隐私政策
In one sentence:The images you process never leave your device; we only store your email and password hash when you sign up for an account.
1. What we store
never stored: the images you choose or process, file names, processing results, and recognized text. All of this is processed in your browser and is never sent to any server.
Only saved when you register an account：
- Email address (for sign-in)
- Nickname (defaults to email prefix; editable)
- scrypt hash of the password (one-way, can't be reversed)
- With Google sign-in: Google's user ID (sub) and avatar URL
- Registration time, last sign-in time
Cookie: there's only one bk_session, used to keep you logged in (HttpOnly, Secure, SameSite=Lax, 30 days). It is not used for tracking or ad profiling.
2. What we do not do
- All page assets are self-hosted: the footer shows in real timeExternal requests this session, which you can verify yourself
- The only exception: youexplicitly clicked"Sign in with Google" connects your browser to
accounts.google.com(The footer counter will +1 here — this is triggered by you)
3. Accounts are optional
Using the tools requires sign-in (email or Google account — free, unlimited). This is only to prevent abuse; the account itself carries no extra permissions. If membership/quotas are added later, it will be announced on this page in advance.
Account deletion & data removal: email us at support@boxkit.dev, with the email to delete. We'll remove the account and all its data within 7 days (no self-serve deletion yet — a known gap).
四、服务条款与退款
5. Policy changes
If the content of this page changes, the date below is updated; major changes involving account data will be announced separately on the site.
最后更新：2026-09-18