Privacy Policy

Last updated: October 22, 2026

This policy explains how the Today Box team (“Today Box”, “we”, “us”) handles information when you use our iPhone app, website and beta waitlist. Contact us at contact@todaybox.ai.

Information we collect

• Account information: your email address, account identifier, profile name, avatar and information you choose to add to your profile.
• Google sign-in: if you choose Google, we receive your Google account identifier, email address and basic profile information, such as your name and profile picture. We request only openid, email and profile permissions. We do not request access to Gmail, Google Drive, Google Photos or your contacts.
• Content: photos, Live Photos, audio, text, artwork and contributions you choose to upload or share. Photo-library permission enables features you select; it does not itself publish your library.
• Technical information: service requests, device/browser information, IP addresses and security or error information needed to operate and protect the service.
• Waitlist: your email and signup context, including time, referral page, device/browser, language, timezone and approximate location derived from IP. We use browser storage to remember a successful signup.

How we use information

We use information to authenticate you, maintain your account, create and store your boxes, provide sharing and collaboration, send requested verification codes or beta invitations, answer support requests, prevent abuse and troubleshoot the service. Google sign-in information is used for account authentication and profile functionality, not advertising.

Photo processing and AI features

Features may process photos on your device or send content you choose to use to our servers and processing providers to prepare media, create layouts or backgrounds, moderate content, or transcribe audio. Providers used by our service include Cloudflare, OpenAI, Google and Soniox, depending on the feature. Google account authentication data is not used to train generalized AI or machine-learning models. Google sign-in does not grant access to your Google Photos library.

Sharing and service providers

We use infrastructure and service providers to host the service, store media, deliver email and process requested features. The website is hosted on Vercel; waitlist records and operational notifications use Lark. We disclose information when necessary to comply with law, protect rights and safety, or carry out a business transfer subject to applicable protections. We do not sell Google user data or use it for personalized advertising. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Shared content and media links

Publishing a box or sending an invitation shares information according to the feature you select. Media may be delivered through public object-storage links: anyone with such a link may be able to download the file. Changing a box’s visibility cannot recall copies or links already obtained by others. Only upload and share content you have permission to use.

Storage, retention and security

We retain account and content information while needed to provide the service and its recovery features, and as necessary for security, legal obligations and dispute resolution. Deletion may not immediately remove backup copies or content others have saved. We use access controls and encrypted network connections, but no service can guarantee absolute security. Our providers may process information in countries outside your own.

Delete your account and data in the app

You can request permanent deletion directly in the Today Box app: open your account settings, choose Account and security → Delete account, complete the identity verification shown, and confirm deletion. You do not need to email us to start this process.

After confirmation, normal account access is disabled and a recovery period begins. The app displays the deadline for your account-deletion request. During that period, verify your identity and explicitly cancel deletion if you change your mind; signing in alone does not cancel the request. After the deadline, recovery is no longer available and the service permanently removes your account record, profile and linked sign-in identities, including the Google identity linked to your account, and clears related sessions and account records through its cleanup process.

Your own boxes are permanently cleared and media with no remaining valid references is scheduled for deletion. Contributions already accepted into another person's valid box may remain with account attribution removed. Removing attribution does not make the underlying photo or voice anonymous: it may still identify you. Local works and copies saved on your device are not automatically erased by cloud-account deletion; remove them in the app or your device photo/file storage. Previously downloaded copies held by others cannot be recalled, and public media links may remain readable until the underlying file is removed. Deletion does not guarantee immediate removal from backups; backup copies are removed as backups rotate. The account-deletion deadline is not a guarantee that all backup copies are erased on that date.

Other privacy choices and requests

You can manage photo permissions in iOS Settings, edit your profile, and revoke Google access in your Google Account connections. Revoking Google access does not by itself delete your Today Box account or uploaded content. Use the in-app deletion flow above to delete your account, including its linked Google identity.

If you cannot access the app, want to request deletion of specific Google-associated information or contributed media, or want access, correction or removal from the waitlist, email contact@todaybox.ai. We may verify your identity before acting and will explain any information retained and the reason for retention. Any rights and response requirements under applicable law remain available.

Children

Today Box is not intended for children under 13, or a higher minimum age required in their country. Contact us if you believe a child has provided personal information.

Changes and contact

We will post policy updates here and update the date. For privacy questions or requests, contact contact@todaybox.ai.