Integrity is our baseline. This policy explains how BoxSight LLC ("we," "our," or "us") manages your information across our ecosystem. We prioritize local processing and transparency in all AI-driven interactions.
1. Information We Collect
Direct Submission
- Account Credentials: Email addresses and profile metadata provided during registration.
- Application Data: Content you send to our servers through an app so that it can do its job.
- Inquiries: Information shared during support requests or technical consultations.
Automated Collection
- Technical Telemetry: Device identifiers, OS versions, and network performance metrics.
- Usage Analytics: Feature engagement patterns and diagnostic logs to maintain service stability.
- Server logs: For every request, our web servers record the IP address, the time, the address requested (without any search terms or other query string), the referring page and the browser or app identifier. When a request fails, the error log records the whole request. These logs are kept for at most 15 days and are used only to run and protect the services, including blocking abusive traffic, and to count visits per site, per day and per country (worked out on our own server; no individual visitor is shown or shared). Addresses blocked for abusive traffic are kept for up to 180 days in the blocking system and up to five weeks in its log. Our servers' system logs are kept for up to five weeks, and the record of sign-ins to the servers themselves (who logged in, from which address) for up to about three months.
These are the general terms and they apply to every BoxSight app. Individual apps may collect less than this. Where section 2 describes different practice for a particular app, that description governs for that app.
2. Where individual apps differ
One policy covers every BoxSight app. This section lists only the places where a particular app does something the general terms above do not already describe. Each current BoxSight app is described below.
SpendCity (Expense Tracking)
SpendCity runs entirely on your device, and none of your data reaches us. Receipts you photograph, the merchant, date and line items read from them, and everything else you record are stored only in an encrypted database on your phone; captured images are kept in encrypted containers. Reading and categorising a receipt happens on the phone itself (Apple's Vision text recognition and on-device Foundation Models on iOS; Google ML Kit's on-device text recognition and a local parser on Android), with no server, no cloud AI and no Gemini call: the image and its text never leave the phone.
There is no SpendCity account and we operate no server that receives this data. We cannot read your receipts, and we could not produce them if we were asked to. The app contains no analytics, crash reporting or telemetry. The complete list of what goes over the network, which the app also shows you under Settings → network access: exchange rates from api.frankfurter.dev (currency codes and a date only); the update check (on iOS the app's ID and your country, sent to Apple at most once a day; on Android, Google Play's in-app update); on Android, a one-time download of Google's document-scanner module (nothing is uploaded); the legal pages, when you open them; and a backup of the database's encryption key (the 32-byte key only, never your data) to your own iCloud Keychain or Google Block Store, end-to-end encrypted and never to us. An offline mode blocks everything the app itself controls. Your data is not synced to any cloud: SpendCity's data folders are excluded from iCloud backup, Android's automatic backup covers only preferences, and documents leave the phone only when you export them. Consequently the collection described in section 1 and the third-party processing in section 3 do not apply to SpendCity, and section 6 has no server-side data to reach: removing the app, or clearing your data from inside it, is the deletion.
LIITOS (News Briefings and Sustainability Research)
LIITOS has two sections, kept separate: AI news briefings with a weekly podcast, and sustainability research. Existing LIITOS and LIITOS-AI accounts, with the items saved in them up to September 13, 2026, were moved into LIITOS 2.0, and their owners sign in with their existing email and password.
What LIITOS stores. To create an account, you give your name and email address, and you sign up through BoxSight's shared sign-in, which gives the account an identifier. Everything else is optional: a profile (biography, role, country, university or organisation, ORCID iD), your briefing focus areas and delivery time, an avatar photo, and the text of a résumé you upload. The uploaded PDF itself is discarded once its text has been extracted, and you can delete the text in the app. Your profile is private by default; your name and avatar appear next to comments you post.
LIITOS also stores what you choose to do in the app: bookmarks, saved items and jobs, likes, comments, follows, watchlists, projects and applications, collaboration messages, notifications, RSS sources and source submissions you add, votes, reports and blocks, in-app feedback (with your device's operating system and app version), job-fit results, and your personal briefings. Messages are stored on our servers and encrypted in transit, but not end-to-end, so we are technically able to read them.
Device and activity. LIITOS keeps on your account the kind of device you last used it from (iOS, Android or other) and, from version 2.0.1, that device's operating system version and the app version (for example "iOS 18.6; LIITOS 2.0.1"), together with when you were last active. We use this to keep the app compatible and to help with support. Only the latest value is kept: it is replaced each time, it appears in your "Your data" export, and it is deleted with your account. Our admin tools show the device and version information only as totals across accounts; administrators can see when each account was last active. The device information does not include your device model or any device identifier.
Search. What you search for is sent to Google Gemini to answer the search. It is not saved to your account; our server keeps the query and its answer in memory for up to one hour so that a repeated search is answered faster. Our web servers log only the path of each request, without search terms, except when a request fails: the error log then records the whole request, search words included, for at most 15 days.
What LIITOS does not collect. Your device's location (GPS or network), device or advertising identifiers, push-notification tokens (notifications are created on your device), contacts, and financial, health, audio or calendar data. The app contains no analytics, crash-reporting or advertising SDK, and its own logs contain no IP address or browser identifier. Our servers work out an approximate country from IP addresses for aggregate traffic and security statistics; it is not linked to your account.
Service providers. These process data on our behalf; we do not sell or share it.
