Privacy policy

BoxSeek QR is a home-inventory app from The Mind Factory. You name boxes, list what is inside, photograph items, print a QR label, and later search or scan to find them. This policy does not cover 2StepCheck, SkyView, LEDMAU5, EcoDrive, or other Mind Factory sites.

The two ways to use the app

What leaves your device depends on which inventory you open.

• Cloud account. Free, HOME STARTER, HOME PLUS, and HOME EXTREME use an email and password. Inventory and photos are stored for that household in our cloud database and private file storage, then downloaded to the device so search and scanning work there.
• HOME LOCAL. A one-time purchase in the iOS or Android app. There is no BoxSeek sign-in. The inventory and photos stay on that device. A purchase check is still sent to us and to Apple or Google so the app can confirm the purchase. That check does not upload the inventory.

Information the app collects

We collect the following categories. If you do not use a feature, we do not collect the information that feature needs.

Account and household

• Email address and password, when you create or sign in to a cloud account. The password is handled by our account host. The app does not keep a readable copy of it.
• A sign-in session, stored in the phone’s secure storage or, on the web, in the browser’s local storage. One cloud account is active on one device at a time. Signing in on another device signs the first one out.
• Household name, your role (owner, editor, or viewer), plan, and whether the household is active, in a billing grace period, expired, or read-only.
• Email addresses and roles of people invited to a household, the invitation link, and when that invitation expires. An emailed invitation expires after seven days. An on-phone invitation QR code expires after ten minutes. Each invitation can be used once and can be revoked.

Inventory you enter

• Box names, the place name you type (such as “Garage, top shelf”), notes, and the date you mark a box as checked.
• Item names, quantities, colors, sizes, barcodes, notes, expiry dates, seasons, whether an item is pinned, and temperature limits you set.
• Lending details you type: a person’s name, the date lent, and a return date. The app does not read your phone’s address book.
• Photos you take or add, and text saved from a photo, including labels, words read from the image, and product details you keep (such as a suggested category, brand, visible condition, or rough value range).
• A QR label identifies a box. It does not contain the list of items. Scanning it looks up that box in the inventory already on the device.

The place name is text you type. The app does not use GPS, and it does not turn box names into a map location.

Camera, microphone, and notifications

• Camera. Used only while you photograph an item or scan a box QR code or product barcode. You can refuse the camera and still type items.
• Microphone. Used only when you choose voice search. The app turns speech into search text on that phone. BoxSeek does not upload the recording to its own servers. The phone may download speech files the first time. If the phone’s operating system sends audio to Apple or Google to recognize speech, that step is covered by Apple’s or Google’s privacy policy.
• Notifications. Optional local reminders for expiry dates, borrowed items, seasons, and cold or heat warnings. They are scheduled on the device. We do not collect a push-notification token and we do not send remote marketing pushes.

Photos and on-device reading

Labeling and text recognition can run on the phone. Those results stay on the device unless you save them into an item. Saved items in a cloud household are then stored with that household.

Some builds also include cloud photo description. When you use it, the photo is sent to OpenAI so the app can suggest a name, quantity, color, size, and other visible details. You review those suggestions before they are saved. That request does not include your password or the rest of the household inventory. A build without cloud photo description does not send the photo to OpenAI.

Weather city

If you turn on cold and heat warnings, you search for and choose a city. That search text, and then the latitude and longitude of the city you pick, are sent to Open-Meteo for a forecast. Item names, photos, and your account email are not sent. The forecast is cached on the device, normally for a few hours and no longer than 24 hours. The app does not track your movement.

Purchases

Apple and Google process the payment. We do not receive your card number, bank account, or the store’s full billing address.

• Cloud subscriptions. The app sends a transaction id (Apple) or purchase token (Google), the product id, and an account token that links the purchase to the BoxSeek account. Our server asks Apple or Google whether the subscription is valid, then stores the plan, billing period, store, status, and paid-through date with the household. Apple and Google can also notify that server when a subscription changes. We keep a notification id so the same notice is not applied twice.
• HOME LOCAL. The app sends the Apple transaction id or Google purchase token so our server can ask the store if that one-time purchase is valid. The server answers with the product and status. It does not store that token as a customer profile and does not attach it to an email address. Whether HOME LOCAL is owned is saved on the device. Restoring it uses the same Apple or Google store account. An Apple purchase does not unlock Android, or the other way around.

App update check

The iOS and Android apps send the platform name (“ios” or “android”) to our cloud host to learn whether this version is still allowed to run. That check does not include your account, inventory, or photos. The answer is cached on the device for about a day. The web app does not make this check. HOME LOCAL can continue if the check cannot reach the server.

