Privacy Policy
Last updated: 4 September 2026
This privacy policy applies to the Box Master mobile application, operated by Veljko Vulovic (Box HQ).
Camera Permission
Our app requests access to your device's camera solely for the purpose of scanning QR codes at gym check-in points. We do not capture, store, or transmit any images or video from your camera.
Information We Collect
We collect only the information necessary to provide our gym management services:
- Account details — your name and email address. A phone number and date of birth are optional.
- Membership and attendance — your subscription periods, check-ins, class bookings and your personal check-in code.
- Payment records — which membership periods your gym has recorded as paid, and the amount. We never receive or store card or bank details; payment is arranged directly with your gym.
- Training data — workout results you log, any personal records they set, and free-text notes you write with them.
- Support messages — the text you send through the in-app feedback form, together with your app version and device model.
- Push notification tokens — issued by your device, used only to deliver notifications from your gym.
- Diagnostics — crash reports and app performance data. These are not linked to your name, email or account.
How We Use Your Information
- To manage your gym membership, attendance and class bookings
- To show you your training plan, your results and your personal records
- To send push notifications about classes and schedules
- To send account emails, such as password resets and membership reminders
- To provide customer support
- To diagnose crashes and improve the app's performance
We do not use your data for advertising, we do not sell it, and we do not track you across other companies' apps or websites.
Data Sharing
We do not sell or rent your personal data. We share data only with service providers that help us operate the app, and only as needed:
- Google Firebase Cloud Messaging — to deliver push notifications (receives your device's push token).
- Resend — to send transactional emails such as password resets (receives your email address).
- Sentry — crash reporting and performance monitoring (receives error and performance data; it is not sent your name, email or account identifier).
- Railway — cloud hosting and database where your data is stored.
We may also disclose data where required by law.
Data Security
Your data is stored securely and protected using industry-standard encryption and authentication practices.
Data Deletion
You can permanently delete your account at any time, directly in the app: open Profile → Help & Legal → Delete Account and confirm. When you do, the following happens immediately:
- Your personal information (name, email, phone number, password, and check-in code) is erased.
- Your push notification tokens are deleted, so you stop receiving notifications.
- Any upcoming class bookings are cancelled.
You can also request deletion by email: contact veljkovulovic1@gmail.com with the subject Account Deletion Request – Box Master and your account email address; we process such requests within 7 days.
For full details, see our Account Deletion page.
Data Retention
After deletion, some records are kept in anonymised form – no longer linked to your name, email, or phone number – for legitimate business and legal/accounting purposes:
- Attendance and check-in history
- Membership and payment records
These anonymised records cannot be used to identify you.
Contact Us
If you have any questions about this privacy policy, please contact us at veljkovulovic1@gmail.com.