Privacy Policy

Cubby Box (“we,” “us,” or “our”) is committed to protecting the privacy of all users, especially children. This Privacy Policy explains how we collect, use, and protect information when you use the Cubby Box mobile application (“the App”) and related services. We comply with the Children's Online Privacy Protection Act (COPPA) and other applicable privacy laws.

Please read this policy carefully. By using Cubby Box, you agree to the practices described here. If you are a parent or guardian creating an account for your child, this policy explains your rights and our obligations under COPPA.

1. Information We Collect

1.1 Parent and Adult Accounts

When you create a parent or adult account, we collect:

• Account information: Full name, email address, and password (managed securely through AWS Cognito — we never store your password in plain text)
• Household information: Household name and configuration settings
• Subscription and billing: Subscription status and tier. Payments are processed through the Apple App Store or Google Play Store. We do not collect or store your credit card or payment details directly.
• Usage data: How you interact with the App, including features used, items cataloged, and rooms organized

1.2 Children Under 13 (Kid Accounts)

Kid accounts are created exclusively by a verified parent or guardian within an existing household. We are committed to collecting only the minimum information necessary for the App's core features. For children under 13, we collect:

• Display name: A name chosen by the parent (does not need to be the child's real name)
• Photos of belongings: Photos taken within the App of items the child is organizing, stored securely within the household
• Organizing activity: Items cataloged, rooms and containers created, organizing progress, and AI-generated item details
• Gamification data: Cubby Coins earned, badges unlocked, organizing streaks, and customization choices (avatars, themes, frames)

We do NOT collect from children under 13: email addresses, phone numbers, physical addresses, precise geolocation, audio or video recordings, or persistent identifiers used for advertising or behavioral tracking.

1.3 Users Ages 13–17

Users ages 13 to 17 may have standard accounts created with verifiable parental consent, and we collect the same categories of information as adult accounts.

2. Parental Consent

To create a kid account for a child under 13, a parent or guardian must first create and verify a parent account. The parent then creates the child's kid account from within the household settings.

By creating a kid account, the parent provides verifiable parental consent for the collection of the child's information as described in Section 1.2. Parents maintain full control over their child's account and may review, modify, or delete it at any time through the App's household management settings or by contacting us at support@getcubbybox.com.

We do not require children to provide more personal information than is reasonably necessary to use the organizing and gamification features of the App.

3. How We Use Information

We use the information we collect to:

• Provide core App functionality: Room and item organization, inventory management, household management
• Power gamification features: Cubby Coins, badges, streaks, the Cubby Cave rewards store, and kid account progress tracking
• Enable AI features: Item identification (Cubby Vision) and resale value estimation (Cubby Calculator) — see Section 4 for full disclosure
• Sync data across devices: Keep your inventory and progress consistent across multiple devices within a household
• Provide customer support: Respond to your questions, troubleshoot issues, and process account requests
• Improve the App: Understand how features are used to fix bugs and develop improvements (using aggregated, non-identifying data where possible)

We do not use any information for behavioral advertising, and we do not sell personal information to third parties.

4. AI Processing Disclosure

Cubby Box uses Anthropic's Claude AI model to power two features. We are transparent about how your data is used in these features:

4.1 Cubby Vision (Item Identification)

When you photograph an item using Cubby Vision, the photo is transmitted to Anthropic's Claude AI API to identify the item's name, description, category, and condition. The AI processes the photo transiently and returns identification results. Anthropic does not retain, store, or use submitted photos or data for model training.

4.2 Cubby Calculator (Value Estimation)

When you request a resale value estimate, the item's name, description, and condition are sent to Anthropic's Claude AI API. No photos are transmitted for pricing requests. Anthropic processes this information transiently and returns an estimated price range. Anthropic does not retain or use this data for training.

4.3 How AI Results Are Stored

AI-generated results (item names, descriptions, categories, conditions, and value estimates) are saved to our database as part of your item records within your household. You can edit or delete any AI-generated content at any time through the App.

