Privacy Policy

• What: your boxes (item name, price, category, note, product link, photo), timers, decisions and history, goals and money kept, Pro tools you set up (challenges, return reminders with item name, price and return date, rules, treat allowance, payday buffer, gift budget with the people you buy for, their budgets and what you spent), and settings.
• Why: so the app works. This data is stored only in the app’s storage on your device. We do not receive it unless you turn on backup (see 3), send a Buddy request (see 4) or use Wishlist (see 5).
• Legal basis: not applicable — we do not process this data. Photos are only read from your library or camera after you grant the operating system permission, and stay on the device.
• How long: until you delete it (Me → Delete everything on this phone) or uninstall the app.

• What: email address, the sign-in method you chose (Sign in with Apple, Google, or a one-time email link), a random account ID, and technical sign-in records kept by our authentication service (such as time of sign-in and the IP address used), for security. If you use Sign in with Apple you can hide your real email; we then only see Apple’s relay address. We never receive your Apple or Google password.
• Why: to create and secure your account, send you sign-in and account emails, back up and restore your boxes, and let you use features that need an account (Buddy, Wishlist).
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR); security logs — our legitimate interest in keeping accounts safe (Art. 6(1)(f)).
• How long: while your account exists. When you delete your account, it is erased within 30 days (see Delete your account).

Sign-in and account emails (such as the one-time sign-in link) are sent from nobuybox.monryte.com through our email provider Resend, using its EU sending region. If Resend is unavailable, the same email is sent through the mail server of our hosting provider in Romania (nxtHost). For this they receive your email address and the content of the email (including the sign-in link).

• What: a copy of your boxes, history, goals, Pro tool settings (challenges, return reminders, rules, treat allowance, gift budget) and settings — including the names, prices, notes and links you typed. Photos themselves are not uploaded; the backup only keeps a reference to the file on your phone.
• Why: so you don’t lose your boxes and can move them to a new phone.
• Legal basis: performance of our contract with you (Art. 6(1)(b)).
• How long: while your account exists; erased with your account within 30 days of a deletion request. “Delete everything on this phone” does not delete the backup — deleting your account does.

The backup is stored in the European Union (Frankfurt, Germany) by our hosting provider Supabase. It is encrypted in transit (TLS) and at rest, and database rules only let your own account read or change it. It is not end-to-end encrypted: our staff can technically access it, but only do so when needed to help you at your request, to keep the service secure, or when the law requires it.

• What: for the invite: your display name (if you set one), the first name you give your buddy, a random invite code, its status and dates. For an early-open request: the box name, your optional note (up to 140 characters), when the box unlocks, a random request code, and the answer with its time. If your buddy accepts inside the app while signed in, their account ID is linked to the invite.
• Why: to let a friend you choose approve or refuse opening a strict box early. Your buddy sees your name, the box name, your note and the time left — not the price.
• Legal basis: performance of our contract with you (Art. 6(1)(b)); for your buddy, our legitimate interest in running the feature they agreed to take part in (Art. 6(1)(f)). Your buddy can use the web page without an account.
• How long: invite links expire after 7 days and requests after 24 hours; the records are kept while your account exists and are erased with it. Removing your buddy ends their access.

• What: for you, the owner: your occasions (title, kind, date, message, the surprise and exact-price settings, the first name you choose to show friends, currency) and their items (name, price, optional store link, category, priority, the date you marked it received). When you share an occasion, a long random link code. For friends who open the link: if they reserve (“claim”) an item, we store the item, a random token kept in their browser’s local storage and the time — no name, no account, no email. To protect the pages from abuse, we briefly record the friend’s token and IP address with a timestamp for rate limiting.
• Why: so you can keep gift wishlists and share them with people you choose, and so friends can see what you would like and reserve an item without doubling up. Anyone with the link (nobuybox.monryte.com/w/…) can view the list without an account. They see the first name you chose (never your email), the occasion, your message, the items with a price range (the exact price only if you turn it on) and store links. You only see whether an item is claimed — and only if you turn “surprise” off — never who claimed it.
• Legal basis: performance of our contract with you (Art. 6(1)(b)); for friends’ claims, our legitimate interest in running the feature they chose to use, and for rate limiting, our legitimate interest in keeping the pages secure and available (Art. 6(1)(f)). Friends can use the page without an account.
• How long: occasions and items while your account exists, or until you delete the occasion, which also deletes its items and claims. If you turn a link off, the page shows “no longer available”. A claim is kept until the friend or you remove it, or until the occasion or your account is deleted. Rate-limit records are deleted within 1 hour (a job removes older ones every 15 minutes). Deleting your account deletes all your wishlist data.

