BoxTales · Android

Privacy policy

Last updated: October 20, 2026

This English version is provided for convenience. In case of any difference, the French version prevails.

1. Who is responsible for your data?

BoxTales is published by Charlotte Cachet, a French sole proprietor (entrepreneur individuel, EI) trading as Lucidblur. She decides how the data described here is used and is the data controller.

Business address:
Contact for any question about your data: contact@lucidblur.fr

This policy covers the BoxTales app and its pages on https://lucidblur.fr. See also the legal notice and the terms of use.

2. Your inventory stays on your device

The spaces, storage units, locations, items, quantities and notes you enter are saved in a local database on your phone. They are never sent to a server: we can’t read, change or delete them remotely.

They stay on your device until you delete them. Uninstalling the app or clearing its data wipes them, unless a backup of your phone or an exported file (section 9) keeps a copy.

3. Photo analysis with AI

Analyzing a photo is always optional. Everything you can do by hand works without it.

When you start an analysis, the photo goes to our Firebase server functions, then to Google’s Gemini API, which sends back a suggested list of items. BoxTales doesn’t save the photo on any server and keeps no photo library.

Gemini is used under Google’s paid service terms. Under those terms, Google doesn’t use this content to improve its products, but it keeps the photos and responses for a limited period it doesn’t specify, solely to detect abuse and meet its legal obligations. This data may be stored temporarily in any country where Google has facilities.

So that a dropped connection doesn’t cost you a scan, the suggested list is kept on our server for 24 hours at most, then deleted automatically. A technical record of the request, without the list itself, is kept for 30 days so the same scan is never charged twice.

No automated decisions. The AI suggests; you check, fix and confirm. Nothing is saved without your approval.

Photograph things, not people, ID documents or confidential papers: they add nothing to the analysis and would be sent along with the rest of the photo.

4. Technical ID, scan balance and device fingerprint

BoxTales never asks for your name, email or a password. To keep track of your scan balance, the app still creates a technical ID using Firebase Anonymous Authentication. “Anonymous” is just what Google calls the feature: legally, this ID is still personal data, because it links a balance and analysis requests to your installation.

On Android, the welcome scans are given only once per phone. To check this, the app reads the ID that Android assigns to BoxTales on your device (ANDROID_ID). Our server doesn’t keep it: it derives a fingerprint from it with a secret key, stores only that fingerprint, and compares it with those of phones that already got the gift. It’s used for nothing else, shared with no one, and can’t be used to follow you across other apps. If the ID can’t be read, the app works as usual, just without welcome scans.

To handle requests and block abuse, Google’s services also process connection data: your IP address and a check that the request really comes from the official app (Firebase App Check).

5. Why, on what legal basis, and for how long

• Analyzing your photos and keeping your scan balance: photo, suggested item list, technical ID, balance. Legal basis: providing the service you ask for (Art. 6(1)(b) GDPR). Retention: item list 24 hours; technical ID and balance 3 years after you last use the app, then deleted, including any scans left.
• Making sure a scan is never charged twice: technical record of the request, without its content. Legal basis: providing the service. Retention: 30 days.
• Giving the welcome scans only once per phone: device fingerprint. Legal basis: our legitimate interest in stopping a free offer from being claimed over and over (Art. 6(1)(f)). Retention: 3 years after the scans were given.
• Keeping the service secure: IP address, App Check attestation, technical logs. Legal basis: our legitimate interest in protecting the service. Retention: 30 days for our server function logs; a few weeks, according to Google, for IP addresses logged by Firebase Authentication.
• Answering you if you write to us: your email address and message. Legal basis: our legitimate interest in providing support. Retention: 3 years after our last exchange.

You have no legal obligation to provide this data. Without it, AI analysis can’t work; manual entry still does.

6. Who receives your data, and where

• Google (Firebase): technical ID, balance, device fingerprint, running the analyses, access protection. Google acts as our processor under its data processing terms.
• Google (Gemini API): recognizing the items in the photo.
• Google Play: downloading the app and, once purchases open, paying for scan packs, under its own privacy rules.
• SARL alwaysdata, 91 rue du Faubourg Saint-Honoré, 75008 Paris, France: website hosting.

