Cubby Box LogoCubby Box
📋 Legal

Privacy Policy

Effective Date: May 13, 2026

Cubby Box, a product of J Wayne Tech LLC (“we,” “us,” or “our”) is committed to protecting the privacy of all users, especially children. This Privacy Policy explains how we collect, use, and protect information when you use the Cubby Box mobile application (“the App”) and related services. We comply with the Children's Online Privacy Protection Act (COPPA) and other applicable privacy laws.

Please read this policy carefully. By using Cubby Box, you agree to the practices described here. If you are a parent or guardian creating an account for your child, this policy explains your rights and our obligations under COPPA.

1. Information We Collect

1.1 Parent and Adult Accounts

When you create a parent or adult account, we collect:

  • Account information: Full name, email address, and password (managed securely through AWS Cognito; we never store your password in plain text)
  • Household information: Household name and configuration settings
  • Subscription and billing: Subscription status and tier. Subscription receipts are validated by RevenueCat (see Sections 7 and 14) which issues entitlements to your account. Payment cards and billing details remain with the Apple App Store or Google Play Store and are not received or stored by Cubby Box.
  • Usage data: How you interact with the App, including features used, items cataloged, and rooms organized

1.2 Children Under 13 (Kid Accounts)

Kid accounts are created exclusively by a verified parent or guardian within an existing household. We are committed to collecting only the minimum information necessary for the App's core features. For children under 13, we collect:

  • Display name: A name chosen by the parent (does not need to be the child's real name)
  • Photos of belongings: Photos taken within the App of items the child is organizing, stored securely within the household
  • Organizing activity: Items cataloged, rooms and containers created, organizing progress, and AI-generated item details
  • Gamification data: Cubby Coins earned, badges unlocked, organizing streaks, and customization choices (avatars, themes, frames)
  • Birthday or age: Used to determine COPPA applicability and to configure age-appropriate features. Date or year of birth is collected; we do not require a full birthdate when only year is needed for age determination.
  • Memory Vault items: Photos and notes a child saves as personal keepsakes within the household. Stored within the household scope and subject to the same access controls as other photos.
  • Clean session photos: Before-and-after photos a child takes during a cleaning session, shared with a parent for review and feedback within the household.

We do NOT collect from children under 13: email addresses, phone numbers, physical addresses, precise geolocation, audio or video recordings, or persistent identifiers used for advertising or behavioral tracking.

1.3 Users Ages 13–17

Users ages 13 to 17 may create standard accounts. While parental consent is not legally required for this age group under COPPA, we encourage parental involvement and provide household tools for parents to manage teen accounts. We collect the same categories of information as adult accounts.

2. Geographic Scope and Applicable Laws

Cubby Box is offered exclusively to residents of the United States and Canada. We do not market, target, or knowingly accept registrations from residents of the European Union, European Economic Area, United Kingdom, or other regions outside the United States and Canada.

All user data is processed and stored in the United States, primarily within Amazon Web Services US regions. By using the App, users in Canada acknowledge cross-border transfer of their personal information to the United States for processing.

This Privacy Policy is designed to comply with applicable United States federal and state privacy laws (including COPPA, the California Consumer Privacy Act and California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, and other comparable state laws) and Canadian federal privacy law (the Personal Information Protection and Electronic Documents Act, PIPEDA).

If you are accessing the App from outside the United States or Canada, please discontinue use. We do not intend to offer the App to residents of other regions.

3. Parental Consent

To create a kid account for a child under 13, a parent or guardian must first create and verify a parent account. The parent then creates the child's kid account from within the household settings.

By creating a kid account, the parent provides verifiable parental consent for the collection of the child's information as described in Section 1.2. Parents maintain full control over their child's account and may review, modify, or delete it at any time through the App's household management settings or by contacting us at support@getcubbybox.com.

We do not require children to provide more personal information than is reasonably necessary to use the organizing and gamification features of the App.