Technical logs

Our hosting providers may record technical logs such as IP address, time, and the request, to operate and protect the service. The HOME LOCAL purchase check also uses the request IP, in memory and for a short time, only to slow repeated attempts. We do not use these logs to advertise to you, and we do not build an advertising profile from them.

Information we do not collect

• No GPS or other precise device location.
• No contacts, calendar, or photo library scan beyond the photos you choose to add.
• No advertising identifier, and no third-party advertising or analytics SDK in the app.
• No sale of personal information, and no sharing with data brokers or ad networks.

How we use information

• To create and keep your inventory, including search, scan, reminders, labels, and backups you start.
• To sync a cloud household between the devices where that account is signed in, and to enforce the plan’s limits on boxes, items, and members.
• To send an invitation email when an owner asks us to, and to let the invited person join that household.
• To verify a purchase with Apple or Google and to show the correct plan.
• To describe a photo when you use cloud photo description, and to fetch a weather forecast when you choose a city.
• To tell the app if a required update is available.
• To protect accounts and the service, including limiting repeated purchase checks and keeping household data available only to its members.

We do not use your inventory to train a public model, and we do not use it for advertising.

Who we share information with

We share information only as described here. The types of parties are: a cloud hosting and account provider, an email delivery provider, the app stores that process payments, an AI provider when cloud photo description is used, a weather provider when you choose a city, the phone platform for on-device speech and photo reading, and people you choose to invite or share with.

Service providers process the information above so they can perform that service. We do not allow them to sell it. Their own privacy terms also apply to processing they perform: Supabase, Resend, OpenAI, Open-Meteo, Apple, and Google.

We may also disclose information if the law requires it, or to investigate abuse of the service. We do not sell personal information.

How long we keep it

• Cloud inventory, photos, and the account are kept while the account and household exist. Deleting an item, box, or photo in the app removes it from the household, including the cloud copy.
• Invitations are kept until they expire, are used, or are revoked.
• Subscription status is kept while needed to provide the plan and to meet store and accounting duties.
• HOME LOCAL inventory stays on the device until you delete the app’s data, uninstall the app, or replace it with a backup. A backup file remains wherever you saved it. We do not keep a copy of that inventory.
• Weather forecasts and the update-check answer are cached on the device as described above.
• Short-lived photo links used to download a cloud photo expire after a few minutes. The stored photo itself remains until you delete it or the account is deleted.

Your choices

• Use HOME LOCAL if you want the inventory kept on the device. Purchase verification still contacts us and the store.
• Refuse the camera, microphone, or notifications. The related feature will not run; typed inventory still works.
• Skip the weather city, and skip cloud photo description, if you do not want those transfers.
• Edit or delete boxes, items, and photos in the app. Export a spreadsheet or a backup from More.
• Sign out to remove the cloud session from that device. Cancel a subscription in your Apple or Google account settings. Canceling the store subscription does not by itself delete the inventory.
• Use Delete my data on the contact form, from the account address, to ask for a copy of the cloud account data, a correction, or deletion. There is no separate delete-account button in the app today. If you own a household, deletion removes that household’s inventory and photos. If you are only a member, we remove your membership. We may retain subscription records the stores or the law require us to keep.

Depending on where you live, including Canada, the EEA, the United Kingdom, and California, you may have rights to access, correct, delete, or receive a copy of personal information, and to complain to a privacy regulator. We will not discriminate against you for making a request. We do not sell or share personal information as those words are used in the California Consumer Privacy Act.

Children

BoxSeek QR is a household storage tool for adults. It is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, email hello@themindfactory.com and we will delete it.

Security

Cloud traffic uses HTTPS. Photos for a cloud household are stored in a private bucket, and database access is limited to members of that household. Sessions on the phone are kept in secure storage. No method of storage or transmission is perfectly secure.

Where information is handled

The Mind Factory is in Canada. Supabase, Resend, OpenAI, Apple, and Google may process information in the United States and other countries where they operate. Open-Meteo receives only the city search and coordinates described above.

Changes

If this policy changes, we will update this page and the effective date. Continued use of BoxSeek QR after the new date means the updated policy applies. A change that materially expands how we share information will be reflected on this page before that sharing begins.

Contact

The Mind Factory
hello@themindfactory.com
themindfactory.com/contact
BoxSeek QR

Ask privacy questions about BoxSeek QR at the email above, or use Delete my data on the contact form. Please include the account email if you have a cloud account, and say whether the request is for access, correction, or deletion.