EFFECTIVE JULY 27, 2026

Privacy Policy

BoxWherever is operated by Archieboy Holdings, LLC (“Archieboy,” “we,” or “us”). This policy explains the information used by BoxWherever.com, BoxWherever Studio, and the BoxWherever Quest application.

Information we collect

• Account information: email address, name or nickname if supplied, encrypted password credentials, account dates, and acceptance of our Terms.
• Household profiles: profile names and each profile's songs, workouts, scene choices, calibration, and other preferences. Household profiles are managed inside the primary account and do not require separate email, Facebook, or Meta accounts.
• Your workout content: audio and panorama files you upload, song titles, choreography maps, workout preferences, and selected scene coordinates, panorama identifiers, and facing direction.
• AI song information: the story and genre you submit, composition status, generated song files, your selected version, and song-creation credit history.
• Purchase information: pack size, amount, payment status, and Stripe transaction identifiers. Stripe processes payment-card details; BoxWherever does not store full card numbers.
• Quest connection information: a device identifier and name, a one-way hash of its pairing token, and paired/last-connected times. When you pair a headset bought through the Meta Horizon Store, we also receive from Meta an app-scoped Meta user identifier for your account, together with a one-time verification code and the time we verified it. The identifier is specific to BoxWherever and cannot be used to identify you in other apps; we store the identifier and the verification time, and we do not store the one-time code. We use it only to confirm that the purchaser and the Studio account holder are the same person, and to stop one purchase from activating several unrelated accounts. We do not receive or store your Meta username, profile photo, age group, or friends list.
• Technical and security information: IP address, browser/device information, referral or campaign parameters, session cookies, and server/error logs.
• Support communications: the information you choose to include when contacting us.

Quest controller and headset movement is processed locally in real time to detect punches, blocks, and dodges. The current release does not upload raw body tracking, biometric data, health measurements, or workout scores to our servers.

How we use information

We use information to create and deliver workouts, pair your headset, secure and operate accounts, provide support, prevent abuse, troubleshoot crashes, improve reliability, meet legal obligations, and communicate service-related information. Where applicable, our legal bases are performance of our agreement with you, our legitimate interests in operating and securing the service, your consent for optional content, and compliance with law.

Music and scene processing

Your uploaded music is stored inside your private household account and processed to detect musical timing and generate choreography. Every household profile can see the household song catalog and choose which songs to use in that profile's Quest library. Only the profile that added a song can edit or delete it. Household songs are not placed in a public music library or sold. When you ask for an AI song, we send your story, genre, and production instructions to ElevenLabs, receive two generated audio files, and store them inside the household so you can preview, select, download, and use one in a workout. Do not put sensitive personal information in a song prompt. Google location scenes are requested live when selected and are not stored for offline use. A user-uploaded panorama is stored with that user's workout.

Service providers and disclosures

We use service providers only as needed to operate BoxWherever, including Amazon Web Services for hosting and operational email, Stripe for payment processing, ElevenLabs for AI music generation, Google Maps Platform for location imagery, Apple’s public iTunes catalog service for search and previews, and Meta for Quest distribution and operating-system services. Their handling of information is governed by their own terms and privacy policies. We may disclose information when required by law, to protect users or the service, or as part of a business transaction subject to appropriate safeguards.

We do not sell personal information, share it for cross-context behavioral advertising, or use third-party advertising trackers.

Cookies

BoxWherever uses essential cookies for sign-in, security, preferences, and attribution of how a visitor reached the site. We do not use advertising cookies.

Retention and security

A personal song's audio is retained for 12 months after its last complete play. Beginning about 30 days before expiration, Studio and the Quest app display an on-screen warning; we do not send song-expiration emails. Completing the song renews its audio for another 12 months. If it expires, we remove the audio but retain the small choreography map, scene identifier or uploaded panorama, facing direction, rotation setting, and other workout details. Re-uploading the exact same recording restores those saved details. The included shared BoxWherever song does not expire. When you delete a workout, its active workout files and saved details are removed; a separately created AI song remains available in Studio until account deletion. When you delete your account, account records, household profiles, workouts, generated songs, scene uploads, unused credits, and paired-device credentials are removed from active systems, while transaction records may be retained where required for tax, accounting, fraud prevention, or legal compliance. Protected disaster-recovery backups may retain encrypted copies for up to 90 days before aging out. Security and access logs are retained only as reasonably necessary for operations, fraud prevention, legal compliance, and incident investigation.

We use HTTPS, access controls, hashed passwords and device tokens, private per-user storage, release signing, rate limits, and restricted backups. No system can promise absolute security.

Your choices and rights

You can download a machine-readable account export or permanently delete your account from Account. You may also ask to access, correct, delete, restrict, or obtain a copy of personal information, or object to certain processing, by contacting us. Rights vary by location. We may verify your identity before completing a request.

Children

BoxWherever is a general-audience fitness service and is not directed to children under 13. We do not knowingly collect personal information from a child under 13. Users aged 13 through 17 may use the service only with permission and supervision from a parent or legal guardian.

International use and changes

BoxWherever is operated from the United States, so information may be processed there. We will post material policy changes here and update the effective date; when required, we will provide additional notice or request consent.

Contact

Archieboy Holdings, LLC · Email higgins@archieboy.com with “BoxWherever Privacy” in the subject line.