Privacy Policy

FessBox lets creators create public question, confession, feedback, or message pages; receive audience submissions in a private inbox; moderate, block, report, delete, reply to, and export messages; turn replies into shareable cards; view analytics; and use AI-assisted tools such as moderation, reply drafting, inbox summaries, inbox intelligence, and content repurposing.

We collect information from creators, account holders, message senders, website visitors, and people who contact us.

Information you provide directly

• Account information, such as email address, phone number where provided, authentication identifiers, username, display name, profile photo, bio, creator type, and onboarding details.
• Creator page information, such as page slug, prompts, page settings, anonymity mode, public wall setting, theme preferences, moderation settings, keyword filters, and notification preferences.
• User-generated content, such as messages, confessions, questions, feedback, replies, reply cards, images you upload, public reply card data, reports, block actions, and support messages.
• Subscription and entitlement information, such as plan status, product identifiers, purchase status, renewal periods, and RevenueCat customer identifiers. Payment card numbers are processed by the applicable app store or payment provider and are not stored by FessBox.
• Support, feedback, and correspondence information, such as the contents of emails or other communications you send to us.
• Referral information, such as referral codes and referral relationships.

Information collected automatically

• Device and app information, such as device type, operating system, app version, language or locale, platform, notification permission status, and similar technical details.
• Usage and analytics information, such as pages or screens viewed, actions taken, feature usage, public page views, submissions, referrals, subscription events, and timestamps.
• Network and abuse-prevention information, such as IP address, user agent, hashed IP address, hashed device or browser fingerprint, rate-limit data, and block-list data.
• Crash, diagnostic, and performance information, such as error logs, stack traces, session diagnostics, and app performance signals.
• Push notification data, such as Expo push tokens, notification platform, notification delivery metadata, and message-opening events.
• Local storage and cookies or similar technologies used on web surfaces to keep the Service working, remember preferences, support authentication, measure usage, and improve performance.

Information from third parties

• Authentication information from Clerk, including account and session details needed to sign you in and secure your account.
• Subscription and purchase information from RevenueCat, Apple App Store, Google Play, or other app-store services.
• Analytics and attribution information from analytics providers, where configured.
• Crash and diagnostic information from Sentry.
• AI processing metadata from AI service providers, such as Google AI Studio/Gemini, including model usage, latency, and error metadata.

We use personal information to:

• Provide, operate, maintain, and improve FessBox.
• Create and manage accounts, sessions, profiles, creator pages, prompts, inboxes, replies, cards, exports, subscriptions, and entitlements.
• Deliver anonymous or attributed audience submissions to the correct creator page.
• Moderate content, detect abuse, enforce rate limits, block abusive senders, investigate reports, and protect the safety and integrity of the Service.
• Provide AI-assisted features, including message moderation, reply drafts, inbox summaries, audience insights, clustering, tags, recommended actions, and content repurposing.
• Send service messages, security notices, product updates, support responses, and push notifications where enabled.
• Process subscriptions, manage access to free and paid features, restore purchases, and handle entitlement changes.
• Provide analytics, measure feature performance, understand public page traffic, debug issues, and improve user experience.
• Export account or inbox data when requested and process account deletion or anonymization requests.
• Enforce our Terms of Service, comply with law, respond to lawful requests, prevent fraud, and defend legal claims.

FessBox uses AI to support creator workflows and safety. AI may process message content, reply content, prompt text, page metadata, usage limits, and related inbox context when you request an AI feature or when AI moderation is used for safety.

AI features may include:

• Screening messages for harassment, hate, spam, threats, sexual content, self-harm concerns, or other safety signals.
• Suggesting editable reply drafts.
• Summarizing inbox trends, themes, audience mood, safety notes, and recommended actions.
• Grouping or tagging similar messages.
• Repurposing replies into captions, scripts, or other creator content.

We may send relevant inputs to AI service providers solely to provide, secure, debug, and improve the requested Service. We also log limited AI run metadata such as feature name, provider, model, status, latency, and error information. We avoid logging full message bodies where diagnostic snippets are sufficient.

Where applicable law requires a legal basis, we process personal information on the following bases:

• Contract: to provide the Service you requested, including accounts, creator pages, submissions, inboxes, subscriptions, AI features, exports, and support.
• Legitimate interests: to improve the Service, secure accounts, prevent abuse, measure performance, understand usage, develop features, and enforce our terms.
• Consent: where required for push notifications, certain tracking technologies, marketing communications, or optional features.
• Legal obligation: to comply with law, tax, accounting, app-store, payment, safety, regulatory, or law-enforcement obligations.

We may disclose personal information to:

• Creators and users of the Service. Message content is delivered to the creator page selected by the sender. Public replies or reply cards may be visible to other users or the public if a creator chooses to publish or share them. If a sender chooses not to be anonymous, the sender-provided identity may be shown according to the feature used.
• Service providers and processors that help us operate the Service, including hosting, database, authentication, storage, analytics, crash reporting, push notifications, AI processing, moderation, customer support, and subscription management.
• App stores and payment processors, including Apple App Store, Google Play, and RevenueCat, for subscriptions, purchases, refunds, restorations, and entitlement management.
• Safety, legal, and compliance recipients, including law enforcement, regulators, courts, or other parties when we believe disclosure is necessary to comply with law, protect rights, investigate fraud or abuse, protect users, or enforce our terms.
• Business transaction recipients, if FessBox is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction.
• Professional advisers, such as lawyers, accountants, auditors, and insurers, where reasonably necessary.

