Privacy Policy

iBoxPlay is a secure cloud storage and private file sharing platform designed for individuals, professionals, and organizations that need private file storage, controlled sharing, and collaboration tools.

Unlike traditional cloud storage platforms that focus only on storing files, iBoxPlay combines secure storage, workspace organization, full-content search, and advanced sharing controls into a single platform. Security and privacy are foundational principles — not features bolted on later.

Account information: When you create an account, we collect your email address, display name, authentication credentials, and (if you subscribe) billing information. Payments are processed by trusted third-party payment providers. We do not store full payment card details on our servers.

Files and content: Files uploaded to iBoxPlay are transmitted over TLS-encrypted connections and stored securely on our infrastructure. To operate the service, we may store limited metadata including file name, file size, upload timestamp, file type, workspace identifiers, and sharing settings.

Usage information: We collect information about how you interact with the platform, including features used, storage consumption, share-link activity, workspace activity, search activity, and general application usage metrics. This information helps us improve reliability, performance, and user experience.

Device and application information: The application may automatically collect device model, operating system version, application version, language and locale settings, IP address, crash diagnostics, a randomly generated installation identifier, and a Firebase Cloud Messaging (FCM) registration token used to deliver push notifications to your device. This information is used for analytics, troubleshooting, security, and compatibility improvements.

Advertising identifier (Android): The free version of the iBoxPlay Android application uses Google AdMob to display advertisements. AdMob may collect the Google Advertising ID (GAID), device identifiers, IP address, ad interactions, and diagnostic information to display advertisements and measure advertising performance. See Section 6 for how to manage advertising preferences.

App permissions: iBoxPlay requests only the permissions required for application functionality. Storage and media permissions (including images, videos, and audio files) are used solely to allow you to upload, download, access, and save files. iBoxPlay does not access your contacts, microphone, or camera. A foreground service permission is used to keep uploads and downloads running reliably when the app is in the background; this is indicated by a persistent system notification while the transfer is active.

We use collected information to:

• Provide, operate, maintain, and improve iBoxPlay.
• Deliver secure file storage and workspace functionality.
• Enable file synchronization, search, and sharing.
• Manage user accounts and subscriptions.
• Send transactional communications, security alerts, and push notifications delivered via Firebase Cloud Messaging (FCM).
• Serve and measure advertisements through Google AdMob in the free version of the Android application.
• Analyze aggregate usage trends through Firebase Analytics.
• Detect fraud, abuse, unauthorized access attempts, and violations of our Terms of Service.
• Comply with legal and regulatory obligations.

We may use your account information to send you product updates and relevant communications. You can opt out of marketing emails at any time by clicking the unsubscribe link in any such message.

We do not sell personal information to third parties.

iBoxPlay is designed with security as a core principle. We apply multiple layers of protection to keep your files and account safe:

• Encryption in transit: All data is transmitted using industry-standard TLS encryption designed to protect information during transmission.
• Encryption at rest: Files are stored using secure cloud infrastructure that provides encryption at rest and industry-standard security controls.
• Signed, time-limited access: Every file download or stream requires a cryptographically signed URL that expires automatically. There are no publicly guessable links to your content.
• Password security: Passwords are hashed with bcrypt before storage. We never store your password in a readable form.
• Session security: Access tokens are short-lived and refresh tokens are stored as one-way hashes — the raw token value is never persisted in our database.

Account information such as email address, subscription status, and support records is accessible to authorized personnel solely for operational, billing, or support purposes.

iBoxPlay provides secure collaboration features that allow you to share files and folders with individuals, teams, clients, and organizations. Sharing controls may include:

• Password-protected links
• Expiration dates
• View-only access
• Download restrictions
• Workspace permissions
• Access revocation

You are responsible for managing sharing permissions and ensuring content is shared only with intended recipients.

iBoxPlay integrates the following third-party services. Each provider has its own privacy policy governing their data collection:

• Google AdMob — advertising platform used in the free version of the Android application. AdMob may collect the Google Advertising ID and related signals to serve ads. Privacy Policy.
• Google Firebase Analytics — used to understand application usage, reliability, and performance trends. Data is aggregated and does not identify individual users. Privacy Policy.
• Google Play Billing — payment processing for subscriptions purchased through the Android app. Privacy Policy.
• Stripe — payment processing for subscriptions purchased through the web platform. Privacy Policy.
• Firebase Cloud Messaging (FCM) — used to deliver push notifications to your device. To route notifications, a device registration token is transmitted to Google's servers. Privacy Policy.
• Google Sign-In — an optional authentication method. When you sign in with Google, your Google account email and display name are shared with iBoxPlay's backend solely to create or identify your account. We do not store your Google password or access other Google services. Privacy Policy.
• Sign in with Apple — an optional authentication method on supported platforms. Apple acts as an identity provider and processes your Apple ID credentials independently. Privacy Policy.
• Sentry — crash reporting, error monitoring, and performance tracing. When an error occurs, Sentry may receive stack traces, device information, and network request metadata. This data is used solely to identify and fix bugs and is not shared further. Privacy Policy.

