Privacy policy

Bin by Bin is a home inventory app operated by Enjoix Labs LLC. This policy says what we collect, where it goes, how long it stays, and what we can see from our side. It covers the hosted service at binbybin.app and the mobile app when it is signed in to that service. Running the app against your own server is covered at the end, and the short answer there is that none of this involves us.

The short version#

• We collect your email address and the inventory you create: bins, items, rooms, homes, and the photos you add.
• Photos you scan go to Anthropic to be read by an AI model. Item and bin text goes to Voyage AI to build your search index.
• There is no advertising, no ad network, and no analytics or crash-reporting toolkit in the app or on this site. We do not sell your data.
• You can delete your account and everything in it at any time, and the deletion is real.
• On our hosted service, we could read your inventory text and open your photos if we chose to. We do not, and no screen in the product shows them to us, but nothing cryptographic stops us. Anyone who tells you otherwise about a service like this one is describing a product with client-held keys, and we are not that yet. If that matters to you, run your own server.

Who we are#

Enjoix Labs LLC. Reach us at privacy@enjoixlabs.com for anything in this document.

What we collect#

• Account. Your email address and a password. The password is stored only as a bcrypt hash, so we never hold the password itself.
• Your inventory. Names, descriptions, tags, quantities and minimum quantities, barcodes, room and location labels, home names, dates you record against an item (expiry, warranty, maintenance, cancellation), loan details including who you lent something to, review notes, and any photos you add.
• Usage counters. For each call to a paid AI feature we record which provider and model ran, the token counts, an estimated cost, and a random per-sign-in session id. This is what makes the meter in Settings → AI possible. The session id is random and is not your IP address.
• Subscription status. If you subscribe, which plan you are on, when the current period ends, and any top-up scans you have bought and not yet used. The purchase itself happens in the App Store or Google Play, so we never see your card and no payment detail reaches our server.
• Push tokens. If you turn notifications on, the token your device is issued by Google Firebase Cloud Messaging, plus the platform and when it was last seen.
• Feedback. If you send feedback from inside the app, your message along with your app version, platform and account email.
• Onboarding events. The app reports which steps of first-run setup were reached, keyed to a random id the app generates on the device. These rows carry no account link and no inventory content, only an id and a step name, and they are deleted after 60 days.

What leaves your device, and where it goes#

We run no request logger of our own, so we keep no access log with your address in it. Our hosting providers keep their own platform logs, which do include IP addresses, under their retention terms.

What we can see#

We think this is the part worth being plain about.

On the hosted service, your item and bin text sits in ordinary database columns and your photos are ordinary image files in our storage bucket. We hold the credentials for both. Provider encryption at rest protects against someone walking off with a disk, and nothing more, because the provider holds that key.

So: we have the technical ability to read your inventory and open your photos. What limits it is practice rather than mathematics.

• There is no feature anywhere in the product that shows us your items. Our admin tools expose exactly two things, usage totals and quota settings.
• Each account's data is walled off from every other account, including for photos: a photo can only be fetched by the account that owns it.
• We carry no analytics, crash-reporting or advertising toolkit, so there is no second copy of your activity anywhere.

Two things follow from the design. The search index is derived from your text, so it doesn't hide that text from us. And the shape of your data, how many rooms you have, what they are called, how many items are in each, when you added them, is visible without reading the actual words.

We don’t claim to be “zero-knowledge,” “end-to-end encrypted,” or unable to see your data, because none of those things are true for the hosted version of the service.

Sending your content to AI providers#

Two features work by sending your content to a provider we do not control.

Anthropic, for Smart Scan. The photo you scan is forwarded to Anthropic's API from the upload, read by a Claude model, and the item list comes back. We never store or serve that image ourselves. Anthropic states that API inputs and outputs are not used to train its models, and that it deletes them within 30 days, keeping them up to two years if its automated trust and safety systems flag the request. That is Anthropic's statement about its own service, not ours; their current terms are the authority.

Voyage AI, for search. The text of a bin or item goes to Voyage when you save it, and your query goes to Voyage when you search, so that both can be turned into the vectors semantic search compares. Voyage's published default is that it stores customer content and may use it for future model training, with an account-level opt-out that gives zero-day retention instead. Read that as the default until we tell you here that we have opted out.

Neither call carries your email address or account id.

If you would rather this did not happen at all, Smart Scan is something you choose per photo rather than something that runs on its own, and keyword search against your own device keeps working with the semantic half turned off.

