Privacy

Last updated: October 30, 2026

Packing runs in your browser. Quick mode and the demo aren’t saved anywhere and need no account. In Saved mode your SKU library, boxes and stock levels are kept in your browser and, when you’re signed in with a free trial or active subscription, synced to your account, held for us by Cloudflare. Carina Dataworks never sees or stores your card.

BoxFit is operated by Carina Dataworks. The app is a static website: the packing math runs in JavaScript in your browser, and no server receives your items or boxes to pack them. Accounts run on a small Carina Dataworks service hosted by Cloudflare.

What is kept in your browser

BoxFit keeps these in this browser’s local storage on this device:

• Your Saved mode libraries: SKUs (name, size, weight, quantity, “upright”), boxes (name, inner size, weights, cost, stock level) and your stock levels.
• Small preferences: Quick or Saved mode, and inches/pounds or centimeters/kilograms.
• When signed in: your sign-in token and a note of the last synced version.

Quick mode and the demo are never saved. Clearing this site’s data in your browser deletes the copy in this browser; the synced copy in your account stays while your account exists. Signing out clears this browser’s copy of your libraries.

If you create an account

We store, in a database hosted by Cloudflare (Cloudflare D1):

• Your email address, when the account was created, and whether you have confirmed the email address.
• A scrambled (hashed, salted) version of your password. We cannot read your password.
• Sign-in sessions, stored only as a hash of the token, with an expiry. The token itself stays in your browser’s local storage.
• During your free trial or with an active subscription: your synced libraries (SKUs, boxes and stock levels), the device name they were saved from (for example “Win32” or “MacIntel”), and the previous three cloud copies as backups.
• Your subscription status, plan, trial and renewal dates, and the Stripe customer and subscription IDs.
• One free trial per email: so the free trial can’t be restarted, we keep a one-way scrambled (hashed) form of the email address and the date its trial ends, even after an account is deleted. It can’t be turned back into your email address, and nothing else is kept with it.
• To stop password guessing, short-lived counters of sign-in and password-reset attempts keyed by a scrambled (hashed) form of the IP address or email. They are deleted after a day.

Email we send you. Only account email: a link to confirm your address after sign-up, password reset links when you ask for one, and, during your free trial if you haven’t chosen a plan, a reminder about 3 days before the trial ends and one on the day it ends. It is sent from carinadataworks@gmail.com through Google Apps Script, so Google processes it under its own privacy policy. Links are single-use; we store only a hash of each, and they expire (1 hour for password reset, 3 days for confirmation). No newsletters or marketing email.

Deleting your account (Account › Delete account) deletes all of that right away, including the backups, and cancels any subscription.

Payments

Payments are handled securely by Stripe; Carina Dataworks never sees or stores your card. No card is needed for the free trial. When you choose a plan, Checkout and Manage billing open Stripe’s own pages, and your card details go straight to Stripe, which handles them under its own privacy policy. We get only your email (to link the Stripe customer to your account), the plan, the subscription status and its dates. Stripe’s pages may set their own cookies for fraud prevention.

Hosting

The site is hosted on Cloudflare Pages and accounts on Cloudflare Workers. Cloudflare may keep standard server logs (such as IP address, browser type and the time of the request) under its own privacy policy. BoxFit has no analytics, ads or trackers.

Cookies

BoxFit does not set cookies. Signing in keeps a token in local storage, not a cookie.

Your choices and rights

You can export your libraries (Export backup) and delete your account yourself at any time. You can ask to see or delete anything linked to your account by emailing carinadataworks@gmail.com. We will do it within 45 days. Depending on where you live (for example California or Connecticut), you may have other rights under state privacy law; ask and we will help. We do not sell personal information or share it for advertising.

Children

BoxFit is a business tool and is not meant for children under 13. We do not knowingly collect information from them. If you think a child created an account, email us and we will delete it.

Changes

If this page changes, the “Last updated” date above changes too. If a change matters for how we use account data, we will email account holders.

Contact

Questions about this page: email carinadataworks@gmail.com. BoxFit is operated by Carina Dataworks.