4.4 AI Features Are Optional

Both Cubby Vision and Cubby Calculator are optional features. You can always add items manually and skip AI identification or valuation entirely. AI features are not required to use the core organization features of the App.

5. Photo Storage and Security

Photos taken within Cubby Box are stored in Amazon Web Services (AWS) S3 with AES-256 server-side encryption. Photos are scoped to your household and are only accessible by household members (parents and the kids they've added).

For kid accounts specifically, photos are accessed through time-limited pre-signed URLs, adding an additional layer of access control. Photos are never shared publicly, never used for advertising, and never analyzed for purposes other than the AI features you explicitly initiate.

When you delete an item, space, or account, associated photos are permanently removed from our storage systems within 30 days.

6. Data Sharing

We do not sell, rent, share, or disclose your personal information to third parties for marketing or advertising purposes.

We share information only with the following service providers, strictly for operating the App:

• Amazon Web Services (AWS): Cloud infrastructure, authentication (Cognito), database (DynamoDB), file storage (S3), and serverless compute (Lambda). AWS is U.S.-based and operates under strict data processing agreements.
• Anthropic: AI processing for Cubby Vision and Cubby Calculator. Data is processed transiently and not retained. See Section 4.
• Apple and Google: Subscription and payment processing through the App Store and Google Play Store, respectively, subject to their privacy policies.

We may disclose information if required to do so by law or in the good-faith belief that such action is necessary to comply with a legal obligation or protect our rights.

7. Advertising

Cubby Box does not display behavioral advertising to any users. We do not display any advertisements to children under 13. We do not use tracking cookies, advertising SDKs, or third-party advertising networks in the App.

8. Parental Rights Under COPPA

As a parent or guardian of a child under 13 with a Cubby Box kid account, you have the following rights:

• Right to Review: You can view all information collected about your child within the App through household management settings.
• Right to Delete: You can delete your child's account and all associated data through the App's household settings or by emailing support@getcubbybox.com. All data will be permanently deleted within 30 days.
• Right to Withdraw Consent: You can withdraw your consent at any time by deleting your child's kid account.
• Right to Refuse Further Collection: You may request that we stop collecting new information for your child without deleting existing data. Contact us at support@getcubbybox.com to make this request.

To exercise any of these rights, contact us at support@getcubbybox.com. We will respond to verifiable parental requests within 30 days.

9. Data Retention

• Active accounts: We retain your data for as long as your account remains active.
• Deleted accounts: All personal data, items, photos, and records are permanently deleted within 30 days of account deletion.
• Inactive accounts: Accounts inactive for 24 months or more will be flagged for deletion. We will notify you before taking any action, giving you the opportunity to reactivate.

10. Account Deletion

You can delete your Cubby Box account at any time from within the App through Settings. Deleting your account permanently removes all personal data, items, photos, and records associated with your account.

Parents can delete a child's kid account through the household management settings without deleting the parent account. If you cannot access the App, you may also request account deletion by emailing support@getcubbybox.com.

11. Data Security

We take the security of your data seriously and implement industry-standard safeguards:

• All data is encrypted in transit using TLS/SSL
• All data is encrypted at rest using AES-256 encryption
• Authentication is managed through AWS Cognito with secure password handling
• Household-scoped access controls ensure users can only access their own household's data
• We conduct regular security reviews of our systems and infrastructure

While we implement these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we commit to notifying you promptly in the event of a data breach that affects your personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will notify you through the App and update the effective date at the top of this page.

For any changes that affect the collection or use of children's personal information, we will send an email notice to the parent or guardian on record and, where required by COPPA, obtain fresh verifiable parental consent before implementing the change.

13. Contact Us

If you have questions about this Privacy Policy, want to exercise parental rights, or need to report a privacy concern, please contact us:

• Email: support@getcubbybox.com
• Website: getcubbybox.com

We aim to respond to all privacy inquiries within 5 business days. For COPPA-related requests from parents or guardians, we will respond within 30 days.