Privacy Policy

Who is responsible

Eigabox is operated by Tsuruta, the developer of the Eigabox apps. For anything on this page, contact us through Settings → Contact us in the app, or by email at privacy@eigabox.io. We are the data controller for the information described here.

The short version

• We do not sell your personal data, and we never have.
• There are no advertising SDKs, no analytics SDKs and no third-party trackers in the apps. Nothing follows you around the internet on our behalf.
• We collect what the product needs to work: your account, your profile, the library you build, and the messages you choose to send.
• You can delete your account, and everything attached to it, from inside the app at any time.

What we collect

Your account

An email address, and a password if you chose that sign-in method. If you use Sign in with Apple and hide your address, we only ever see Apple’s private relay address, never your real one. Authentication is handled for us by Supabase.

Your profile

A display name, a handle, an optional profile picture, and your country and language preference. Profile pictures are stored in Supabase Storage. Your profile, your handle and your picture are visible to other signed-in Eigabox users, because the app has social features.

What you track

The library you build: your watchlist, your boxes and box sets, diary entries, ratings, written reviews, favourites, your Box of Fame, episode and franchise progress, and the streaming services you follow. Some of this is private by default and some of it is public; the app tells you which as you create it, and you can change the visibility of a box or a review at any time.

Social features

Your eigapals and follows, direct messages, comments on films and shows, and any reports or blocks you submit. Direct messages are stored so they can be delivered and shown to you and the person you sent them to. They are not end-to-end encrypted, and we may read a specific conversation if it is reported to us for abuse.

Device and usage

The app version you are running, when you last used the app, and a record of which months you were active, which we use to understand whether the product is growing. If you turn on notifications we store a push token for that device so Apple or Google can deliver them. We do not collect your location, your contacts, your photos beyond a picture you deliberately upload, or an advertising identifier.

ePass purchases

If you buy an ePass, the store you bought it from processes the payment: Apple on iOS, Google Play on Android. We never see or store your card details. What we store is the transaction identifier that store gives us, which product was bought, when it expires, and whether it is still valid, so that your membership works on every device you sign in on. Promo codes you redeem are recorded against your account so a code cannot be used twice.

When you contact us

Messages you send through the in-app contact form, bug reports, and feature requests, together with the account they came from, so we can reply.

Why we are allowed to hold it

Most of it is because we cannot provide the service without it: there is no watchlist without storing a watchlist. Purchase records are kept to perform the contract you entered into and to meet accounting obligations. Moderation records, blocks and reports are kept on the basis of our legitimate interest in keeping Eigabox usable and safe. Push notifications are sent only if you consent, and you can withdraw that in your device settings at any time.

Who else sees it

We use a small number of service providers, and they act on our instructions only:

• Supabase: our database, authentication, file storage and server functions. This is where your account and your library live.
• Apple: App Store purchases, Sign in with Apple, and push notification delivery on iOS.
• Google: Google Play purchases on Android, and push notification delivery on Android through Firebase Cloud Messaging.
• Vercel: hosting for this website.

Two things load directly from third parties as you browse, which means those companies receive your IP address and the usual request information: The Movie Database (TMDB) serves the posters, artwork and film metadata, and YouTube serves trailers, embedded in privacy-enhanced mode. We are not otherwise affiliated with either, and neither receives your Eigabox account details.

Beyond that, we disclose personal data only where the law requires it. We do not sell it, we do not rent it, and we do not share it with advertisers.

Where it is stored

Your data is held on Supabase’s infrastructure. Some of our providers operate outside the European Economic Area, so your data may be transferred there. Those transfers rely on the European Commission’s standard contractual clauses or an equivalent safeguard.

How long we keep it

Your account data is kept for as long as your account exists. When you delete your account we remove your profile, your library, your messages and your profile picture. A purchase record may survive that deletion for accounting purposes, but with the link to you removed, so it can no longer be traced back to a person. Backups roll off on their own schedule and may hold deleted content for a short period after removal.

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict that use. Most of this you can do yourself:

• Correct it: edit your profile in the app.
• Delete it: Settings → Account → Delete account. This is immediate and cannot be undone.
• Everything else: write to privacy@eigabox.io and we will answer within one month.

Deleting your Eigabox account does not cancel an active subscription. Subscriptions are managed by the store you bought them from. On iOS, open Settings, tap your name, then Subscriptions. On Android, open the Play Store, tap your profile picture, then Payments and subscriptions.

If you think we have handled your data badly, you can complain to your national data protection authority.

Children

Eigabox is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

Security

Traffic is encrypted in transit. Access to your rows in our database is enforced by row-level security, so one account cannot read another account’s private data. No system is perfect, and we will tell you if a breach affects you and the law requires it.

Changes to this policy

If we change it we update the date at the top. If a change materially affects you, we will tell you in the app before it takes effect.