Privacy Policy · boxbox

boxbox is operated by Fortune App Inc. (“we”, “us”), which is responsible for your personal information. This policy explains what data the boxbox app and website collect, how it is used, and the choices you have. The short version: we collect what the product needs to work, we use AI to power coaching features, and we do not sell your data.

What we collect

Account data, when you sign in (for example with Sign in with Apple): an identifier, your name as provided, and email address.
Session telemetry, data recorded from your GPS device during sessions: position, speed, lap and sector times, and, if you connect a heart-rate sensor, heart-rate data.
Apple Health data, only if you allow it: the app reads your heart rate (and, for the optional health summary, active energy) from Apple Health (HealthKit) during a session, shows it on your watch and phone, and keeps it with the session, including the copy of your session archive stored in your account. While “Share sessions live” is on, your live heart rate is shown to the friends watching your session, along with your lap times. Health data is used only for these features. It is never used for advertising, never sold, and never shared with anyone else. Turn it off anytime in the app’s Account screen or in iOS Settings > Privacy & Security > Health, and turn live sharing off on the app’s home screen.
Usage data: analytics events about how the app and site are used (feature usage, device model, app version) and session replays of how screens are used, so we can find what confuses people and fix it. Typed input, health data and friend codes are masked before a replay is recorded. We do not use third-party ad trackers.
Content you share: sessions you choose to share live or with other users, and anything you submit to us directly.
Purchase status: payments are processed by Apple or our payment processor (Stripe); we receive your subscription status so the app can unlock paid features. Your card details never reach our servers.
Device push tokens, if you allow notifications, so we can tell you for example when a friend goes on track. Turn notifications off anytime in your device settings.

How we use it

To run the Service: timing, replay, history, live sharing, and notifications.
To power AI features: session data is processed to generate coaching feedback and insights. We share with AI service providers only what the feature needs.
To improve the product, debug problems, and keep the Service secure.

What we don’t do

We do not sell your personal data.
We do not share it with advertisers or data brokers.
We do not make your sessions public: live sharing happens only with people you invite or give a race code to.

Service providers

We use a small number of providers to operate the Service: hosting, push notifications, analytics, and AI processing. They process data on our behalf and are not permitted to use it for their own purposes. We may also disclose data where the law requires it.

Retention and deletion

We keep your data while your account is active. You can delete your account from within the app, which removes your account and associated data from our systems right away. Session recordings live in tamper-protected storage that refuses deletion for 30 days after a recording is saved, so a recent recording is removed as soon as that window ends, at most 30 days after you delete your account.

Young racers

Motorsport includes young drivers. If you are under the age of majority where you live, use the Service only with a parent or guardian’s consent, and have them manage the account.

Your rights

Subject to the laws that apply to you (including Québec’s Law 25 and, where applicable, the GDPR), you can request access to, correction of, or deletion of your personal data. Contact us and we will respond within a reasonable time.

Changes

We will update this policy as the product evolves; material changes will be indicated by the date above and, when reasonable, an in-app or on-site notice.

Contact

Privacy questions or requests: leo@boxbox.racing.