4. How We Use Information

We use the information we collect to:

  • Provide core App functionality: Room and item organization, inventory management, household management
  • Power gamification features: Cubby Coins, badges, streaks, the Cubby Cave rewards store, and kid account progress tracking
  • Enable AI features: Item identification (Cubby Vision) and resale value estimation (Cubby Calculator). See Section 5 for full disclosure
  • Sync data across devices: Keep your inventory and progress consistent across multiple devices within a household
  • Provide customer support: Respond to your questions, troubleshoot issues, and process account requests
  • Improve the App: Understand how features are used to fix bugs and develop improvements (using aggregated, non-identifying data where possible)

We do not use any information for behavioral advertising, and we do not sell personal information to third parties.

5. AI Processing Disclosure

Cubby Box uses Anthropic's Claude AI model to power two features. We are transparent about how your data is used in these features:

5.1 Cubby Vision (Item Identification)

When you photograph an item using Cubby Vision, the photo is transmitted to Anthropic's Claude AI API to identify the item's name, description, category, and condition. The AI processes the photo transiently and returns identification results. Anthropic does not retain, store, or use submitted photos or data for model training.

5.2 Cubby Calculator (Value Estimation)

When you request a resale value estimate, the item's name, description, and condition are sent to Anthropic's Claude AI API. No photos are transmitted for pricing requests. Anthropic processes this information transiently and returns an estimated price range. Anthropic does not retain or use this data for training.

5.3 How AI Results Are Stored

AI-generated results (item names, descriptions, categories, conditions, and value estimates) are saved to our database as part of your item records within your household. You can edit or delete any AI-generated content at any time through the App.

5.4 AI Features Are Optional

Both Cubby Vision and Cubby Calculator are optional features. You can always add items manually and skip AI identification or valuation entirely. AI features are not required to use the core organization features of the App.

6. Photo Storage and Security

Photos taken within Cubby Box are stored in Amazon Web Services (AWS) S3 with AES-256 server-side encryption. Photos are scoped to your household and are only accessible by household members (parents and the kids they've added).

For kid accounts specifically, photos are accessed through time-limited pre-signed URLs, adding an additional layer of access control. Photos are never shared publicly, never used for advertising, and never analyzed for purposes other than the AI features you explicitly initiate.

Deleted content enters a 7-day grace window during which our support team can restore the content if you contact us. After 7 days, content is permanently purged from our active systems. Residual data in encrypted backups is purged within 30 days, completing the deletion.

7. Data Sharing

We do not sell, rent, share, or disclose your personal information to third parties for marketing or advertising purposes.

We share information only with service providers strictly necessary to operate the App. See Section 14 for the full list of third-party service providers and their privacy policies.

We may disclose information if required to do so by law or in the good-faith belief that such action is necessary to comply with a legal obligation or protect our rights.

8. Advertising

Cubby Box does not display behavioral advertising to any users. We do not display any advertisements to children under 13. We do not use tracking cookies, advertising SDKs, or third-party advertising networks in the App.

Cubby Box uses device-local storage (such as AsyncStorage on the device) to maintain app state, session data, and offline functionality. This local storage is not used for cross-service tracking or behavioral profiling and is not shared with any third party.

9. Parental Rights Under COPPA

As a parent or guardian of a child under 13 with a Cubby Box kid account, you have the following rights:

  • Right to Review: You can view all information collected about your child within the App through household management settings.
  • Right to Delete: You can delete your child's account and all associated data through the App's household settings or by emailing support@getcubbybox.com. All data will be permanently deleted within 30 days.
  • Right to Withdraw Consent: You can withdraw your consent at any time by deleting your child's kid account.
  • Right to Refuse Further Collection: You may request that we stop collecting new information for your child without deleting existing data. Contact us at support@getcubbybox.com to make this request.

To exercise any of these rights, contact us at support@getcubbybox.com. We will respond to verifiable parental requests within 30 days.

In addition to in-app access, parents may request a copy of all personal information collected from their child by emailing support@getcubbybox.com. We verify the requester's identity through their authenticated parent account associated with the child. We deliver the data within 30 days of a verified request in a portable format such as JSON or CSV. There is no fee for this service. If the request is large or requires significant assembly time, we may extend the response window once by an additional 30 days and will inform the requesting parent of the extension.

