Privacy

Your shows, buyers, orders, box assignments and printed labels are stored in a database file in your own user-data directory, together with a rotating application log. None of it is uploaded anywhere by WhatBox. If you delete the app's data directory, it is gone, and we cannot recover it because we never had it.

Exactly four things, when it checks or refreshes your licence:

• Your licence key.
• An identifier for the machine, which we convert into a keyed hash on arrival. The original value is never written to our database.
• An operating system name, so support can tell a Mac problem from a Windows one.
• The app version, for the same reason.

You may also give the machine a name — “Front of house”, “Packing desk” — so you can tell your two seats apart on your licence page. That name is yours and you choose it; leave it blank and we store nothing.

If something goes wrong, the app can send us a diagnostics bundle — but only when you press the button, and only after it has shown you what the bundle contains and you have confirmed. Nothing is ever sent automatically, and there is no crash reporting running in the background.

A bundle contains the app's own log files, a description of your setup — versions, printer state, counts from your most recent show, and the settings that matter for support — plus a message from you if you choose to write one. It never contains your sales, buyers, items or prices, and buyer usernames in the logs are replaced with hashes before the bundle is made. The bundle goes straight to private storage, not through our web servers; we record that it exists, how large it is, and which licence sent it.

Our support system then opens the bundle once to prepare a summary for the person helping you: the setup description, and the warnings and errors from the logs. That summary is kept with your support ticket so we can still answer you after the bundle is gone; the full log files are not kept. Where we use an AI model to help interpret a bundle, it is given that summary and your message only — never your email address, licence key or any identifier — and nothing it writes is sent to you without a person reading it first. Support can also download the bundle by hand, and every download is written to the same audit record as administrative actions. Bundles are deleted after thirty days.

We hold your email address because a licence has to belong to somebody, support has to be able to reply, and your licence key has to be recoverable if you reinstall.

If you start a free trial we also store a keyed hash of that address, separately from the address itself. It exists for one purpose: to stop the same person taking an unlimited number of free trials. It cannot be turned back into your address.

Payment is handled by Paddle, our merchant of record. They take the card, work out the tax, and hold whatever billing details you give them under their own privacy policy. We never receive or store card details, and we never see your billing address.

What does reach us is the shape of the arrangement rather than the means of paying for it: that a subscription exists, its status, the date it is paid through, and a record of each payment — its date, its amount, and whether it was refunded. We keep those so we can answer what you paid and when without sending you off to look it up somewhere else.

Transactional messages only: your licence key when you start a trial, and a sign-in link when you ask for one. There is no marketing list to unsubscribe from because there is no marketing list.

Our server logs are redacted before they are written. Licence keys, tokens, machine identifiers and anything resembling a credential are replaced with a placeholder on the way in rather than filtered later. We keep an audit record of administrative actions taken on a licence — a grant, a revocation, a released seat — because when a customer says they were cut off wrongly, that record is the only thing that can answer them.

Licence and subscription records are kept while your licence exists and for as long afterwards as tax and accounting rules require. Rate-limiting records are transient and are overwritten continuously. Ask us to delete your account and we will, with the exception of records we are required to retain and the trial hash — deleting that one would hand out a second free trial, which is the one thing it exists to prevent.

Our hosting provider and database provider, because the service runs on their infrastructure, and our email provider, for the two messages described above. Nobody buys, sells or rents this data, and there is no advertising or third-party analytics on this site or in the app.

Questions, corrections, or a deletion request: hello@whatbox.live. A person reads it. See the contact page for what to include, and the terms for the rest.