Last updated: June 21, 2026

1. Data Controller

The data controller is Marco Marani, independent developer of BoxCatalog, available on the App Store.

For any privacy-related request: app@marcomarani.com

2. The principle behind BoxCatalog

BoxCatalog does not have its own server. There is no central database operated by us where your boxes, items, or photos are collected. All the data you create in the app is stored:

• locally on your device, and
• (only if you enable iCloud sync, a Premium feature) in your personal iCloud account, via Apple CloudKit — infrastructure operated by Apple, which we do not have direct access to.

We cannot read, sell, or share the content of your boxes, because it simply never passes through or resides on any server we own.

3. Data processed by the app

3.1 Box and item data

Name, location (free text you type, e.g. “Basement”), color, quantity, and contents of the boxes/items you create. This stays on your device; if you enable Premium sync it is saved to your private iCloud, in an app-dedicated CloudKit zone.

3.2 Photos

Photos attached to boxes and items are compressed and saved in the app’s documents folder on your device. With the Premium version, photos are synced (as CKAssets) to your private iCloud, so they are available across all your devices signed in with the same Apple ID.

3.3 Family Sharing — Premium feature

If you choose to share a box with other people:

• A CKShare (a native Apple CloudKit mechanism) is created and linked to that specific box, inside your private iCloud.
• Invited people access the shared box’s data (name, items, photos) through their own Apple ID, with either read-only (Viewer) or read/write (Editor) permission, as you choose.
• To display the participant list, the app retrieves via CloudKit the name (or email/phone number, depending on what the participant has made visible) associated with their Apple ID. This data comes from Apple, not collected by us.
• You can remove a participant or stop sharing entirely at any time: access is revoked immediately.

3.4 In-app purchases

BoxCatalog Premium is a one-time purchase (no subscription, no renewal). Purchases are handled entirely by Apple via StoreKit: the app only receives a confirmation of the purchase to unlock Premium features. We never see or store your credit card or payment method details — those remain exclusively managed by Apple.

3.5 Device permissions requested

• Camera — to take photos to attach to boxes/items. Requested only when you choose to take a photo.
• Photo Library — to select existing photos. Requested only when you choose to add a photo from your library.
• iCloud — for Premium sync and Family Sharing. Requested only if you enable these features.

You can revoke these permissions at any time from iOS Settings → BoxCatalog.

3.6 QR codes

Each QR code generated by the app contains only an internal unique identifier (UUID) for the box (e.g. catalogoscatole://box/xxxxxxxx). It does not contain names, photos, or other personal data readable by someone who scans the code without the app and permission to view that box.

3.7 What we do NOT collect

BoxCatalog does not use third-party analytics SDKs, does not use advertising SDKs, does not access your contacts, does not use GPS location, and does not build an advertising profile about you.

4. Data recipients

The only third party involved is Apple Inc., as the provider of iCloud/CloudKit (sync, sharing) and StoreKit (in-app purchases) services. Apple’s processing is governed by its own privacy policy: https://www.apple.com/legal/privacy/

5. Data retention and deletion

• Local data remains until you delete the corresponding box/item or uninstall the app.
• Deleting a box in the app automatically deletes its associated photos, both locally and (if synced) from your iCloud.
• Data synced to iCloud stays in your personal iCloud storage, subject to your own Apple settings (Settings → [your name] → iCloud → Manage Storage).
• Stopping a family share immediately revokes participants’ access.

6. Your rights (GDPR)

If you are located in the European Union, you have the right to: access your data, request rectification or deletion, request portability, object to processing, and file a complaint with your national data protection authority.

Since your data lives primarily on your device and in your personal iCloud, you can exercise most of these rights directly: by deleting boxes/items in the app, uninstalling the app, or managing your iCloud from Apple Settings. For any other request: app@marcomarani.com

7. Children

BoxCatalog is not directed at children under 16, and we do not knowingly collect data from children.

8. Changes to this policy

We may update this policy periodically. The “last updated” date at the top reflects the most recent version. We will highlight substantial changes within the app (e.g. via the “What’s New” screen).

9. Contact

For questions about this policy or how your data is processed: app@marcomarani.com