Privacy Policy — Box Messenger
Last Updated: November 4, 2026
This Privacy Policy applies to the Box Messenger mobile application for Android (the "App") and the website https://box-messenger.tech (the "Website"), together referred to as "BM".
Developer / Data Controller: Individual Entrepreneur Nikolai Mikhailovich Kozakov (IP Kozakov N. M.), OGRNIP 325774600585181, INN 772743126265, D-U-N-S Number: 933900059 ("we", "us", "our").
Contact email: info@box-messenger.tech
By using BM you confirm that you have read this Policy. If you do not agree with it, please do not use BM.
1. Summary
- BM is a messenger for exchanging messages and files over the Internet and over the "BoxNet" technology (Bluetooth / Bluetooth Low Energy).
- On Android 11 and lower, the App requests Location permission (precise and approximate), including in the background. This is required by Android only to discover nearby Bluetooth devices. We do NOT collect, store, transmit or share your GPS coordinates or any location data.
- We do not sell your personal data and do not use it for advertising.
- You can delete your account and data at any time (see Section 9).
2. Data We Collect
2.1. Data you provide
- Account data: username, email address, password (stored only as a hash), confirmation code sent to your email.
- Messages and files you send or receive (text, images, documents and other files).
- Support requests and feedback you send to us, including refund requests.
- Payment and balance data: order number, number of KBX purchased, amount, discount, payment status, the bank's payment identifier, payment and refund dates, KBX credit and debit history, chest records (identifier, Device, issue and opening dates) and Premium subscription status. Card number, expiry date and CVC are entered on the bank's payment page; we never receive or store them.
2.2. Data collected automatically
- Device information: device model, Android version, app version, app-generated identifiers.
- Diagnostic data: crash logs, error reports, technical performance data.
- Bluetooth data: Bluetooth identifiers of nearby BM devices and technical connection logs, used to deliver messages via BoxNet.
- Notification data: tokens and events needed to deliver notifications.
2.3. Location data
What is accessed. On devices running Android 11 (API 30) and lower, the App requests the permissions ACCESS_FINE_LOCATION (precise location), ACCESS_COARSE_LOCATION (approximate location).
Why. On these Android versions, the operating system requires location permission for any app that scans for nearby Bluetooth Low Energy devices, because Bluetooth scan results could theoretically be used to infer a location. BM needs Bluetooth scanning to find other nearby BM devices and to transmit messages through BoxNet without Internet access. Background access is needed so that messages can continue to be received and relayed via BoxNet while the App is closed or not in use.
What we do NOT do.
- The App does not request, read or record GPS coordinates or any geolocation of your device.
- Location data is not stored on the device or on our servers, is not transmitted to us or third parties, is not used for advertising, analytics or profiling, and is not shared with other users.
Android 12 and higher. On Android 12 (API 31) and above, the App uses the BLUETOOTH_SCAN permission with the neverForLocation flag, which tells the system that Bluetooth scanning is never used to derive location. Location permission is not requested on these versions.
Your choice. Location permission is requested only after an in-app explanation and only with your consent. You can deny or revoke it at any time in Settings → Apps → Box Messenger → Permissions. If you do, BM will continue to work over the Internet, but BoxNet (Bluetooth) messaging may be unavailable on Android 11 and lower.
3. Permissions Used by the App
| Permission | Purpose |
|---|---|
INTERNET | Sending and receiving messages and files over the Internet |
BLUETOOTH, BLUETOOTH_ADMIN (Android ≤ 11) | Bluetooth connections for BoxNet |
BLUETOOTH_SCAN (neverForLocation), BLUETOOTH_CONNECT, BLUETOOTH_ADVERTISE (Android 12+) | Discovering, connecting to and being visible to nearby BM devices |
ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION | Required by Android for Bluetooth scanning only; no location data is collected (see 2.3) |
READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE | Selecting files to send and saving received files |
POST_NOTIFICATIONS (Android 13+) | Showing notifications about new messages |
4. How We Use Data
- To provide the App's core functionality: registration, authorization, sending and delivering messages and files over the Internet and BoxNet.
- To send notifications about new messages.
- To ensure security, prevent fraud and abuse.
- To diagnose and fix technical issues and improve stability.
- To respond to support requests.
- To accept payments, credit and debit KBX, issue chests, account for BOX and Premium, handle refund requests, and send fiscal receipts to your verified email address.
- To comply with legal obligations, including accounting and fiscal receipt requirements.
We do not use your data for advertising and do not sell it.
5. Storage and Security
- Messages and files are stored mainly locally on your device. Encrypted content may be temporarily stored on servers or on other devices participating in BoxNet solely to deliver it to the recipient; relaying devices cannot read it.
- Data transmitted over the Internet is protected with encryption in transit (HTTPS/TLS).
- Encryption keys are stored on the device using Android's secure storage mechanisms.
- No method of transmission or storage is 100% secure; you are responsible for protecting your device and credentials.
6. Data Sharing
We do not sell or rent personal data. We may share data only:
- with service providers (hosting, email delivery, crash reporting) strictly to operate BM and under confidentiality obligations;
- with the acquiring bank JSC "TBank" — order number, amount, purchase details and the email address for the receipt — solely to process payments and refunds and to issue fiscal receipts;
- when required by law, court order or a lawful request of a government authority;
- in the event of a reorganization or transfer of the business, with prior notice to you.
Location data is never shared with anyone.
7. Data Retention
- Account data is kept while your account exists and deleted within 30 days after account deletion, unless retention is required by law.
- Messages temporarily held for delivery are deleted after delivery or after expiry of the delivery period.
- Diagnostic data is kept for no longer than 90 days.
- Payment, refund and KBX transaction records are kept for as long as tax and accounting law requires (generally at least 5 years), including after account deletion.
- Local data is deleted when you uninstall the App or clear its data.
8. Children
BM is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we will delete it.
9. Your Rights and Account Deletion
You may at any time:
- access, correct or delete your data;
- revoke any permission in your device settings;
- withdraw consent to data processing;
- delete your account on the Website or by sending a request from your registered email to info@box-messenger.tech. Your account and associated data will be deleted within 30 days.
Depending on your country, you may have additional rights under applicable law (including Federal Law No. 152-FZ "On Personal Data" of the Russian Federation and the GDPR).
10. Third-Party Services
BM may contain links to or integrations with third-party services. They have their own privacy policies, and we are not responsible for their practices.
11. Changes to This Policy
We may update this Policy. The new version takes effect when published in the App or on the Website. We will notify you of material changes in the App.
12. Contact Us
IP Kozakov Nikolai Mikhailovich
OGRNIP 325774600585181, INN 772743126265
D&B D-U-N-S® Number: 933900059
Email: info@box-messenger.tech
Website: https://box-messenger.tech