Our server functions run in Google Cloud’s Paris region (europe-west9) and so does the database holding balances. However, according to Google, Firebase Authentication runs only from the United States, and Gemini may process photos in other countries. These transfers outside the European Economic Area rely on Google’s participation in the EU–US Data Privacy Framework and on the European Commission’s standard contractual clauses included in its terms.

We don’t sell or rent any data, to anyone.

7. Security

• All communication with our servers is encrypted (HTTPS).
• Only the official app can call our server functions: every request is checked by Firebase App Check.
• The app can’t change a balance; only our server can. Device fingerprints can’t be read by any app.
• The Android ID is never stored as is, only its fingerprint, computed with a key kept in Google Cloud’s secret vault.
• Our logs contain no photos, no item lists and nothing about what’s in your storage.

If a data breach puts you at risk, we’ll notify the competent authority and, where the law requires it, the people affected.

8. Ads, analytics, purchases

BoxTales contains no advertising module, no audience analytics and no crash reporting tool. If one is ever added, this policy will be updated before the app version that includes it.

Scan pack purchases aren’t open yet. Before they are, this policy will describe the data processed by Google Play and by RevenueCat, the service that will confirm purchases to us.

9. Backup and export

The “My data” screen lets you export your inventory to a file, without photos, and restore it later. The file stays under your control: if you hand it to a cloud storage or messaging service, that service handles it under its own rules.

10. Device permissions and website

The camera is used to photograph a storage unit or scan a QR label; file access, to import an image or restore a backup. You manage each permission in your phone’s settings. Refusing one only blocks the matching feature.

The website sets no cookies and has no analytics or ads. Its host processes the connection data needed to run and secure it (IP address, date, pages requested) for 30 days.

11. Your rights

You can ask to access, correct, delete or port your data, or to restrict its processing, and you can object to processing based on our legitimate interest. Write to contact@lucidblur.fr. We reply within one month.

Since BoxTales doesn’t know who you are, we can only find your server-side data with the technical ID shown in the app, on the “My data” screen. Include it in your request. We’ll never ask for proof of identity.

Two things worth knowing up front:

• Deleting your technical ID also deletes your balance: any scans left, free or paid, are lost.
• The device fingerprint is only useful if it survives a reinstall. We may therefore keep it despite a deletion request, until the end of the period in section 5. It reveals nothing else about you.

Your inventories exist only on your phone: you manage them in the app, and deleting them or uninstalling the app is enough to erase them.

You can complain to the French data protection authority, the CNIL (cnil.fr), or to the authority in your country (section 13).

12. Minimum age

BoxTales is for people aged 18 and over, as required by the terms of the AI service that analyzes photos. The app isn’t aimed at children and we don’t knowingly collect their data.

13. Depending on where you live

This policy follows the General Data Protection Regulation (GDPR), which applies in the European Union, Iceland, Liechtenstein and Norway. Elsewhere, the following also applies.

• United Kingdom: your rights are those of the UK GDPR. Authority: Information Commissioner’s Office (ico.org.uk).
• Switzerland: your data may be transferred to the United States (section 6). Authority: Federal Data Protection and Information Commissioner (edoeb.admin.ch).
• Canada: your personal information is processed in the United States and in Europe (section 6). Authority: Office of the Privacy Commissioner of Canada (priv.gc.ca).
• Quebec: the person in charge of the protection of personal information is Charlotte Cachet, publisher of BoxTales, reachable at contact@lucidblur.fr. Authority: Commission d’accès à l’information (cai.gouv.qc.ca).
• Australia and New Zealand: your data is processed outside your country, as described in section 6. Authorities: Office of the Australian Information Commissioner (oaic.gov.au) and Office of the Privacy Commissioner (privacy.org.nz).
• Monaco: authority: Autorité de protection des données personnelles (apdp.mc).
• United States: we don’t sell or share your personal information as defined by state privacy laws, and we run no targeted advertising. Neither the website nor the app tracks you across other sites or apps, so they don’t respond differently to “Do Not Track” signals.

14. Changes to this policy

The date of the latest update is shown at the top of this page. If a change needs your consent, the app will ask for it before the change takes effect.