Privacy Policy

1. Who we are

LunchBox ClassX ("LCBX", "we", "us", "our") is a software studio based in Toronto, Ontario, Canada. We publish mobile applications on Google Play and build custom software, private APIs and machine learning solutions for clients.

We are the data controller for personal information handled through this website and through the apps we publish under our own name. For work we do on behalf of clients, see section 18.

2. What this policy covers

This policy applies to everything we publish, specifically:

• The website at lunchboxclassx.com, including every page on it;
• Did I Lock It (com.lunchboxclassx.didilockit);
• Tan Alert (com.lunchboxclassx.tanalert);
• Video Downloader LCBX (com.lunchboxclassx.videodownloaderultra);
• Brawl Matcher, once released — on both Android (Google Play) and iOS (the Apple App Store);
• Sky Divers Air Patrol, once released — likewise on Android and iOS;
• Any other app, game, tool, beta or web service LCBX publishes, unless that product displays its own separate privacy policy — in which case the more specific policy applies to it.

It also covers our support email, our contact form, and any pre-release or test build we distribute through Google Play's internal, closed or open testing tracks.

It does not cover third-party websites, app stores, advertisers or services you reach through links in our apps or on this site. Those operate under their own policies.

3. Information we collect

Our design principle across every app is the same: if the app can do its job without sending something to a server, it doesn't send it. Most of what our apps hold never leaves your device.

3.1 Information you give us directly

• Contact details — your name, email address and anything else you include when you email us or use the contact form.
• Project enquiries — details you share about something you'd like us to build, including any files or documents you send.
• Support information — the app name, device model, Android version, and the description, screenshots or logs you send when reporting a problem.
• Feedback — reviews, bug reports, feature requests and beta-testing feedback you choose to send.

The contact form on this website stores nothing on our servers — it opens your own email application with the details filled in, and the message reaches us as ordinary email.

3.2 Information created on your device and kept there

Each app stores its own working data locally — the things you track, your settings, your history. Details are listed app by app in section 4. We cannot see this data, we cannot retrieve it, and we cannot restore it for you if you delete it.

3.3 Information collected automatically

• Website hosting logs — our host may record standard technical data such as IP address, browser type, referring page and time of visit, for security and reliability.
• Crash reports and diagnostics — where enabled, reports telling us that an app crashed or a feature failed, including device model, Android version, app version and a stack trace. These are aggregated and are not used to identify you.
• Aggregated app store statistics — installs, uninstalls, ratings, countries and crash rates from Google Play, and the equivalent from Apple for any iOS release. Neither store gives us your name or account details.
• Advertising identifiers — in any app that shows ads, the ad network may access your device's resettable advertising ID. See section 7.
• Network requests — when an app needs data from an external service (for example weather data, or the file you asked to download), your device makes that request directly and the receiving service sees your IP address.

3.4 Information we never collect

• We do not require an account, sign-up or login to use any of our apps.
• We do not collect your name, phone number, contacts, calendar, photos or messages.
• We do not record audio, take photos, or read your files beyond what a feature you activated needs.
• We do not track you across other apps or websites, and we do not build advertising profiles about you.
• We do not sell, rent or trade personal information to anyone, ever, for any price.
• We do not collect payment card details — Google Play handles any transaction.

4. Our apps, one by one

This section is the specific, per-app detail. Where an app collects nothing, we say so plainly rather than leaving it vague.

4.1 Did I Lock It

What it stores

• The items you choose to track (for example "front door", "car", "garage") — including any name or label you type.
• Your check-ins: what you marked as locked and when.
• Your reminder schedule and app settings.

All of this lives on your device only. It is not uploaded, not backed up to us, and not visible to us in any form. If you type something identifying into a label, that stays local too.

What it sends

Nothing about your locks. The app's core features work offline. Reminders are scheduled through Android's own notification system on your device — they are not push messages from our servers.

Permissions

Notifications (for reminders). If you decline, the app still works, you just won't be reminded. Alarm and exact-timing permissions may be requested on newer Android versions so reminders fire when they should.

4.2 Tan Alert

What it stores

• Your skin type and any exposure preferences you set.
• Your session history and timers.
• Your chosen or last-used location, so the app can show conditions without asking every time.

All of this stays on your device.