- Google Gemini receives your search queries, your focus areas, and the titles and summaries of articles in your feeds, to produce briefings and search answers. It does not receive your résumé, name or email address. We use the paid Gemini API: under its terms Google does not use prompts or responses to improve its products, and logs them for a limited period solely to detect misuse (Gemini API Additional Terms of Service, effective March 23, 2026).
- Google NotebookLM receives public article addresses only, to produce the podcast and video pieces.
- ORCID is contacted only when you ask LIITOS to fetch your own works.
Retention and deletion (LIITOS). Account data is kept until you delete the account. Podcast and video media are deleted after 30 days. You can delete individual items in the app, and your whole account with all its data in the app or at liitos-ng.boxsight.ai/delete-account, where the request is recorded and carried out within the period in section 6. The previous LIITOS server (before version 2.0) was shut down on September 28, 2026, and its database deleted. Final backup copies of the previous LIITOS service were deleted on October 5, 2026.
LIITOS-AI (discontinued)
LIITOS-AI was discontinued on September 26, 2026; its features continue in LIITOS. LIITOS-AI accounts were moved to LIITOS before it closed, and their owners sign in to LIITOS with the same email and password. LIITOS-AI's server-side service and its database have been deleted. Final backup copies of that database and of the episodes it generated were deleted on October 5, 2026.
Topos (Nearby-Places Finder)
No account required. Topos identifies a signed-out installation with an anonymous session token issued by our server, held in your device's secure keychain/keystore. It is used for rate-limiting and to keep your saved activity separate from anyone else's. It is not your name or email, and Topos contains no advertising identifier.
- Precise location (GPS): Collected only while the app is in use (foreground), at the moment you search, to find nearby places and calculate travel times. We do not collect background location and do not track movement between searches. Your coordinates are sent to our backend and to our mapping/places providers to perform the search you requested; we store the search origin only in coarsened form (rounded to approximately 110 metres) for coverage analytics — never your exact coordinates.
- Search and place activity: Each search is recorded with what you searched for — the category, the situation bundle, or the text you typed — along with the coarsened origin described above, the time radius, the transport mode, how many results came back and which places they were, and the platform, OS version, device model and app version that made the request. Opening or saving a place records a similar entry for that place. When you are signed in these records carry your account identifier and are linked to you; signed out, they carry only the session token.
- If you create a Topos account: your email address, and the content you choose to save — favorites and itineraries (your itinerary's title and, for each place, only Google's identifier; a place's name, address and location are fetched from Google when you view them and are not stored by us), and saved searches (the category or text you searched for, the time radius and the transport mode). This content is linked to your account rather than to a session token, and is removed when you delete the account. We also keep on the account the platform, OS version and app version last seen on it, and the time it was last active.
- Device & diagnostics: Platform, OS version, device model and app version, sent with each request, plus IP/connection metadata for security and abuse prevention. Our backend records which endpoint each request reached, and logs server-side errors (endpoint, status code, error type) so we can keep the service working. Topos adds no analytics or crash-reporting SDK of its own. The Google Maps SDK that displays the map reports crash metrics within the SDK, a pseudonymous SDK identifier and map interaction events to Google (see Google's disclosure); nothing else is sent to any third party for analytics.
- Third-party processors: the Google Maps SDK, which displays the map (Google receives your map viewport, device model and OS version, IP address, crash data within the SDK and a pseudonymous SDK identifier — see Google's disclosure: developers.google.com/maps/documentation/android-sdk/play-data-disclosure); Google Maps Platform (place search, details and travel times, called by our server); and Google Gemini only for Find in Topos: when you use it, the page text you share is sent via our server to Gemini to extract the place. Google states that paid Gemini API usage is not used to train its models (ai.google.dev/gemini-api/terms).
Retention and deletion (Topos): Used signed out, these records are tied only to the anonymous session token described above, not to a name or an account. Used signed in, they are linked to your Topos account — deliberately, so that deleting your account reaches the records written from every device you have used it on. Each record is automatically deleted 180 days after it is created. You may also erase all of your captured search activity at any time from the in-app My Activity screen ("Clear my activity"), which permanently deletes every search-origin record associated with your session token — the account-free equivalent of the account-deletion right described in section 6 ("Account Deletion"). That section's 7-day purge window applies to our account-based products; for Topos, records are purged on your in-app request (or on deletion of a Topos account, where one is used) and otherwise expire automatically at 180 days.
3. Third-Party AI Processing
Each app's part of section 2 says which of its features use an AI provider and what is sent.
We utilize enterprise-grade AI services for specific cognitive tasks:
LLM Reasoning & Insights
We use the Google Gemini API to generate briefings, summaries and other written output. What is sent depends on the app and is described in section 2. We use the paid Gemini API: under its terms, Google does not use prompts or responses to improve its products, and logs them for a limited period solely to detect misuse (Gemini API Additional Terms of Service, effective March 23, 2026).
4. Security
We protect your data with these safeguards:
- Data travels only over HTTPS (TLS 1.2 or 1.3).
- Administrative access is limited to our operators from a fixed network location, and traffic that looks like an attack is blocked automatically.
5. Your Rights & Data Portability
You maintain full control over your digital footprint. You have the right to request access to, correction of, or permanent deletion of your data. For portability requests or CCPA/GDPR inquiries, contact us at privacy@boxsight.ai.
6. Account Deletion
Upon initiating account deletion, all associated data—including saved content and metadata—is purged from our active systems within 7 days. This process is irreversible.