10. Data Retention

  • Active accounts: We retain your data for as long as your account remains active.
  • Deleted accounts: Personal data, items, photos, and records enter a 7-day support-restoration window, are then permanently purged from active systems, and are fully removed from backup storage within 30 days of account deletion.
  • Inactive accounts: Accounts inactive for 24 months or more will be flagged for deletion. We will notify you before taking any action, giving you the opportunity to reactivate.

Operational backups and system logs follow a separate technical retention window (typically 30 to 90 days) and do not contain user-accessible content. Backup data is purged on the same 30-day window as the user-facing deletion guarantee, ensuring deleted personal data does not persist beyond that timeline.

To comply with the legal requirement that children's personal data not be retained indefinitely, Cubby Box also enforces an inactive-account policy. Kid accounts that have shown no activity for 36 consecutive months are flagged for parent notification. If the kid account remains inactive for 60 days after the notification, the kid account is automatically scheduled for deletion. The deletion then follows the same two-stage timeline described in Section 11: a 7-day support-restoration window, followed by permanent purge from active systems, followed by removal from backup storage within 30 days.

11. Account Deletion

You can delete your Cubby Box account at any time from within the App through Settings. Deleting your account starts the deletion process: a 7-day support-restoration window, followed by permanent purge from active systems, followed by removal from backup storage within 30 days.

Parents can delete a child's kid account through the household management settings without deleting the parent account. If you cannot access the App, you may also request account deletion by emailing support@getcubbybox.com.

12. Data Security

We take the security of your data seriously and implement industry-standard safeguards:

  • All data is encrypted in transit using TLS/SSL
  • All data is encrypted at rest using AES-256 encryption
  • Authentication is managed through AWS Cognito with secure password handling
  • Household-scoped access controls ensure users can only access their own household's data
  • We conduct regular security reviews of our systems and infrastructure

While we implement these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify the affected account holder by email within 72 hours of discovery for breaches that are likely to result in significant harm, and within 30 days for other reportable breaches. For breaches that involve a child's data, we will additionally notify the parent or guardian on record.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will notify you through the App and update the effective date at the top of this page.

For any changes that affect the collection or use of children's personal information, we will send an email notice to the parent or guardian on record and, where required by COPPA, obtain fresh verifiable parental consent before implementing the change.

14. Third-Party Service Providers

We share information only with the following service providers, strictly for operating the App:

  • Amazon Web Services (AWS): Cloud infrastructure, authentication (Cognito), database (DynamoDB), file storage (S3), and serverless compute (Lambda). AWS is U.S.-based and operates under strict data processing agreements.
  • RevenueCat: Subscription receipt validation, entitlement management, and subscription analytics. Receives the RevenueCat App User ID and store receipt data. Does not receive payment card or personal billing details.
  • Anthropic: AI processing for Cubby Vision and Cubby Calculator. Data is processed transiently and not retained. See Section 5.
  • Apple and Google: Subscription and payment processing through the App Store and Google Play Store, respectively, subject to their privacy policies.

15. Governing Law

This Privacy Policy is governed by the laws of the State of Texas, United States, without regard to its conflict of law provisions.

16. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

  • Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you.
  • Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
  • Right to Opt-Out of Sale: We do not sell personal information to third parties, so this right does not apply.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

Sensitive Personal Information (SPI): Under the California Privacy Rights Act, the only category of SPI we collect is account login credentials, which are used solely to authenticate your access to the App and are not used for any non-essential purpose. The Right to Limit Use of SPI therefore has no operational effect on our processing, since use is already limited to providing the authentication service you have requested.

To exercise these rights, contact us at support@getcubbybox.com. We will verify your identity before processing any request and respond within 45 days.

17. Privacy Rights Requests From Other US States and Canada

Residents of other US states with applicable privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and others as state laws come into effect) and residents of Canada under PIPEDA may exercise applicable privacy rights through the same contact at support@getcubbybox.com. We will verify your identity in a manner consistent with applicable law and respond within 45 days. Where applicable law provides a longer or shorter response window, we will follow the legally required timeframe.

18. Contact Us

If you have questions about this Privacy Policy, want to exercise parental rights, or need to report a privacy concern, please contact us:

We aim to respond to all privacy inquiries within 5 business days. For COPPA-related requests from parents or guardians, we will respond within 30 days.