What it sends

To tell you the UV conditions where you are, the app has to ask a weather data service about that place. When you grant location permission, your device sends an approximate or precise location to that provider and receives UV and weather data back. This is the one outward request the app makes, and it is made for the sole purpose of answering your question about the sun.

We do not keep a record of where you have been. We do not build a location history, we do not store your coordinates on our systems, and we do not share your location with advertisers.

Permissions

Location (approximate or precise) and notifications. Both are optional: decline location and you can enter a place manually or accept reduced accuracy; decline notifications and you simply won't get alerts. You can revoke either at any time in Android settings, and Android will tell you when location is in use.

4.3 Video Downloader LCBX

This app works differently from the others, because it connects to websites and services we don't control. That deserves spelling out in full.

What stays on your device

• The links you paste or open. A URL you give the app is used on your device to locate the media. We do not receive it, log it or store it anywhere.
• Your download history and library — file names, thumbnails, sizes and progress, kept in the app's local storage.
• The files themselves — saved to your device's storage. They never pass through our systems.
• Your settings — preferred quality, save location and similar options.

Clipboard access

If the app offers to paste a link you've just copied, it reads your clipboard at that moment only, purely to fill the link field, entirely on your device. Clipboard contents are never transmitted to us or retained by us. Android may display a "pasted from clipboard" notice — that's the system correctly reporting what the app just did.

Connections to third-party sites

When you download, your device connects directly to the site hosting that media — never through a server of ours. That third party sees what any visit from your device would show: your IP address, request headers, an approximate location derived from your IP, and what you asked for. Their policy governs that, not ours. If the app shows an in-app browser, any cookies or logins created there belong to that site and remain on your device. We operate no proxy, mirror or intermediary that could observe your download activity.

Notifications and background downloads

The app posts notifications for download progress and completion and may continue a download in the background. This runs on your device and can be switched off in Android's notification settings.

Your responsibility for what you download

The app is a tool for saving content you own, content offered for download, or content you otherwise have permission to save. You are responsible for ensuring a download is lawful and permitted by the terms of the source site, and for not circumventing technical protection measures. We don't monitor your usage — we can't, because none of it reaches us — which is exactly why that responsibility sits with you.

Permissions

Storage or media access (to save files and list your library), notifications (download progress), foreground/background service (to keep a download running), clipboard read (paste-link only), and internet access.

4.4 Brawl Matcher

Brawl Matcher is in development and not yet released. It will be published for both Android and iOS — through Google Play and the Apple App Store respectively. When it launches, this section will be updated with exactly what it stores, sends and requests on each platform, and that update will be published before the app appears in either store. Until then, no data is collected through it because it isn't available to use.

In the meantime, everything in this policy applies to it as an LCBX app: no selling of data, no cross-app tracking, and local-first storage wherever the feature allows.

On iOS specifically, we will not request App Tracking Transparency permission to track you across other companies' apps or websites, because we don't do that. Any permission the app asks for — notifications, or anything else — will be requested at the moment the feature needs it, and can be declined or revoked in iOS Settings, exactly as on Android.

4.5 Sky Divers Air Patrol

Sky Divers Air Patrol is in development for Android and iOS and is not yet released on either store. As with Brawl Matcher, this section will be updated with exactly what the game stores, sends and requests before it appears in either store, and no data is collected through it in the meantime.

As a game it may, once released, store local progress, scores and settings on your device. If any feature requires something to leave your device — online leaderboards, for instance — that will be described here before launch, and it will not be used to track you across other apps or companies.

4.6 Any other app or feature we release

If we ship a new app, a new feature, a game or a beta that collects something not described above, we will update this policy to describe it before or at the time that feature becomes available to you, and we'll update the "last updated" date at the top. Nothing we release is exempt from this policy just because it isn't named on this page yet — including for Brawl Matcher and Sky Divers Air Patrol.

5. Device permissions

Our apps request only the permissions a feature actually needs. In summary:

The table above describes our Android apps. Where an app is also released for iOS — Brawl Matcher, and any future app we ship on both — the equivalent iOS permissions are requested for the same reasons and are managed under iOS Settings → [app].

Every permission can be declined or revoked at any time in Settings → Apps → [app] → Permissions. Declining one disables only the feature that needs it — the rest of the app keeps working. We do not request permissions "just in case", and we do not request contacts, microphone, camera, SMS, call logs or body sensors in any app.

