Privacy Policy

1. Our promise

boxlore isn’t meant for monetary gain. It’s a few friends finishing a childhood dream — watching code turn into magic on screens — and sharing a useful podcast app along the way. We collect product analytics so we can see how the app is used and which features work or don’t.

2. How boxlore handles data

Accounts are optional: You do not need an account to use boxlore. You can use the entire app offline as a guest. Your library (subscriptions, downloads, playback progress, and likes) stays stored locally on your device.

If you choose to create an account (Cloud Sync): Accounts exist purely to back up your library and synchronize your subscriptions, listening progress, and playback queue across your devices. Authentication is handled securely via Google Firebase. Our sync servers never store your email address, name, or password — we only identify your sync data with an opaque, pseudonymous user ID.

Analytics can suggest a rough sketch of a listener (for example rough place, device, podcast taste) — not age, gender, or a precise identity. We don’t ask for name or email to use the app. The only way those show up is if you type them into search or AI chat. Please don’t.

Analytics starts with the app. There is no in-app opt-out for PostHog capture. See section 5 for reset and deletion. For a transparent, event-by-event inventory of what leaves your phone, read our open-source Privacy & Analytics Architecture doc.

3. What we collect

App use

Screens, feature taps, settings, rough time spent, lifecycle events, and occasional PostHog surveys (for example NPS). Used to understand adoption and drop dead features (example: Radio was removed after almost nobody used it).

Search and AI onboarding text

Search queries/results and AI onboarding chat (your messages and replies) go to our backend and PostHog. We use this to improve search (catalog APIs lean on exact-word match) and keep AI onboarding relevant (including detecting when someone types a podcast name like a search query). Don’t type personal identifiers here.

Listening

Episode/podcast ids and titles, playback progress, likes, subscriptions, downloads, and related signals — to PostHog and, when requesting recommendations, to our backend. Used for product insight and community charts.

App and device

App version, OS/device details PostHog attaches by default, local hour, analytics ID. PostHog may also derive approximate geo from IP. No GPS tracking in the app.

Crashes

Error events to PostHog; Firebase Crashlytics may also receive crash diagnostics. An older crash-consent toggle is not an effective gate today.

Recommendations, transcripts, briefings

Recommendations can send country, subscriptions, interests, and listening history plus the device UUID. Auto transcript/chapters may send episode ids and audio URLs to our backend (and related PostHog events). Publisher chapters/transcripts are fetched from publisher URLs. Briefings may load from our backend.

User accounts & cloud sync (optional)

If you sign in to sync across devices, the app synchronizes your subscribed show IDs (along with custom RSS feed URLs, so private Patreon/Substack feeds appear on your other devices), your playback progress timestamps, completion states, liked episodes, and your playback queue order. This data is transmitted securely over TLS and stored solely to provide cross-device continuity. As noted above, we do not store your email or name in our sync database, and sync records are never merged with analytics profiles.

Custom RSS, push, install

Custom RSS feeds are fetched directly from the feed host (they see your request). Firebase Cloud Messaging handles push; App Check tokens may protect APIs; Play Install Referrer may be read once for install context. Optional feedback email is only sent if you provide one.

What we don’t collect by design

No required account. No ad-targeting SDK stack, no GPS tracking, and no biometric or financial data. We do not collect names, phone numbers, or passwords. Exception: free-text you type into search or AI chat.

4. Where it goes

• PostHog — product analytics and surveys
• Our backend services — search, AI onboarding, recommendations, auto transcripts/chapters, briefings, and optional user cloud sync
• Google Firebase / Play — user authentication (optional), messaging, App Check, Crashlytics
• Publishers / CDNs / RSS hosts / catalog providers — when you stream, fetch publisher assets, add a feed, or search the catalog

We don’t control every publisher or RSS host you contact through the app.

5. Your controls

No in-app switch disables PostHog today. Older consent UI is not the live gate.

Reset analytics ID

Settings → Privacy → Start a new analytics ID. Future PostHog events use a new ID; past events stay unless you request deletion. Does not wipe your library or rotate the device UUID.

Request deletion

Settings → Privacy → Request deletion → send the email draft with your PostHog ID to support@aswin.cx (or privacy@aswin.cx). That deletes PostHog data for that ID when we process the request — not your on-device library, and not every log held by other processors you contacted.

Cloud sync controls & account deletion

Sign out / Disconnect: You can disconnect your account at any time in Settings → Account. Your device reverts immediately to local-only guest mode, and future changes stay on your phone.

Delete cloud account & sync data: You can permanently delete your cloud account and wipe all stored subscriptions, listening history, and queue records from our servers directly within the app (Settings → Account → Delete Account) or by emailing privacy@aswin.cx. Deletion is immediate and irreversible. For detailed steps and data retention policies, visit our dedicated Account & Data Deletion Page.

Retention

PostHog retention follows our project configuration. On-device library data stays until you clear it or uninstall. Aggregated metrics may outlive individual events. Email us for a specific retention question.

6. Data security & limitation of liability

Our security efforts: We take the protection of whatever data is processed or synced very seriously. We employ industry-standard safeguards — including strong TLS encryption in transit, strict database-level access controls, pseudonymous identification, and zero storage of passwords or email addresses on our sync servers. We put all possible engineering efforts into keeping your data safe, private, and secure.

Security reality & liability waiver: However, no method of transmission over the internet or electronic storage is completely impenetrable or 100% secure. boxlore is provided on an “as is” and “as available” basis, free of charge, without warranties of any kind, whether express, statutory, or implied.

To the maximum extent permitted by applicable law, the creators, maintainers, and contributors of boxlore cannot guarantee absolute security against all unforeseen vulnerabilities, malicious attacks, or third-party processor failures, and disclaim all liability for any direct, indirect, incidental, special, or consequential damages resulting from unauthorized access, system outages, data loss, or reliance on the service.

7. Other notes

boxlore is general-audience. We don’t offer accounts for children. If you think a child typed personal details into search or AI chat, contact us and we’ll take reasonable steps to delete related analytics we control.

We’ll update this page when practices change (see the date above) and reflect major changes in Settings → Privacy where practical.

The Android app is source-available: github.com/boxcreate/boxlore.

8. Contact

Privacy: privacy@aswin.cx

Support / deletion drafts: support@aswin.cx