Wishlist data is stored in the European Union (Frankfurt, Germany) by Supabase, like the backup, and database rules only let your own account read or change your lists. The friend page loads no third-party scripts, sets no cookies and runs no analytics; it only contacts our database to show the list and record claims.

• What: “Ready” alerts, the weekly recap, the evening check-in, return reminders and the trial reminder are scheduled locally on your phone and never pass through our servers. For Buddy only, we store a push token for your device (with your account ID and platform) to deliver Buddy messages, which contain your buddy’s name and the box name.
• Why: to tell you when a box is ready and to deliver Buddy invitations, requests and answers.
• Legal basis: your consent to notifications, given in the operating system (Art. 6(1)(a)), and performance of our contract (Art. 6(1)(b)). You can turn notifications off in your phone’s settings at any time.
• How long: push tokens are deleted when you sign out, when the device stops accepting notifications, or with your account.

• What: a purchase user ID (random, or your account ID if you are signed in), the product you bought, transaction identifiers and receipts, subscription and trial status, store country and currency. Payments are handled by Google Play or the App Store — we never see your card or bank details.
• Why: to unlock Pro, restore purchases on your devices, handle trials and renewals, and meet our accounting duties.
• Legal basis: performance of our contract (Art. 6(1)(b)); legal obligation for tax and accounting records (Art. 6(1)(c)).
• How long: for as long as your purchase gives you Pro, and afterwards as long as required by tax and accounting law.

• What: events such as “box sealed”, “decided: let go”, “paywall viewed” or “settings changed”, with small technical details (for example the timer length, a money amount when you let something go, the plan viewed), a random install ID that is not linked to your account, app version, platform, language and time. Never the names, notes, links or photos you add, and never your email.
• Why: to understand which parts of NoBuyBox help people and to fix what doesn’t.
• Legal basis: our legitimate interest in improving the app (Art. 6(1)(f)). You can object at any time with one switch: Me → Terms & Privacy → Anonymous usage events. When it is off, nothing more is sent.
• How long: up to 24 months, after which events are deleted or aggregated so that no install can be singled out.

• What: if the app crashes or hits an error: the error and where in the code it happened, app version, device model and operating system, and the random install ID. Before sending, the app removes emails, money amounts, the names you typed and web-address details. Sending your IP address as personal data is disabled.
• Why: to find and fix bugs and keep the app stable and secure.
• Legal basis: our legitimate interest in a working, secure app (Art. 6(1)(f)). The “Anonymous usage events” switch turns crash reports off too.
• How long: up to 90 days in our crash-reporting service (Sentry, EU data region in Germany).

• What: your email address, what you write to us and any details you choose to share.
• Why: to answer you and, for rights requests, to show we handled them correctly.
• Legal basis: our legitimate interest in helping our users (Art. 6(1)(f)); legal obligation for GDPR requests (Art. 6(1)(c)).
• How long: up to 3 years after the conversation ends (the general limitation period for claims in Romania), unless we need it longer to defend a legal claim.

• What: Price Watch is not live yet. Joining the waitlist is recorded only as an anonymous usage event (see 8).
• Why: to know who asked to be told when it launches, inside the app.
• Legal basis: as for usage events.
• How long: as for usage events. Before Price Watch launches we will update this policy to describe how it checks the product links you save.