Privacy Policy

Shoebox (“Shoebox,” “we,” “us”) provides a mobile and web application that helps Canadian prairie grain farmers photograph, parse, store, and export grain elevator tickets. This policy explains what information we collect when you use the Shoebox app or visit shoe-box.ca, how we use it, who we share it with, and the choices you have.

By using Shoebox, you agree to this Privacy Policy. If you do not agree, please do not use the service.

Information you give us

• Account information. First name, last name, email address, username, province, and password (stored as a one-way hash). You may also link a Google account through Google Sign-In, in which case we receive your email address and basic profile information from Google.
• Grain ticket photos and PDFs. Images and PDF documents you capture or upload to record grain tickets. These files, along with the structured fields we extract from them (elevator name, date, commodity, weights, dollar amounts, and similar grain ticket fields), are stored on your behalf so that you can review, edit, and export them later.
• Manually entered ticket fields. Information you type or correct on a ticket review screen.
• Communications. When you submit our contact form or email support@shoe-box.ca, we receive your name, email address, and the contents of your message.

Information we collect automatically

• Device and usage data. Information needed to operate the app, including device type, operating system version, app version, and basic crash and error logs.
• Authentication metadata. Sign-in events, session tokens, and the IP address used to sign in. We use this to keep your account secure.

Information we do not collect

• We do not record audio or video.
• We do not collect your precise location (GPS).
• We do not access your contacts or text messages.
• We do not sell or rent your information to third parties.
• We do not show third-party advertising in the app.

• To provide the core service: storing your grain ticket photos and parsed fields, letting you review and edit them, and exporting your data as a CSV or Excel file.
• To run automated extraction of grain ticket fields from the photos and PDFs you upload.
• To authenticate you, secure your account, and respond to security incidents.
• To send you transactional emails (e.g. one-time passcodes, account verification, password reset, receipt confirmations, year-end exports).
• To respond to your support requests.
• To improve the app — for example, to fix parsing accuracy, diagnose crashes, and improve performance.
• To comply with legal obligations.

We use a small number of trusted service providers (“processors”) to run Shoebox. They process your information on our behalf, under contract, and only for the purposes described here.

• Supabase — database, authentication, file storage, realtime, and serverless functions. Your account information, grain ticket data, and uploaded files are stored on Supabase infrastructure (Canada region).
• Anthropic— provides the AI model that extracts fields from your grain ticket images and PDFs. When a ticket is uploaded, the image is sent to Anthropic for analysis. Anthropic does not use customer data submitted via the API to train its models. See Anthropic's privacy policy at anthropic.com/legal/privacy.
• Vercel — hosts the web application at shoe-box.ca and the contact form API. Receives the IP address and user-agent of visitors.
• Resend — sends transactional emails (account verification, OTPs, password resets, contact form auto-replies).
• ImprovMX — forwards inbound mail sent to addresses on the shoe-box.ca domain (e.g. support@shoe-box.ca) to our support inbox.
• Google— when you choose to sign in with Google, Google authenticates you and shares your email address and basic profile with us under Google's own privacy policy.
• Expo / EAS — used to build and distribute the mobile application. Receives anonymous build metadata only.

We store your account information, grain ticket data, and uploaded files on Supabase in the Canada (Central) region. Some of our service providers (notably Anthropic and Vercel) operate internationally and may process data in other countries, including the United States. By using Shoebox you consent to such cross-border processing.

• Account information — for as long as your account exists.
• Grain tickets and photos — until you delete them, or until you delete your account.
• Contact form messages — for up to 24 months, for support and abuse-prevention purposes.
• Authentication logs — for up to 90 days.

When you delete your account, we delete or de-identify your grain tickets, uploaded files, and profile information within 30 days, subject to any retention required by law.

We use industry-standard safeguards including encrypted transport (HTTPS/TLS) for all data in transit, encrypted storage at rest, row-level security in our database (so users can only access their own tickets), passwords hashed with a strong one-way algorithm, and protections against leaked-password reuse. No online service can guarantee absolute security; please use a unique password and keep your sign-in credentials private.

Depending on where you live, you may have rights under applicable privacy laws (such as Canada's Personal Information Protection and Electronic Documents Act). These typically include the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Delete your account and your data;
• Export a copy of your data;
• Withdraw consent to certain processing.

You can exercise most of these rights directly in the app — for example, edit any ticket field, delete tickets, change your password, and export your data as CSV or Excel. To delete your account or for any other request, email support@shoe-box.ca. We respond within 30 days.

Shoebox is intended for adults running farm businesses and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with information, please email support@shoe-box.ca and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top and, if the changes are material, notify you by email or in the app before they take effect.

Questions about this policy or about how we handle your information? Email support@shoe-box.ca or use our contact form.