Privacy policy

Bin by Bin is a home inventory app operated by Enjoix Labs LLC. This policy says what we collect, where it goes, how long it stays, and what we can see from our side. It covers the hosted service at binbybin.app and the mobile app when it is signed in to that service. Running the app against your own server is covered at the end, and the short answer there is that none of this involves us.

The short version#

• We collect your email address and the inventory you create: bins, items, rooms, homes, and the photos you add.
• Photos you scan go to Anthropic to be read by an AI model. Item and bin text goes to Voyage AI to build your search index.
• There is no advertising, no ad network, and no analytics or crash-reporting toolkit in the app. This site counts page visits without cookies, as described below. We do not sell your data.
• You can delete your account and everything in it at any time, and the deletion is real.
• On our hosted service, we could read your inventory text and open your photos if we chose to. We do not, and no screen in the product shows them to us, but nothing cryptographic stops us. Anyone who tells you otherwise about a service like this one is describing a product with client-held keys, and we are not that yet. If that matters to you, run your own server.

Who we are#

Enjoix Labs LLC. Reach us at privacy@enjoixlabs.com for anything in this document.

What we collect#

• Account. Your email address and a password. The password is stored only as a bcrypt hash, so we never hold the password itself.
• Your inventory. Names, descriptions, tags, quantities and minimum quantities, barcodes, room and location labels, home names, dates you record against an item (expiry, warranty, maintenance, cancellation), loan details including who you lent something to, review notes, and any photos you add.
• Usage counters. For each call to a paid AI feature we record which provider and model ran, the token counts, an estimated cost, and a random per-sign-in session id. This is what makes the Smart Scan count in Settings possible. The session id is random and is not your IP address.
• Subscription status. If you subscribe, which plan you are on, when the current period ends, and any top-up scans you have bought and not yet used. The purchase itself happens in the App Store or Google Play, so we never see your card and no payment detail reaches our server.
• Push tokens. If you turn notifications on, the token your device is issued by Google Firebase Cloud Messaging, plus the platform and when it was last seen.
• Feedback. If you send feedback from inside the app, your message along with your app version, platform and account email.
• Onboarding events. The app reports which steps of first-run setup were reached, keyed to a random id the app generates on the device. These rows carry no account link and no inventory content, only an id and a step name, and they are deleted after 60 days.

What leaves your device, and where it goes#

Our server writes one log line for each request it answers: the time, which part of the service was called (never the rest of the address, which can carry details), the response status, size and timing, your account id when you are signed in, and the app's build number when the app sends one. It never records your IP address. Those lines sit in our hosting provider's logs. Our hosting providers also keep their own platform logs, which do include IP addresses, under their retention terms.

What we can see#

We think this is the part worth being plain about.

On the hosted service, your item and bin text sits in ordinary database columns and your photos are ordinary image files in our storage bucket. We hold the credentials for both. Provider encryption at rest protects against someone walking off with a disk, and nothing more, because the provider holds that key.

So: we have the technical ability to read your inventory and open your photos. What limits it is practice rather than mathematics.

• There is no feature anywhere in the product that shows us your items. Our admin tools expose exactly two things, usage totals and quota settings.
• Each account's data is walled off from every other account, including for photos: a photo can only be fetched by the account that owns it.
• The app carries no analytics, crash-reporting or advertising toolkit, so there is no second copy of your activity anywhere. The visit counter on this site, described below, never sees your inventory.

Two things follow from the design. The search index is derived from your text, so it doesn't hide that text from us. And the shape of your data, how many rooms you have, what they are called, how many items are in each, when you added them, is visible without reading the actual words.

We don’t claim to be “zero-knowledge,” “end-to-end encrypted,” or unable to see your data, because none of those things are true for the hosted version of the service.

Sending your content to AI providers#

Two features work by sending your content to a provider we do not control.

Anthropic, for Smart Scan. The photo you scan is forwarded to Anthropic's API from the upload, read by a Claude model, and the item list comes back. We never store or serve that image ourselves. Anthropic states that API inputs and outputs are not used to train its models, and that it deletes them within 30 days, keeping them up to two years if its automated trust and safety systems flag the request. That is Anthropic's statement about its own service, not ours; their current terms are the authority.

Voyage AI, for search. The text of a bin or item goes to Voyage when you save it, and your query goes to Voyage when you search, so that both can be turned into the vectors semantic search compares. We have opted our account out of Voyage storing that text and using it for model training, which Voyage describes as zero-day retention. The opt-out took effect on October 28, 2026. Text sent before then was handled under Voyage's default, which is to store customer content and allow it to be used for future model training.

Neither call carries your email address or account id.

If you would rather this did not happen at all, Smart Scan is something you choose per photo rather than something that runs on its own, and keyword search against your own device keeps working with the semantic half turned off.

Barcode lookup#

When you scan a barcode, the number is sent from your device to two public product catalogs, UPCitemdb first and Open Food Facts if there is no match, so the name, description and tags can be filled in for you. Only the number is sent. No photo, no bin, no item detail and nothing identifying you or your account goes with it. This happens whether or not you are signed in, and on your own server as well as ours. Typing the number in by hand instead of scanning it sends nothing.

Subscriptions and purchases#

If you pay for a plan, the purchase is handled by Apple or Google, not by us. We never see your card number, and no payment detail reaches our server.

