Privacy Policy

Last updated November 1, 2026

This policy explains what The Box collects, why, and what you can do about it.

What we collect

• Your account: your email address, the name you choose, and your password (stored only in hashed form).
• Rooms you join: while a room is open we keep who is in it and who sits in which seat. This is deleted when the room closes.
• Your profile: your handle, name, tag, bio and profile picture, who you follow, the debates you schedule and the ones you RSVP to, and challenges you send or receive (only you and the other person can see those). Other signed-in users can see these.
• Blocks and reports: who you've blocked, and any reports you make (who, why, which room and any details you add).
• Box Pass: whether you have a Box Pass and when it renews, and how many AI fact checks you've used this month. We never see your payment details: Apple or Google handle the payment.

What we don't collect

• We don't record video, audio or chat. They go live to the people in the room and aren't stored.
• We don't use advertising or tracking SDKs, and we don't sell your data.

Emails

We email you about password resets and, unless you turn it off in Edit profile, when someone challenges you or answers your challenge. We don't send marketing emails.

Push notifications

If you allow notifications, we keep a push token for your device so we can tell you about challenges, debates you're going to, and rooms opened by people you follow. You can turn each kind off in Edit profile, or turn notifications off in your phone's settings. The token is deleted when you sign out or delete your account.

AI fact checks

With Box Pass, when a fact check is asked for in a room, the claim, any source the debater gave and the room's topic are sent through OpenRouter to an AI model, along with web search results for the claim, and the model suggests a verdict with sources. Names and other details about you aren't sent. We only use AI providers that don't keep what we send or use it for training. The suggestion is shown in the room like any other fact check.

Reactions

Reactions you send go live to the people in the room and aren't stored.

Camera and microphone

The app uses your camera and microphone only while you're in a seat in a room, so the others in that room can see and hear you. Everyone in the room can see your name.

Who processes your data

• Supabase stores accounts, blocks and reports.
• IONOS hosts our servers: the app server, the live video service and the mail server that sends our emails.
• Google Firebase Cloud Messaging and Apple Push Notification service deliver push notifications to your device.
• Apple App Store and Google Play take payment for Box Pass, and RevenueCat keeps track of who has it. RevenueCat knows your account id and your purchases, not your name or email.
• OpenRouter and the AI provider it routes to (with Parallel for the web search) run AI fact checks.

We share data with these providers only to run The Box, and with authorities only when the law requires it.

Keeping and deleting your data

Your account is kept until you delete it. You can delete it at any time in the app: tap your initials in the Lobby, then Delete account. This removes your account, profile, profile picture, follows, blocks, push tokens, scheduled debates and RSVPs. Reports about rule-breaking are kept so we can act on them, with your link to them removed.

Children

The Box is not for anyone under 17, and we don't knowingly collect data from children.

Changes and contact

If we change this policy significantly, we'll tell you in the app. For questions, or to ask for a copy of your data: support@thegavel.live.