Security and privacy

Your moving inventory should stay yours.

BoxBuddy is built around simple controls: sign in to manage your move, keep QR codes private by default, invite only the people you trust, and back up the data that helps you find your life again after moving day.

Download BoxBuddy Read the privacy policy

How BoxBuddy protects your move

Security should be understandable. Here is what is in place today.

1

Account-based access

Your moves, rooms, boxes, notes, and photos are tied to your account. Shared moves use invite-based roles so helpers only get the access they need.

2

Private QR controls

Printed QR labels use public web links so any phone can scan them. The server still decides what to show. Private boxes stay hidden from anonymous scanners.

3

Backups and deletion

Production runs nightly database and upload backups, including offsite backup copies. Account deletion is available in the app and removes account-linked data.

Direct answers

The questions customers usually ask before trusting an app with photos of their belongings.

Can movers or family scan labels without installing BoxBuddy?

Yes. BoxBuddy labels open a normal web page. A helper can scan with an iPhone or Android camera without downloading the app.

Does scanning a QR code make my box public?

No. The QR code is a link, but BoxBuddy only shows contents anonymously when that box is marked public. New boxes default to private QR visibility.

Where are photos stored?

Current production image uploads are configured for Cloudflare R2. Legacy local upload storage may still exist for older files. Direct file URLs are hard to guess, but they are not expiring signed URLs yet.

Are backups tested?

Yes. BoxBuddy runs nightly backups, and the July 4, 2026 database backup was restored into a disposable Postgres container as a restore drill.

Can BoxBuddy claim encrypted-at-rest storage?

Not as a blanket claim today. HTTPS protects data in transit, and R2 storage is configured for image uploads, but the current VPS filesystem itself is not encrypted at rest. We prefer being exact over sounding fancy.

Can I delete my account?

Yes. Account deletion is available in the app. You can also read the public deletion instructions at boxbuddy.tech/account-deletion.

Built for real moving-day trust.

Use public QR labels when helpers need quick access. Keep private QR on when the box contains personal items. You stay in control.

Get BoxBuddy