Privacy policy
Last updated: September 17, 2026
A Little Box of Goodies is operated by Chengcai Li in China. For privacy questions or requests, contact support@alittleboxofgoodie.com.
Information we use
- Package content: sender and recipient labels, notes, photos, drawings, voice recordings and other content you choose to add. We process it to save your draft and deliver your package.
- Browser identifiers: cookies and local browser storage connect this browser to its drafts and purchases for single purchases. Clearing browser data or switching devices can affect your ability to find a draft or purchase.
- Google account information: when you choose Google sign-in, we receive your Google account identifier, verified email, name and profile image. We store account and session records to protect and restore your pass and published boxes. We do not receive your Google password or request access to Gmail, Drive or contacts.
- Payment and support records: order identifiers, payment status, transaction references, amounts, currencies, taxes, a checkout email where supplied, and messages you send to support. Waffo Pancake or CREEM processes payment details; our application does not collect full card numbers.
- Technical and usage information: records needed to operate and protect the service, and basic page-visit analytics such as page type, referring website, browser and device information.
Drafts and delivery
Your browser keeps a local draft. The service also uploads content to server storage while preparing and delivering a package. Anyone with its recipient link can open it, including someone who receives a forwarded link. Share links carefully and do not include confidential records.
Service providers and analytics
We use Vercel for hosting, Neon for our database, Cloudflare R2 for media storage, Waffo Pancake and CREEM for payments, and Google for optional account sign-in. These providers process information needed to deliver their services. Information may be processed outside your country.
We use a self-hosted OpenPanel service for basic page-visit analytics and anonymous product events, such as which purchase option is chosen and which type of content is added or opened. The application replaces private order and recipient-link paths with page categories before reporting visits and removes query parameters. Analytics properties are limited to fixed categories, for example a content type or an order status, and never include package contents, notes, sender or recipient labels, links, or email addresses. When you are signed in, analytics events carry a scrambled, non-reversible reference to your account so that your own actions can be counted together; this reference cannot be used to sign in and is not linked to your content. Session replay is disabled. Infrastructure may process network information, including IP addresses, when serving requests.
How long information is kept
Local drafts are kept for up to seven days. Single-purchase packages are available for 365 days after payment. Boxes published with a pass are available for 365 days after publication, independently of the pass expiry; content cleanup follows the service’s retention process. Account and entitlement records are kept to provide account access; you can request deletion through support. Payment and operational records may be retained separately for reconciliation, dispute handling and applicable recordkeeping requirements.
Removing a local draft does not automatically delete an already uploaded or paid package. The availability period is not a promise that all records and provider backups are erased at the exact moment a package expires.
Your choices and requests
You choose which content to add and who receives a link. You can remove draft items before paying. For requests to access, correct or delete your information, contact our support address with enough information to identify the relevant package or purchase. We may need to verify ownership and may retain records where required for legal or payment obligations.
Policy updates
We may update this policy when our practices change. The date above identifies the current version. Contact us if you need help understanding how your information is handled.