BipboxPrivacy policy
Who we are
Bipbox is operated by BIP (Philip Marsden and Traci Davenport, Prague, Oklahoma, USA) ("we"). Questions about this policy go to bip-support@mybip.org.
What we collect
Account details. Your name, email address and a one-way hash of your password. We never store the password itself.
Devices. When you sign in from a Mac, phone or tablet we record the device's name, the app version it runs, and when it last connected, so you can see and sign out your devices from your account page.
Files and their descriptions. The files you upload, their names, sizes, dates and folder structure, and thumbnails we make of your images so they can be shown in the apps.
Billing. Your plan, subscription status and invoices. Card details are collected and stored by our payment processor, Stripe, and never reach our servers.
Technical logs. Server logs with IP addresses, request times and error details, kept for operating and securing the service. Sign-in attempts are counted by IP address to stop password guessing.
We do not collect location data, contacts, or anything from your device beyond the files you choose to upload.
How we use it
- To provide the service: store and deliver your files, run the apps, and show you your account.
- To bill you, and to email you about your account: confirmations, password resets, receipts and notices about the service.
- To keep the service secure and working, including finding and fixing problems.
We do not sell your data, use it for advertising, or profile you. We do not use your files for anything except storing and serving them to you and the people you share them with.
Your files
Your files are yours. They are stored in secure cloud storage in the United States, encrypted in transit and at rest, in a storage area that belongs to your account. Nobody else's account can see them. Our staff do not open your files except when you ask us to help with a specific problem, or when required by law.
Sharing
When you create a share link, anyone who has the link can see and download what it points to, subject to any password or expiry you set. When you share a folder with another Bipbox user, that person can see the folder's contents and, if you gave them write access, add, change and remove files in it. You can revoke either at any time from your account page.
Service providers
We use a small number of providers to run Bipbox: a cloud storage and hosting provider in the United States for files and servers, Stripe for payments, and an email delivery service for account messages. Each receives only what it needs for its job and is bound by its own privacy terms. We will name our current providers on request.
Cookies
The website uses one session cookie to keep you signed in and a token to protect forms from forgery. There are no advertising or analytics cookies. The apps use a device key instead of cookies.
Retention and deletion
- Files you delete go to your trash, where they stay until you empty it or restore them.
- When you empty the trash, the files leave your account immediately. We keep the underlying data for a short grace period of 7 days, during which we can put it back if you ask, and earlier versions of changed files for 2 days, after which everything is removed for good. Delete permanently and free space in your trash skips the grace period: those files are removed at once and cannot be put back.
- If you close your account, or it stays unpaid for 60 days, your files and account details are deleted within 30 days. Invoices are kept as long as tax law requires.
- Server logs are kept for up to 90 days.
Security
Connections use HTTPS. Passwords are hashed. Device keys are stored hashed on our side and in your device's secure storage on yours. Files are encrypted at rest by the storage provider. No system is perfectly secure; if we learn of a breach affecting your data we will tell you promptly.
Your rights
You can see and change your name and email on your account page, download any of your files at any time, and sign out devices you no longer use. To export everything, delete your account, or ask what we hold about you, email bip-support@mybip.org from your account address. We answer within 30 days. Bipbox is not intended for anyone under 16.
Changes
If we change this policy in a way that matters, we will email account holders before it takes effect. The date at the top is the date of the current version.