6. How we use information

We use what we collect only to:

• Provide and operate the features of our apps and website;
• Answer your messages, support requests and privacy requests;
• Prepare quotes and deliver client projects;
• Diagnose crashes, fix bugs and improve performance and stability;
• Understand, in aggregate, which features are used so we know what to improve;
• Keep our apps and systems secure and prevent abuse or fraud;
• Comply with legal obligations and enforce our terms.

We do not use your information for automated decision-making that produces legal or similarly significant effects about you. Where the law requires a legal basis (for example under the UK/EU GDPR), we rely on your consent, on performance of a contract with you, on compliance with a legal obligation, or on our legitimate interest in operating, securing and improving our software.

7. Analytics, crash reporting and advertising

Crash reporting and analytics

Where enabled, our apps report crashes and basic technical events through Google Play so we know something broke and can fix it. These reports contain device and app information — not the contents of your app data. A crash report from Did I Lock It does not include your lock labels; one from Video Downloader LCBX does not include your download links.

Advertising

Some of our apps are free and may display advertising. Where they do, ads are served by a third-party ad network, which may access your device's resettable advertising ID to select and measure them. We never pass your app content — your locks, your locations, your downloads — to an advertiser. You can reset or delete your advertising ID, and limit ad personalisation, under Settings → Privacy → Ads on your device.

If a particular app of ours shows no ads at all, then nothing in this subsection applies to it.

8. Device identifiers and backups

• Identifiers. We do not assign you a permanent user ID. Where an identifier is used at all — for crash grouping or advertising — it is one provided by the platform and resettable by you.
• Android backup. Android may include app data in your device backup to your own Google account, depending on your device settings. That backup belongs to you and Google, not to us; we cannot read it. You can disable backups in your Android settings.
• App caches. Our apps may keep temporary files (thumbnails, cached data) on your device to run faster. Clearing the app's cache in Android settings removes them.

9. Purchases and payments

If an app offers a paid version, a subscription or an in-app purchase, the transaction is processed by Google Play on Android or by Apple on iOS. We never see or store your card number, bank details or billing address. We receive only what the store tells us: that a purchase or refund occurred, and an anonymised token confirming your entitlement. Refunds and billing history are handled through your Google or Apple account.

For client work, invoices are handled by ordinary business means and any details you give us for that purpose are used only to bill you and to meet our accounting and tax obligations.

10. Third-party services and links

We rely on a small number of providers to operate. They may process limited data on our behalf:

• Google Play — distribution, updates, crash reporting, aggregated statistics, billing (Android).
• Apple App Store — the same functions for any app we release on iOS, under Apple's privacy policy.
• Weather and UV data providers — Tan Alert sends a location to receive conditions for that area.
• Advertising partners — where an app shows ads.
• Web hosting — our website host processes standard server logs.
• Email — messages you send us are handled by our email provider.

These providers are bound by their own privacy policies and, where applicable, by data-processing terms with us. We do not authorise them to use your information for their own marketing.

Sites you reach through our apps are a different matter. A link you open, or a site Video Downloader LCBX connects to, is not our service provider and does not act on our behalf — your device is simply visiting it, exactly as a browser would. What that site collects is governed by its own policy, and we have no visibility into or control over it.

11. Sharing and disclosure

We share personal information only in these situations:

• With the service providers listed above, to the minimum extent needed to operate our software;
• With your consent, when you ask us to;
• For legal reasons — if required by law, court order, subpoena or a valid request from a public authority, or to protect the rights, property or safety of LCBX, our users or the public;
• In a business transfer — if LCBX is merged with or acquired by another company, in which case we'll post notice here before your information becomes subject to a different policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under California law.

12. Retention

• Data stored inside an app stays on your device until you delete it or uninstall the app — your Did I Lock It log, your Tan Alert settings and history, your Video Downloader LCBX library and settings.
• We hold no server-side record of your in-app activity to delete, because we never receive it in the first place.
• Emails and support correspondence are kept for as long as needed to help you and keep a record of our work — typically no more than 24 months after the conversation ends.
• Client project records are kept for the duration of the engagement and for any period our accounting and tax obligations require.
• Server logs are kept for a short period for security and troubleshooting.
• Aggregated statistics that cannot identify anyone may be kept indefinitely.

