Last updated: September 2026
1. Introduction
This Privacy Policy describes how MyBox ("we", "our" or "the App") collects, uses and protects users' personal data, in compliance with Regulation (EU) 2016/679 (GDPR).
MyBox is an application for cataloguing household items, organised into houses, floors, rooms and boxes.
2. Data controller
The data controller is 123studio.dev.
For any request concerning personal data: privacy@123studio.dev
3. Data collected
3.1 Account data
- Email address and password. The password is managed by Firebase Authentication and is never accessible to us in plain text
- Display name, if provided
- Profile photo, if uploaded
- Account creation date and email verification status
3.2 Content created by the user
- Names, notes and descriptions of houses, floors, rooms, boxes and items
- Identifying photos voluntarily uploaded for items, houses, floors and rooms
- QR codes generated for boxes, which contain only the box identifier
3.3 Sharing data
- The email address of the person the user invites to a house and the role assigned, read-only or edit
- The list of houses shared with the user by others
By inviting someone, the user provides a third party's personal data and must therefore make sure they are entitled to do so.
3.4 Lending data
- The identifier of the user who took or removed an item
- The date the item was taken and the date it was returned
3.5 Technical data
- Authentication and session tokens
- Device and app attestation data generated by Firebase App Check, through Play Integrity on Android, App Attest on iOS and reCAPTCHA v3 on the web, used to verify that requests come from a legitimate installation of the app
- Date and time of last access
MyBox does not use analytics tools, does not track browsing for advertising purposes, does not carry out profiling and does not collect geolocation data.
4. Device permissions
4.1 Camera
Used to take photos of items, houses, floors and rooms and to scan box QR codes. Images are processed only after capture; the scanner's video stream is neither recorded nor transmitted.
4.2 Gallery and photos
Used to select images already on the device and to save generated QR codes.
4.3 Biometrics or device passcode
Used for the optional app lock. Authentication is handled entirely by the operating system: biometric data is never read, transmitted or stored by MyBox, which only receives the result, success or failure.
All permissions are optional and can be revoked from the device settings; the related features will then no longer be available.
5. Data stored on the device
So that it also works without a connection, MyBox stores locally:
- An offline copy of the inventory data, through Cloud Firestore persistence
- A queue of photos awaiting upload, together with their temporary files
- A cache of images already downloaded
- A cache mapping user identifiers to email addresses, used to display names in shares and loans
- App preferences, namely the selected language and whether the biometric lock is enabled
This data stays on the device and is removed on logout or when the app is uninstalled. For the technical storage used by the web version, see the Cookie Policy.
6. Purposes and legal bases
We process data for the following purposes, on the legal basis indicated under Article 6 GDPR:
- Creating and managing the account and providing the service: performance of a contract, point (b)
- Storing and synchronising inventory content: performance of a contract, point (b)
- Sharing a house with other users, at the user's explicit request: performance of a contract, point (b)
- Protecting the account and preventing abuse, through App Check and email verification: legitimate interest in the security of the service, point (f)
- Responding to support requests: legitimate interest, point (f)
- Complying with legal obligations: legal obligation, point (c)
7. Recipients and transfers
Personal data is neither sold nor transferred for commercial purposes. It is processed by:
- Google Ireland Limited and Google LLC, acting as processors, through the Firebase Authentication, Cloud Firestore, Cloud Storage, App Check and Hosting services
- The users with whom the user chooses to share a house, limited to that house's content and according to the role assigned
The Cloud Firestore database is hosted in the European region europe-west1, in Belgium. Some support and security operations may involve a transfer to third countries: in that case the transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission.
8. Retention
Data is retained for the lifetime of the account. When the account is deleted from the Account screen, the profile, content and associated photos are erased; backup copies held by Google's systems are overwritten within the technical timeframes set by the provider.
Content created by the user inside houses belonging to other owners may remain visible to those owners.
9. Security
We adopt appropriate technical and organisational measures: encryption of data in transit via TLS and at rest, authentication managed by Firebase Authentication, server-side security rules restricting access to authorised users only, request integrity verification through App Check, and an optional biometric app lock.
No system is absolutely secure: users remain responsible for keeping their credentials confidential.
10. User rights
Under Articles 15 to 22 GDPR users have the right to:
- Access their personal data
- Rectify inaccurate data, such as name, email, profile photo and content
- Obtain erasure of their data and account
- Restrict processing, or object to processing based on legitimate interest
- Receive their data in a structured format, that is, data portability
- Withdraw consent given, without affecting processing already carried out
Requests should be sent to privacy@123studio.dev. Users may also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, at www.garanteprivacy.it, or with the supervisory authority of their country of residence.
11. Minors
MyBox is not intended for children under 14. We do not knowingly collect data from children of that age; if we become aware of such processing, we delete the data.
12. Changes to this Privacy Policy
We reserve the right to update this Privacy Policy. Material changes will be communicated through the app. The date at the top of the document indicates the latest update.
13. Contact
For any privacy-related questions: privacy@123studio.dev
← Back to index