FessBox uses third-party services that process information under their own terms and privacy policies. These may include:

• Expo — expo.dev/privacy
• Supabase — supabase.com/privacy
• Clerk — clerk.com/privacy
• RevenueCat — revenuecat.com/privacy
• Sentry — sentry.io/privacy/
• PostHog — posthog.com/privacy
• Google AI/Gemini — policies.google.com/privacy
• Apple App Store — apple.com/legal/privacy/
• Google Play — policies.google.com/privacy

Third-party services may change over time as the Service develops. We will update this Privacy Policy when material changes occur.

FessBox and our service providers may use cookies, local storage, SDKs, pixels, and similar technologies to:

• Keep you signed in and secure your account.
• Remember preferences and app settings.
• Provide public pages and deep links.
• Measure usage and performance.
• Detect errors, abuse, spam, fraud, or security issues.
• Understand the effectiveness of features and communications.

You may be able to disable cookies or similar technologies through your browser or device settings. Some features may not work correctly if they are disabled. Mobile operating systems also provide controls for notifications, analytics, advertising identifiers, and app permissions.

If you enable push notifications, we collect and store a push token and platform information so we can send notifications, such as new-message alerts. You can disable push notifications through your device settings or in-app settings where available.

We may send transactional and service messages, such as account, security, legal, support, or subscription notices. Where permitted by law, we may also send product updates or marketing communications. You may opt out of marketing communications where required, but you may still receive essential service messages.

Depending on where you live, you may have rights to:

• Access personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion or anonymization of personal information.
• Request a portable copy of your information.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Opt out of certain analytics, marketing, sale, or sharing activities where applicable.
• Appeal a privacy-rights decision where applicable.
• Lodge a complaint with a data protection authority.

You can access some information in the app, request account export, and request account anonymization where those features are available. You may also contact support@fessbox.com. We may need to verify your identity before completing a request. We may deny or limit a request where permitted by law, such as when we must keep information for security, fraud prevention, legal compliance, app-store records, dispute resolution, or to protect the rights and safety of others.

If you are a California resident, this section applies to you. In the preceding 12 months, FessBox may have collected the following categories of personal information:

• Identifiers, such as email address, phone number, username, display name, Clerk identifier, RevenueCat customer identifier, push token, IP address, hashed IP address, hashed device information, and similar identifiers.
• Customer records, such as account details, subscription status, support communications, and purchase-related records.
• Commercial information, such as subscription plan, entitlement status, products purchased, renewal periods, and app-store purchase metadata.
• Internet or electronic network activity, such as app usage, page views, submissions, analytics events, device information, crash logs, and interaction data.
• Approximate geolocation information inferred from IP address where applicable.
• Audio, electronic, visual, or similar information, such as profile images, uploaded images, reply card images, and message content.
• Inferences, such as audience trends, tags, moderation scores, AI-generated summaries, and feature recommendations.
• Sensitive personal information, such as account credentials handled by authentication providers and contents of messages or communications.

We collect these categories from you, your device, public page interactions, app stores, authentication providers, analytics providers, AI providers, and other service providers. We disclose these categories to service providers, creators where needed to provide the Service, app stores, payment and subscription processors, legal recipients, and business transaction recipients as described above.

We use sensitive personal information only for purposes permitted by law, such as providing the Service, securing accounts, processing messages, detecting abuse, and complying with legal obligations. We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act unless we provide a specific notice and opt-out method.

California residents may exercise rights to know, access, correct, delete, receive a copy of, and opt out of sale or sharing of personal information, and may use an authorized agent where permitted by law. Contact support@fessbox.com to exercise these rights.

FessBox and our service providers may process and store personal information in countries other than your country of residence. These countries may have data protection laws different from those in your jurisdiction. Where required, we use appropriate safeguards, such as contractual protections, adequacy decisions, consent, or other legally recognized transfer mechanisms.

We retain personal information for as long as reasonably necessary to provide the Service, fulfill the purposes described in this Privacy Policy, comply with law, resolve disputes, enforce agreements, prevent abuse, maintain security, and support business operations.

Retention periods vary by data type:

• Account, profile, creator page, subscription, entitlement, and support data are generally retained while your account is active and for a reasonable period afterward.
• Messages, replies, cards, reports, blocks, analytics, moderation records, AI summaries, and exports may be retained while needed for the Service, safety, legal compliance, or creator account features.
• Push tokens are retained while active or until disabled, replaced, or no longer needed.
• Crash, diagnostic, analytics, and security logs are retained for a limited period unless needed for security, debugging, or legal purposes.
• Aggregated or de-identified information may be retained indefinitely because it no longer identifies you.

When you request account deletion, FessBox may anonymize or delete account data, remove stored files where feasible, and delete the related authentication account where technically available. Some records may remain where required for legal, security, payment, anti-abuse, audit, or dispute-resolution reasons.

We use reasonable technical, administrative, and organizational safeguards designed to protect personal information. These include authentication, access controls, row-level database security, server-side handling of sensitive AI and payment integrations, hashed abuse-prevention identifiers, and monitoring for errors or misuse.

FessBox is not intended for children under 18 years old, or any higher minimum age required by law in your jurisdiction. We do not knowingly collect personal information from children in violation of applicable law. If you believe a child has provided personal information to FessBox, contact support@fessbox.com so we can take appropriate action.

FessBox may contain links to third-party websites, apps, stores, or social platforms. Creators may also share FessBox replies or cards to external social platforms. We do not control those third parties and are not responsible for their privacy or security practices. Review their policies before using them or sharing information with them.

We may update this Privacy Policy from time to time. We will update the effective date when we make changes. If changes are material, we will provide additional notice where required by law, such as through the app, website, email, or other reasonable means. Your continued use of the Service after an updated policy becomes effective means you accept the updated policy.

For questions, privacy requests, complaints, or concerns, contact: