SPOOKY BOX / PRIVACY

PRIVACY POLICY

UPDATED OCTOBER 3, 2026

Who we are

Spooky Box is a paranormal entertainment app by Vantage Point Media LLC. For privacy questions, contact privacy@spookybox.app. For app support, contact support@spookybox.app.

App data

Spooky Box works without a Spooky Box account and contains no advertising or analytics of its own. The app does not send session content to a Spooky Box server. Session logs, settings, and custom words are stored locally on your device. The only information the app sends to a Spooky Box server is the purchase check described further down. Google Play gives developers install and crash statistics for their apps (Android vitals) under Google’s own policies; Spooky Box does not add any crash or usage reporting of its own.

The app asks Android for three permissions, plus one internal permission that only this app can use. The three are Internet access, which Spooky Box’s own code uses only for the purchase check, although Google Play’s billing component may also use it to send diagnostics to Google (see below); Google Play billing, so you can buy the unlock through Google Play; and network status, which Google’s billing library adds. It does not ask for location, contacts, microphone, camera, or storage permissions.

Sensors and session logs

The app uses available device sensor readings to operate its word engine and display sensor activity. Logs include generated words and session information such as start time, duration, trigger reasons, and the latest magnetic, pressure, temperature, and humidity readings saved with each word. Custom words or names you enter are also stored locally. Sensor availability depends on your phone. Sensor readings are not sent to us or to anyone else, apart from what appears in a log you choose to export.

Audio and camera

Spooky Box speaks generated words using Android text-to-speech. It does not record microphone audio or camera video. So that Replay can repeat a word exactly, each spoken word is saved on your phone as a short synthesized voice clip. These clips come from the text-to-speech engine, are not recordings of your surroundings, and are deleted with their session.

Speech services

Spooky Box uses an installed Android text-to-speech engine. Offline voices can process speech on your device. Network-enabled engines may send text and technical information to their providers under their own privacy policies. The engine and voice you select determine this processing; voice downloads may require a connection. Spooky Box labels the voices that need a network connection (“Needs internet”) in its voice list, and unless you choose otherwise it uses an offline voice when one is installed. The text spoken is a generated word, a custom word you add, or the test phrase in voice settings.

Sharing

When you export a text log through Android’s share sheet, the app or recipient you choose receives that copy. The app first saves the text file in its private storage so Android can hand it over. The file name and the share subject include the session number. Shared copies are governed by the destination’s settings and privacy practices. Removing a session in Spooky Box does not remove copies already delivered to another app, cloud service, or recipient.

Purchases

Spooky Box offers a one-time unlock that you buy through Google Play. Google Play handles the payment. To make sure an unlock is genuine, and to notice if Google later cancels or refunds it and revokes access, the app checks the purchase with our verification service.

What is sent

The app sends the purchase token that Google Play gave your phone, together with the app version number, over an encrypted HTTPS connection to our verification service. The app name and the product being checked are set on our server; the app does not choose them. The check runs when you buy the unlock; automatically when you open the app and Google Play lists a purchase of the unlock that the app has not confirmed yet, for example after you reinstall the app, clear its storage, or move to a new phone; when Google Play reports a different purchase than the one the app holds; when you tap Restore purchase, Try again or Check again; when you open the app and its last successful check is a week or more old; and when Google Play reports no purchase on a phone that holds an unlock. While a new purchase is still being confirmed, the app retries automatically.

Like any internet request, the connection reveals your IP address and the standard technical details Android adds to web requests, such as the Android version and device model. The app does not send your name, email address, payment card details, Google account, device identifiers, location, sensor readings, session logs, words, or settings.

Where it goes

Our verification service runs on Cloudflare. It asks Google Play whether the token is a valid purchase of the Spooky Box unlock, which means sending Google the token together with the app and product names, and it replies to the app with a short status such as purchased or canceled. Google Play processes the payment under Google’s privacy policy and manages your purchase history and refunds; you can review purchases and request refunds in Google Play.

The Google Play billing library built into the app talks to the Google Play app on your phone to show the price and complete the purchase. That library may also send diagnostic information to Google, such as whether billing calls succeed and whether the connection to Google Play works, along with technical details of the device; Google handles it under its own privacy policy.

How long it is kept

We do not store the purchase token. Our service handles it in memory only for as long as the request takes, and its own log lines record only the outcome of the check and how long it took, never the token. Cloudflare, which hosts the service, may keep standard connection logs, such as IP address and time of request, under its own policies.

What Google Play shares with us

Google Play Console shows us the orders for the unlock. According to Google’s help pages, that can include the buyer’s email address (orders can be searched by it), the order number, order date and history, amount, taxes and fees, the buyer’s city, state or region, postal code, and country, and device model. We use this information only for customer support, refunds, and accounting.

On your phone

After a successful check, the app keeps the unlock status, the purchase token, and the time of the check in its private storage, so your unlock keeps working without a connection. If Google confirms that the purchase was cancelled or refunded and access was revoked, the app removes the token and locks the unlocked features again. This information is not included in Android backups or device transfers. After reinstalling the app or on a new phone, your unlock normally comes back by itself the first time you open the app, as long as you are signed in to the same Google account in Google Play and the phone is online. If it does not, use Restore purchase.

Retention and deletion

Local session data remains on your device until you delete it, app storage is cleared, or the app is uninstalled. Delete sessions in the app or clear its storage through Android settings. Deleting a session also deletes its saved voice clips and the exported text copy kept in the app’s private folder. Custom words stay until you remove them in the app. The app also keeps a list of the 500 most recently generated built-in words so it can avoid repeating them. Custom words are not added to it, and removing a custom word also clears any entry an earlier version stored. Deleting a session does not clear the list. Clearing app storage or uninstalling does. The free tier’s five-session archive access limit is not a promise that older data is automatically deleted. Copies you already shared with another app, cloud service, or recipient stay with them and must be removed separately.

Spooky Box opts out of Android cloud backup and device-to-device transfer, so its data is not copied to your Google account or moved to a new phone. If you change phones, your sessions, custom words, and settings do not come with you; your unlock is restored from Google Play, not from a backup. Uninstalling the app removes its data from the phone.

Website visits

This website does not add advertising trackers, analytics scripts, marketing cookies, or contact forms. Fonts and artwork are served with the site. Hosting infrastructure may process connection information such as your IP address, request time, requested page, and browser information to deliver and secure the site. Hosting access controls may use their own session storage or cookies.

Support messages

If you email us, we receive your email address, message, and attachments. We use them to respond and resolve your request. Our email provider processes messages to deliver this service. We retain correspondence for as long as needed to handle your request and meet applicable recordkeeping obligations. Do not send unnecessary sensitive information.

Your requests

Email privacy@spookybox.app to request access to, correction of, or deletion of personal information you sent us. We may need enough information to verify and locate the request. We cannot remotely access or delete session logs kept only on your device. We also do not keep purchase tokens or session logs on our servers, so there is no such record for us to access or delete; Google Play manages your purchase history and refunds.

Security

Local records use Android’s private app storage. The purchase check travels over an encrypted HTTPS connection. Protect your device and consider who can access exported logs. No method of storage or transmission is completely secure.

Changes

We will update this policy if data practices change, including when features introduce additional processing. Material changes will be reflected here and, where appropriate, communicated in the app.

Contact

Vantage Point Media LLC
Spooky Box
privacy@spookybox.app