13. Security

We use reasonable technical and organisational measures to protect information: encrypted connections (HTTPS/TLS), limited access to accounts and data, up-to-date dependencies, and a strong preference for keeping data on your device rather than on a server at all — the most reliable way to protect data is not to hold it. No method of transmission or storage is perfectly secure, so we can't guarantee absolute security, but we design to minimise what's at stake.

If a breach ever affects your personal information, we will notify affected users and the relevant authorities as required by law.

14. Your rights and choices

Depending on where you live, you may have the right to:

• Ask what personal information we hold about you;
• Request a copy of it, in a portable format;
• Ask us to correct information that's wrong or incomplete;
• Ask us to delete it;
• Withdraw consent you previously gave;
• Object to or restrict certain processing;
• Be free from discrimination for exercising any of these rights;
• Complain to a privacy regulator.

To exercise any of these, send us a request through the contact form and choose "Privacy request" as the topic — it reaches us by email immediately. We'll respond within 30 days. We may need to confirm your identity before acting, and we'll tell you if a request can't be met — for instance, we genuinely cannot produce a copy of app data we never received.

15. Deleting your data

You can remove your data yourself at any time:

• Inside an app — delete individual items, entries or downloads using the app's own controls.
• All app data — Settings → Apps → [app] → Storage → Clear data. This is irreversible and we cannot restore it.
• Everything — uninstall the app. Files you already saved to your device (for example downloads) stay until you delete them yourself.
• Permissions — revoke any permission in Android settings.
• Correspondence — email us and we'll delete the emails and support records we hold about you.

16. Region-specific rights

Canada

We handle personal information in accordance with PIPEDA and applicable provincial privacy legislation. You may complain to the Office of the Privacy Commissioner of Canada if you're not satisfied with our response.

United Kingdom and European Economic Area

Where the UK or EU GDPR applies, you have the rights listed in section 14, including data portability and the right to lodge a complaint with your local supervisory authority. Our legal bases are described in section 6.

California

Under the CCPA/CPRA you have the right to know, delete, correct and opt out of sale or sharing. We do not sell or share personal information as those terms are defined, so there is no opt-out to exercise — but the other rights are available to you through the contact details below, at no cost and without discrimination.

Everywhere else

If your local law grants you privacy rights not listed here, we'll honour them on request to the extent the law requires. Ask us.

17. Children's privacy

Our apps and website are intended for a general audience and are not directed at children under 13 (or the equivalent minimum age in your country). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we'll delete it promptly.

Where an app is age-rated in a store, that rating reflects its content. Parents can use Google Play's parental controls and Family Link on Android, or Screen Time and Ask to Buy on iOS, to manage what's installed and purchased.

18. Client project work

When we build software for a client, that client is the data controller for the information their product handles, and we act as a service provider (processor) working to their instructions. We use client data only to deliver the agreed work, we keep it confidential, and we return or delete it at the end of the engagement on request. Custom projects are covered by a separate written agreement, and where a client's product needs its own privacy policy, we help write one.

19. International transfers

We operate from Canada. If you use our apps or website from another country, the limited information described in this policy may be processed in Canada or in other countries where our service providers operate, under laws that may differ from your own. Where required, we rely on appropriate safeguards such as standard contractual clauses. By using our software, you consent to that transfer.

20. Do Not Track signals

Our website does not track visitors across other sites, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off. We honour such signals where the law requires it, and our default behaviour already matches what they ask for.

21. New apps and future features

This policy is written to cover LCBX as a whole, not just the apps named today. Any new app, game, tool, beta or web service we publish is governed by it from the moment it's released, unless that product carries its own more specific policy. If a new release collects something this policy doesn't yet describe, we will update this page to describe it at or before launch — including for Brawl Matcher.

22. Changes to this policy

We'll update this page when our apps or practices change. The effective date at the top always reflects the current version, and material changes will be highlighted here. Where the law requires it, we'll seek your consent again. Continuing to use our apps or website after an update means you accept the revised policy.

23. Contact us

Questions, privacy requests or complaints:
LunchBox ClassX
Toronto, Ontario, Canada
Send us a message

We don't publish an email address on this site — it only attracts spam — but the contact form delivers your message straight to us by email, and you can reply to our answer as normal. Choose "Privacy request" as the topic. We aim to reply within a couple of business days and, for formal requests, within 30 days.

← Back to home