Privacy Policy

Last updated 29 September 2026

1. Who we are

Oakbox is a private file app operated by factiii llc ("we", "us", "our"), a limited liability company registered in San Antonio, Texas 78254, United States. factiii llc is the data controller for the information described here.

This policy covers the Oakbox website at oakbox.me and the Oakbox mobile app for iOS and Android. The two apps carry different identifiers: the iOS bundle identifier is com.factiii.oakbox and the Android package name is com.oakbox. Together we call these the Services.

Oakbox runs on the same servers and the same accounts as Factiii, our social research platform. Section 7 explains exactly what that means for you.

2. What we collect

Account information

Your username and email address. If you sign in with a password we store a one-way hash of it, never the password itself. If you sign in with a passkey we store the public half of the credential; the private half never leaves your device. If you turn on two-factor authentication we store the secret needed to verify your codes.

Session and device information

Each time you sign in we record a session: which app it came from (Oakbox for iOS or Oakbox for Android), the device it is tied to, and when it was last used. We use this to keep you signed in and to let you see and revoke your own sessions.

Your IP address reaches our servers with every request, as it does with any website. We use it to rate-limit abuse and it appears in server logs and in error reports. It is not attached to your session record and we do not build a profile from it.

Files you add to Oakbox

When you upload a file, or photograph a document with the camera, we store:

• the file itself, as bytes, in our object storage;
• its name, size, and file type;
• the text we extract from it, including text recovered by optical character recognition from a scan or a photograph;
• numeric embeddings of that text — vectors that let you search your files by meaning rather than by exact wording;
• for an image, a written description of it, produced by an AI model so the image can be searched;
• topic labels an AI model chooses from the text or the image, so you can browse by subject.

All of it is private to your account. Nothing you put in Oakbox is published, shown to another user, or used to train any model.

A connected OneDrive folder

If you connect Microsoft OneDrive, we store:

• an OAuth access token and refresh token for your Microsoft account, encrypted at rest with AES-256-GCM;
• the identifiers, names, and change tags of the folder you chose and the files inside it;
• the extracted text and embeddings of those files, exactly as described above.

We do not copy your OneDrive files into our storage. We fetch the bytes of a file while we are reading it, extract the text, and discard the bytes. When you download a synced file, Microsoft hands you a short-lived link and the file travels from Microsoft to you without passing through us. We ask Microsoft only for the permission needed to read and write the folder you picked, and you can revoke it at any time — from inside Oakbox, or from your Microsoft account.

Purchases

Oakbox sells four auto-renewing monthly storage subscriptions: oakbox_storage_50gb, oakbox_storage_200gb, oakbox_storage_2000gb, and oakbox_storage_6000gb. Apple and Google take the payment. We receive and store the transaction identifier, the purchase token, the price and currency charged, and whether the subscription is active. We never receive or store your card number, bank details, or billing address.

Camera and biometrics

The camera is used only when you choose to photograph a document, and the photograph is treated as a file you uploaded. If you unlock the app with Face ID or a fingerprint, the check happens on your device and the biometric data never reaches us — your operating system tells us only whether it succeeded.

Diagnostics

We collect crash reports and basic performance data so we can fix what breaks. These are not linked to your identity and are never used to track you.

What we do not collect

• Advertising identifiers. Oakbox contains no advertising SDK.
• Your location.
• Your contacts, calendar, photo library, or health data.
• Any information about what you do in other apps or on other websites.
• Sensitive categories such as race, religion, political opinion, health, or sexual orientation — except insofar as you choose to store a document that happens to mention them, in which case it is a file like any other and is treated as one.

3. Why we process it, and on what legal basis

• To run the Services — store your files, extract and index their text, have an AI model describe and tag them, search them, sync a OneDrive folder, and keep you signed in. Legal basis: performance of our contract with you.
• To answer your questions about a document, when you use the Ask feature. Legal basis: performance of our contract with you; you choose whether to use it.
• To take payment and manage your subscription. Legal basis: performance of our contract with you.
• To keep the Services secure — detect abuse, stop automated sign-ups, and investigate incidents. Legal basis: our legitimate interest in a service that is not overrun.
• To comply with the law, including tax, accounting, and lawful requests. Legal basis: legal obligation.

We do not use your files for marketing, we do not profile you, and we make no automated decisions that produce a legal or similarly significant effect on you.

4. Who we share it with

We do not sell personal information, and we have never sold it. We share it only with the service providers below, only for the purposes listed, and only to the extent each one needs.

• Cloudflare — the object storage your uploaded files sit in.
• Amazon Web Services — hosting.
• Microsoft — only if you connect OneDrive, and only to read and write the folder you chose.
• Anthropic and OpenAI — when you add a file, its extracted text, or the picture itself for an image, is sent to one of these providers so a model can describe and tag it. When you use the Ask feature, the relevant text is sent to produce the answer. We use their business offerings, under which submitted content is not used to train their models; each provider may keep it for a limited period under its own terms, for example to monitor abuse. Which provider handles a given request depends on the model chosen for it. Text recovered from a scanned page by optical character recognition, and the embeddings that power search, are produced on our own servers.
• Apple and Google — payment processing and subscription state for in-app purchases, and app distribution.
• Google reCAPTCHA — shown only when a sign-up attempt looks automated. Google receives device and browser signals to make that judgement, subject to Google's privacy policy.
• Expo — delivery of over-the-air app updates. Expo receives the app version and platform requesting an update, not your identity or your files.

We may also disclose information where the law requires it, to enforce our Terms, or to protect the rights and safety of our users or the public. If our business is sold or merged, your information may transfer with it; you will be told before it does, and before it becomes subject to a different policy.

5. Where it is stored, and for how long

Your information is stored on servers in the United States. If you are in the European Economic Area or the United Kingdom, this means your information is transferred outside it. Where we make such a transfer we rely on the European Commission's Standard Contractual Clauses, or on your explicit consent.

We keep your account information and your files for as long as your account exists. When you delete your account we hold it for a 30-day grace period, so that a deletion made by mistake or by someone else can be undone. After that period the account and everything attached to it are deleted outright — your files from our storage, and the account record itself from our database. Deleting your account lists what goes.

Backups run on their own rotation and are overwritten in the ordinary course. We do not restore a deleted account from one.

6. Cookies and tracking

The oakbox.me website sets no cookies at all. It loads no analytics, no fonts from another domain, no advertising scripts, and no third-party embeds. There is nothing to consent to and nothing to opt out of.

The mobile app keeps your session token in the device keychain — the operating system's protected storage — and a single flag recording whether you have seen the introduction. Neither is a tracking technology and neither is readable by any other app.

Because we do not track you across sites, a Do Not Track or Global Privacy Control signal has nothing to switch off. We honour them by having nothing to honour.

7. Your account is a Factiii account

There is no separate Oakbox account. Oakbox and factiii.com share one account system, one set of servers, and one database, operated by the same company. Signing up in Oakbox creates a Factiii account, and an existing Factiii account signs in to Oakbox directly. A passkey created on either works on both.

What this does not mean: your files are not visible on Factiii, are never posted, and are never shown to another user. Oakbox content is private to you.

What it does mean: your username and email are shared between the two products, a storage subscription bought in Oakbox is visible on your Factiii account, and deleting your account deletes both. If you also use Factiii's social features, the Factiii privacy notice covers what happens there. Signing out of Oakbox does not sign you out of Factiii, and the reverse.

8. How we keep it safe

• Everything in transit is encrypted with TLS.
• Your files are not end-to-end encrypted. Our servers can read them, because extracting text, searching, and AI tagging all need the contents. A small number of our staff have the system access to read them too; the Terms say when they may.
• OneDrive tokens are encrypted at rest with AES-256-GCM. Passwords are stored only as a one-way hash.
• Every request for a file is checked against its owner. There is no path by which one account reads another account's files.
• Passkeys and two-factor authentication are available on every account, and we recommend both.

No system is perfectly secure, and we will not pretend otherwise. We protect your files as well as we can, but an attacker could reach them. Before you store a file whose exposure would seriously harm you, weigh that. If a breach affects your information we will tell you and the relevant regulator within the time the law allows.

9. Your rights

Depending on where you live you may have the right to ask us to give you a copy of your information, correct it, delete it, restrict or object to how we use it, or send it to another provider. You may also withdraw a consent you gave, and lodge a complaint with your data protection authority.

Some of these you can exercise yourself, immediately, without asking us: download any file from the app, disconnect OneDrive from the app, cancel a subscription from the App Store or Play Store, and delete your account from the app. For anything else, email support@oakbox.me from the address on your account. We answer within 30 days, and we do not charge for it. We will never treat you worse for making a request.

10. California residents

Under the California Consumer Privacy Act, as amended, you may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of source, the purpose, and the categories of third party we disclosed it to; you may request correction or deletion; and you may opt out of any sale or sharing of personal information.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months, and we do not do so for anyone under 16. There is therefore no opt-out to offer you. The categories we collect are identifiers, commercial information, internet activity limited to your use of Oakbox itself, and the contents of files you choose to store — all described in section 2.

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comparable laws have equivalent rights, including an appeal if we refuse a request. Use the same address to exercise them.

11. Children

Oakbox is not for children. You must be at least 13 years old to use it, and at least 16 if you are in the European Economic Area or the United Kingdom. We do not knowingly collect information from anyone younger. If you believe a child has given us information, email support@oakbox.me and we will delete the account.

12. Changes to this policy

We update this policy when what we do changes. The date at the top is the date of the current version. If a change materially affects your rights we will tell you in the app, or by email, before it takes effect. Continuing to use Oakbox after that means you accept the updated policy.

13. How to contact us

Email support@oakbox.me, or write to us:

factiii llc
San Antonio, TX 78254
United States

For a request about your own data, see Deleting your account and your data. For a problem with the app, see Support.