages, as described above).
• Remote-machine hosting provider: Our infrastructure provider (the platform that hosts and runs your remote machines and stores their files).
• Analytics and diagnostics: Amplitude (product analytics and privacy-masked session replay) and Sentry (crash and error reporting).

These providers process information on our behalf subject to contractual confidentiality and security obligations.

We may disclose information if we believe disclosure is reasonably necessary to:

• comply with law or legal process,
• respond to lawful requests,
• protect the rights, safety, and security of boxes.dev, our users, or the public.

If we are involved in a merger, acquisition, financing, due diligence, reorganization, bankruptcy, or sale of assets, information may be disclosed or transferred as part of that transaction.

We disclose information when you instruct us to do so (for example, when you connect third-party tools or services).

You may update certain account details through the Service or through your authentication provider. You can request deletion of your account by contacting us (see "Contact Us").

You can disable push notifications through your device settings. If you disable notifications, we may still send essential administrative messages through other channels (for example, email).

If you are a California resident, you may have rights to request access to, correction of, or deletion of personal information we hold about you, and to receive information about our data practices. To exercise these rights, contact us at the email below. We may need to verify your identity.

Selling/sharing. We do not sell personal information. We also do not share personal information for cross-context behavioral advertising as those terms are defined under California law.