Privacy Policy — BoxNear

1. Information you give us

Account: email address and password (managed by Supabase Auth); optionally your name and a profile photo. If you sign in with Google or Apple, we receive the basic profile fields those providers return.
Store profile (sellers): business name, logo, address, phone number, hours, business information you choose to add.
Listings and content: photos of items, descriptions, prices, pickup windows, pickup location.
Communications: support tickets, messages, and reviews you submit.
Verification documents (sellers): identity and business documents you upload to complete verification. Stored in a private storage bucket accessible only to you and BoxNear reviewers.

2. Information Stripe collects for payouts

To receive paid orders, sellers complete Stripe Connect Express onboarding directly with Stripe. That flow collects your legal name, address, date of birth, tax identifier (SSN or EIN), and bank account information. BoxNear never sees or stores your bank account credentials or full tax identifiers. Stripe returns to BoxNear a Stripe account ID and status flags (charges enabled, payouts enabled, details submitted, outstanding requirements). See Stripe Connect Disclosure.

3. Information collected automatically

Auth events (sign-in / sign-out) with IP address, user agent, and a device hash for security.
Approximate location derived from the address you enter or the location you grant to the app, used to show nearby listings on the map.
App logs and error reports.
Webhook events from Stripe (payment intents, refunds, disputes, account updates).

See Cookie Policy for browser storage details.

4. How we use information

To provide the marketplace: publish listings, match buyers to sellers, process reservations, generate pickup codes, send notifications.
To process payments, refunds, and payouts through Stripe.
To verify identity and eligibility for payouts.
To detect and prevent fraud, abuse, and violations of our policies.
To provide customer support.
To improve the Service.
To comply with law and enforce our agreements.

5. What is public

The following are intentionally visible to other users and to search engines: your store name, logo, city/area, listing photos and descriptions, aggregate ratings and reviews, and store trust indicators. Exact pickup addresses are shown to buyers only after a reservation is confirmed. Reviews you post are attributed to your display name.

6. Who we share information with

Stripe, Inc. — payment processing, Connect onboarding, payouts, dispute handling.
Supabase Inc. — hosted database, authentication, storage, realtime.
Cloudflare, Inc. — hosting, CDN, and DNS.
Mapbox, Inc. — geocoding and interactive maps.
Google / Apple — OAuth sign-in (if you use it) and native app distribution and push notifications.
Buyers and sellers — the other party in a transaction receives the information needed to complete it (buyer name, pickup code; seller name, address, contact).
Law enforcement / legal process — when required by valid legal process or to protect rights, property, or safety.

We do not sell personal information.

7. Email and in-app notifications

We send transactional messages (payment confirmations, new orders, pickup codes, refunds, disputes, follower-based new-listing alerts, low-stock alerts). See Electronic Communications. You can adjust some in-app notifications from your settings; transactional messages tied to money movement or safety cannot be turned off while your account is active.

8. Security

Data is encrypted in transit. Sensitive documents are stored in a private storage bucket with row-level security. Passwords are hashed by Supabase. No system is perfectly secure — please report suspected vulnerabilities to support@boxnear.com.

9. Retention

BoxNear enforces a written data retention schedule with automated deletion. Full category-by-category thresholds — including the 180-day retention for authentication events, the 90-day retention for webhook events, the 7-year retention for financial audit records, and the rules that survive account closure — are published in the Data Retention Policy. An automated retention job runs every 24 hours and permanently deletes rows that have exceeded their configured threshold.

10. Your choices and rights

You have the right to access, correct, export, and delete your personal information, as well as to restrict or object to certain processing. BoxNear operates a formal Data Subject Access Request workflow that lets you submit and track these requests from your account. Standard response time is 30 days.

Access / export: download a machine-readable copy of your account, listings, reservations, reviews, payments, and payouts.
Correction: update inaccurate profile fields directly, or submit a correction request for fields you cannot edit yourself.
Deletion: close your account and delete your personal data, subject to the retention exceptions in the Data Retention Policy (financial records, verification records, and legal-hold records).
Notification preferences: opt out of non-transactional messages from your settings. Transactional messages tied to money movement or safety cannot be turned off while your account is active.

11. Children

BoxNear is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided information, contact us and we will delete it.

12. International users

The Service is operated from and directed to users in the United States. If you access it from elsewhere, you do so on your own initiative and are responsible for compliance with local law.

13. Changes

We will update this policy from time to time. The effective date at the top of this page reflects the latest revision.

14. Contact

Privacy questions: support@boxnear.com.