The free version of the Android application displays advertisements served through Google AdMob. AdMob may use your Google Advertising ID (GAID) to provide personalized advertising.

Managing advertising preferences:

• On Android, go to Settings → Google → Ads and enable Opt out of Ads Personalisation (Android 12 and below), or Delete advertising ID (Android 13+).
• Visit adssettings.google.com to manage your Google ad preferences.
• Users who subscribe to eligible premium plans may receive an ad-free experience.

Even when personalized advertising is disabled, non-personalized advertisements may still be displayed.

User data may be processed and stored in secure cloud infrastructure operated by our service providers. Data may be stored in multiple geographic regions for redundancy, disaster recovery, performance optimization, and service continuity. Appropriate safeguards are implemented to protect personal information during international data transfers where applicable.

The web version of iBoxPlay uses essential cookies and local storage technologies to maintain user sessions, store preferences, improve security, and provide core functionality. We do not use advertising or cross-site tracking cookies.

The Android application does not use browser cookies. However, integrated services such as Google AdMob and Firebase may use device identifiers or similar technologies as described in their respective policies.

Account information and files are retained while the account remains active. Deleted files are moved to Trash and permanently deleted after 7 days.

Upon account deletion, personal data will generally be deleted within 30 days. Certain encrypted backups may persist for a limited period before automatic deletion as part of our disaster recovery processes. Certain records may be retained longer where required by law, fraud prevention, security, dispute resolution, or legitimate business purposes. Aggregated and anonymized analytics information may be retained indefinitely.

iBoxPlay is not directed toward children under 13 years of age. We do not knowingly collect personal information from children. If we become aware that personal information has been collected from a child without appropriate consent, we will take reasonable steps to remove such information.

Parents or guardians who believe a child has provided information may contact us at privacy@iboxplay.com.

Depending on your jurisdiction, you may have the following rights:

Access. You may request details about what personal information we hold about you and how it is used.

Correction. If any information we hold is inaccurate or incomplete, you may request that we correct or update it. You can update most account information directly from your profile settings.

Erasure. You may request deletion of your personal information in circumstances such as: our processing violates applicable law; the purpose for which it was collected has been fulfilled or no longer applies; you withdraw consent; or the retention period has expired. When you delete your account, personal data is permanently removed within 30 days. Note that deletion from backup systems may be delayed, and we may retain certain information where required by law, to resolve disputes, or for legitimate security purposes.

Data portability. Where technically feasible and permitted by applicable law, you may request a copy of your personal information in a structured, machine-readable format, or ask us to transfer it to another service provider.

Restriction and objection. You may request that we restrict processing of your information in certain circumstances, or object to processing based on legitimate interests.

Withdrawal of consent. Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

You may manage most information directly through your account settings. Account deletion options are available within the application or at iboxplay.com/delete-account.

For privacy-related requests, contact us at privacy@iboxplay.com. We respond to all verifiable requests within 30 days.

We implement reasonable technical, administrative, and organizational safeguards designed to protect personal information. Security measures include TLS encryption in transit, AES-256 encryption at rest, access controls, server-level access logging, and regular security reviews. Only authorized personnel have access to account information, and solely for operational, billing, or support purposes. We do not log or monitor the contents of your private files.

No method of transmission or storage can be guaranteed to be completely secure. Users are encouraged to use strong passwords and enable additional security features where available.

Security incident notification. In the event of a personal data breach that is likely to result in risk to your rights, we will notify affected users promptly and report to relevant supervisory authorities within 72 hours of becoming aware of the incident, as required by applicable law.

In the event of a merger, acquisition, reorganization, or sale of all or part of our assets, your personal information may be transferred to the acquiring or successor entity. We will notify you of any such transaction — for example, by email or in-app notice — and describe your choices at that time. Any successor will be required to honor the commitments made in this Privacy Policy or provide you with the opportunity to opt out before your information is subject to a materially different policy.

We may update this Privacy Policy from time to time. Material changes may be communicated through email notifications, in-app notifications, or website announcements. The "Last updated" date at the top of this page reflects the most recent revision.

iBoxPlay
Mumbai, Maharashtra, India
privacy@iboxplay.com