Privacy, in plain language
Treasure Box holds your travel memories, so here's exactly what we keep and how it's protected. This is a plain-language notice, not legal boilerplate.
What we store
Your email address, the trips, moments, and notes you write, and the photos you upload. That's it.
Your password
Passwords are hashed by Supabase Auth (bcrypt) and never stored in plain text. No one — including us — can read your password.
Your photos
Photos live in a private storage bucket. They're served only through short-lived signed links to people on the trip — never publicly listed.
Who can see a trip
Only the people you invite. Access is enforced at the database level with row-level security, so a trip can't be read by anyone who isn't a member.
We don't sell your data
Your memories are yours. We don't sell or share them with advertisers.
Deleting your data
Want your account and everything in it removed? and we'll delete it, including your photos.