Barcode lookup#

When you scan a barcode, the number is sent from your device to two public product catalogs, UPCitemdb first and Open Food Facts if there is no match, so the name, description and tags can be filled in for you. Only the number is sent. No photo, no bin, no item detail and nothing identifying you or your account goes with it. This happens whether or not you are signed in, and on your own server as well as ours. Typing the number in by hand instead of scanning it sends nothing.

Subscriptions and purchases#

If you pay for a plan, the purchase is handled by Apple or Google, not by us. We never see your card number, and no payment detail reaches our server.

We use RevenueCat to find out whether a subscription is active. Your app store reports the purchase to RevenueCat, and RevenueCat tells our backend which plan you are on, when the current period ends, whether you are in a free trial, and whether the purchase was refunded. To ask that question we send RevenueCat a random billing id we generate for your account. That id is not your email address and not your account number, and your purchase history is held by RevenueCat against it.

Deleting your account tells RevenueCat to delete that customer record too. It does not stop a subscription from renewing, because only the store that sold it can do that. See the deletion section below.

Notifications#

If you turn on low stock alerts, the notification is delivered through Google Firebase Cloud Messaging, and the text of that notification names up to three of the items that are low. Google handles the message in order to deliver it. This is worth knowing before you turn the feature on: a notification appears on a lock screen, and it says what it is about.

Providers we use#

Each of these processes your data only to provide their service to us.

We do not sell your personal information and we do not share it for advertising.

How long we keep things#

• Your account and inventory: while the account exists. Deleting the account removes them.
• A photo you delete in the app: moved out of the live bucket immediately, then destroyed by a storage rule 30 days later. That window exists so a deletion caused by a bug in our code is recoverable. Deleting your whole account skips it and destroys the file outright.
• Onboarding events: deleted nightly once they are 60 days old.
• AI usage counters: kept while the account exists, deleted with it.
• Subscription records: kept while the account exists. Deleting the account removes our copy and tells RevenueCat to delete theirs.
• Backups: we take a nightly database dump so an account is recoverable after an outage or a mistake on our side. A deleted account can persist in those dumps until they age out.

How your data is protected#

• Every connection to the app, the dashboard and this site uses HTTPS.
• Passwords are stored only as bcrypt hashes.
• Photos are in a private bucket with no public URL, served through links that expire after about five minutes, and a photo can only be fetched by the account that owns it.
• Sign-in sessions on the web use host-locked, HTTP-only cookies.
• On your phone, the app keeps its own copy of your inventory so it works offline. That local database is not encrypted by the app, so on a rooted or jailbroken device it is readable. Your sign-in token is held in the operating system's keystore rather than in that database. Your device's own full-disk encryption, and the screen lock that gates it, are what protect the local copy.

No system is perfectly secure. This section describes what we do, not a guarantee.

Deleting your account#

You can delete your account from Settings in the app, or from the account deletion page on the web without installing anything. Both ask for your password.

It is a real deletion and not a flag. The rows go, the photos are destroyed outright rather than parked in the 30 day window above, and none of it is reversible. Export first if there is any chance you want the record. You can sign up again later with the same address, and it will be an empty account.

If you are paying for a plan, cancel it in the App Store or Google Play as well. Deleting your account here cannot reach a subscription the store sold you, so it would keep renewing and keep charging you for an account that no longer exists. We delete your customer record at RevenueCat either way.

Running your own server#

The app also runs against a backend on your own hardware. On that setup your account, your inventory and your photos are on your machine and never reach us, and the providers in the table above drop to the ones your own server is configured to call. Two things still leave: a barcode lookup, which is made from your device to those two public catalogs either way, and whichever AI provider you configure your own server with, if you configure one at all.

Your rights#

Depending on where you live you may have the right to see, correct, export or delete your personal data. You can read and edit your whole inventory in the app, export it as CSV from Settings → Export, and delete your account as described above. For anything else, write to privacy@enjoixlabs.com and we will answer.

Children#

Bin by Bin is not directed at children under 13, or under the minimum age where you live if it is higher, and we do not knowingly collect their information.

Where your data is processed#

Our providers are based in the United States and your data is processed there.

Changes to this policy#

We will revise the effective date above when this changes. For a change in what we actually do, rather than a change in how clearly this document says it, we will also give notice in the app or by email.

Contact#

privacy@enjoixlabs.com