We use RevenueCat to find out whether a subscription is active. Your app store reports the purchase to RevenueCat, and RevenueCat tells our backend which plan you are on, when the current period ends, whether you are in a free trial, and whether the purchase was refunded. To ask that question we send RevenueCat a random billing id we generate for your account. That id is not your email address and not your account number, and your purchase history is held by RevenueCat against it.

Deleting your account tells RevenueCat to delete that customer record too. It does not stop a subscription from renewing, because only the store that sold it can do that. See the deletion section below.

Notifications#

If you turn on low stock alerts, the notification is delivered through Google Firebase Cloud Messaging, and the text of that notification names up to three of the items that are low. Google handles the message in order to deliver it. This is worth knowing before you turn the feature on: a notification appears on a lock screen, and it says what it is about.

Visits to this site#

This site, www.binbybin.app, counts page visits with Vercel Web Analytics. For each page view it records the page address, the page that linked you here, the country, region and city you are browsing from, your browser, operating system and device type, and the time. It sets no cookies. Vercel tells one visitor from another with a hash computed from the incoming request and discards it after 24 hours, so the counts are not tied to your IP address or to any account. We see totals, not individual visitors.

The counter runs only on these pages. The web dashboard and the mobile app do not carry it.

Our company page at enjoixlabs.com counts visits in a similar way with Cloudflare Web Analytics, which also sets no cookies.

Providers we use#

Each of these processes your data only to provide their service to us.

We do not sell your personal information and we do not share it for advertising.

How long we keep things#

• Your account and inventory: while the account exists. Deleting the account removes them.
• A photo you delete in the app: moved out of the live bucket immediately, then destroyed by a storage rule 30 days later. That window exists so a deletion caused by a bug in our code is recoverable. Deleting your whole account skips it and destroys the file outright.
• Onboarding events: deleted nightly once they are 60 days old.
• Site visit records: Vercel keeps one record per page view, carrying the details listed under "Visits to this site" and no cookie, account or IP address, under its own retention terms. It discards its per-visitor hash after 24 hours. Cloudflare keeps the enjoixlabs.com visit data under its own terms.
• AI usage counters: kept while the account exists, deleted with it.
• After you delete your account: we keep a one-way fingerprint of your email address for 90 days, with how many Smart Scans the account had used, so that free scans can't be reset by deleting an account and signing up again. It is a keyed hash, so it can't be read back as an address. We work it out after removing any +tag from the address and, for Gmail, the dots, so those variants match too. All we can do with it is check whether a new signup matches, which is the only use we make of it. After 90 days it is deleted.
• Subscription records: kept while the account exists. Deleting the account removes our copy and tells RevenueCat to delete theirs.
• Backups: we take a nightly database dump so an account is recoverable after an outage or a mistake on our side. A deleted account can persist in those dumps until they age out.

How your data is protected#

• Every connection to the app, the dashboard and this site uses HTTPS.
• Passwords are stored only as bcrypt hashes.
• Photos are in a private bucket with no public URL, served through links that expire after about five minutes, and a photo can only be fetched by the account that owns it.
• Sign-in sessions on the web use host-locked, HTTP-only cookies.
• On your phone, the app keeps its own copy of your inventory so it works offline. That local database is not encrypted by the app, so on a rooted or jailbroken device it is readable. Your sign-in token is held in the operating system's keystore rather than in that database. Your device's own full-disk encryption, and the screen lock that gates it, are what protect the local copy.

No system is perfectly secure. This section describes what we do, not a guarantee.

Deleting your account#

You can delete your account from Settings in the app, or from the account deletion page on the web without installing anything. Both ask for your password.

It is a real deletion and not a flag. The rows go, the photos are destroyed outright rather than parked in the 30 day window above, and none of it is reversible. The one thing that stays is the 90 day fingerprint of your email address described under "How long we keep things". Export first if there is any chance you want the record. You can sign up again later with the same address. The new account starts empty, and if it is within those 90 days it also starts with the free Smart Scans the old one had already used.

Deleting your account cannot reach text Voyage AI received before October 28, 2026, as described under "Sending your content to AI providers".

If you are paying for a plan, cancel it in the App Store or Google Play as well. Deleting your account here cannot reach a subscription the store sold you, so it would keep renewing and keep charging you for an account that no longer exists. We delete your customer record at RevenueCat either way.

Running your own server#

The app also runs against a backend on your own hardware. On that setup your account, your inventory and your photos are on your machine and never reach us, and the providers in the table above drop to the ones your own server is configured to call. Two things still leave: a barcode lookup, which is made from your device to those two public catalogs either way, and whichever AI provider you configure your own server with, if you configure one at all.

Your rights#

Depending on where you live you may have the right to see, correct, export or delete your personal data. You can read and edit your whole inventory in the app, export it as CSV from Settings → Your data, and delete your account as described above. For anything else, write to privacy@enjoixlabs.com and we will answer.

Children#

Bin by Bin is not directed at children under 13, or under the minimum age where you live if it is higher, and we do not knowingly collect their information.

Where your data is processed#

Our providers are based in the United States and your data is processed there.

Changes to this policy#

We will revise the effective date above when this changes. For a change in what we actually do, rather than a change in how clearly this document says it, we will also give notice in the app or by email.

Contact#

privacy@enjoixlabs.com