Privacy Policy

Last updated October 28, 2026

Back of the Box makes a daily printable page of puzzles, facts and news for kids, and emails it to a parent. This page explains what we collect to do that, and what we do with it. The short version: we collect the minimum, we don’t sell it, and kids never have accounts.

Who this is for

Back of the Box is used by parents and guardians. Children do not sign in, and we don’t knowingly collect information directly from children. A parent creates each page and chooses what goes in it.

What we collect

Your Google account email when you sign in with Google. We use it to identify your account and to send the daily email. We don’t store your Google profile name or photo.
What you enter: each page’s first name or nickname for the child (you can use any name you like), an age range, the modules you choose, delivery time and time zone, the email address it’s sent to, and your weather city or ZIP, favorite sports teams and stock tickers if you add them.
Google Calendar events (optional, currently paused): if Calendar sync is offered and you turn it on, we ask Google for read-only access to your calendars so we can show today’s events on the page. We only read event titles and times for the calendar you pick, and only to build that page. We don’t change anything in your calendar.
Billing information: payments are handled by Stripe. We never see or store your card number. We keep your plan, subscription status and Stripe customer ID.
Support messages you send us through the help chat or by email.
Basic usage and delivery logs, such as which days a page was delivered and error logs, to keep the service running.

How we use it

To sign you in, build and deliver each daily page, run your subscription, answer support requests, and keep the service working and safe. We don’t use your information for advertising and we don’t sell or rent it.

Who we share it with

Only the services that help us run Back of the Box, and only what they need:

Google, for sign-in and (if you enable it) read-only Calendar access.
Stripe, to take payments.
Resend, to send the daily email.
Supabase and Vercel, to store your data and host the app.
Anthropic, whose AI models rewrite news into kid-friendly text and power the help chat. News rewriting doesn’t use your personal information. Messages you type into the help chat are sent to Anthropic to generate a reply.
Law enforcement or others only if the law requires it.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Calendar data is used only to show your events on your page. It is never used for advertising, sold, or used to train AI models.

How long we keep it

We keep your account data while your account is open. Delete a page and its settings go with it. To close your account and delete everything, email us and we’ll do it. We may keep billing records as long as the law requires.

Your choices

Ask to see, correct or delete your data any time by emailing us.
Turn off the Calendar module, or remove Back of the Box’s access at myaccount.google.com/permissions.
Unsubscribe or pause by making a page inactive, or cancel your plan on the Plan page.

Security

Data is stored with reputable providers and sent over HTTPS. No system is perfectly secure, so we can’t promise absolute security, but we take reasonable steps to protect your information.

Changes

If we change this policy in a meaningful way we’ll update the date above and, where appropriate, tell you by email.

Contact

Questions or requests: support@backofthebox.xyz.