Legal

Privacy notice

BoxShare is a small site, so this is a short notice. It says what we hold about you, why, who else can see it, and how to get it back or get rid of it. No dark patterns, no data sold to anyone, ever.

Last updated 11 August 2026.

Who's responsible

BoxShare is run by Ross Cadogan in Maynooth, Co. Kildare, Ireland. For anything in this notice — a copy of your data, a correction, a deletion, or a complaint — email hello@boxshare.ie and a real person will answer.

What we collect

Only what the site needs to work. There is no tracking pixel, no advertising network, and no profile built about you.

• Your account — name, email address, and a password stored as a one-way hash (we never see it). Optionally a location and a profile image if you add one.
• Sign-in sessions — a session token, your IP address and browser user-agent, kept so you stay signed in and so we can tell a real session from a stolen one.
• Listings — the box's title, description, category, photos, fit details, daily rate, deposit, and the town it's in. If you add pickup details, an Eircode and any notes you write.
• Bookings — the dates requested, the agreed rate, and the status of the request.
• Wanted posts — the category, dates, town, any note you write, and whether you ticked the optional box letting us count the post in totals we publish elsewhere.
• Reviews — the rating and comment you leave after a completed borrow.

What other people can see

This is the part worth reading before you post anything, so there are no surprises.

• A listing is public. Anyone on the internet can see the box's details, photos, town, rate, deposit — and your first name, shown as "Listed by". Your surname and email address are not shown.
• Asking to borrow shows the owner who's asking. When you request a box, its owner sees your full name — they're deciding whether to hand over something valuable to a stranger. You see only the owner's first name until they approve, and their full name and email after that.
• A wanted post is public, but shows only your first name, along with the category, dates, town and your note.
• Reviews are public and show your first name only.
• Nothing you post here is republished elsewhere unless you tick the box that says so, and even then only as a count of five or more posts — "five people around Kildare are after a roof box in August". Never your name, your note, your dates or your town: just the county and the month. It's unticked by default, posting works the same without it, and you can change your mind by emailing hello@boxshare.ie.
• Your email address is never public. It's revealed to the other person only once a booking is approved, active or completed — so you can arrange the handover. Not before.
• Pickup Eircode and notes are shown only to a borrower whose booking is approved or active. They're never on the public listing.

Anything you type into a description, note or review is published as you wrote it, so please don't put your phone number or home address in one.

Why we're allowed to hold it

Under the GDPR, most of it is necessary to perform the contract you enter when you use the site — you can't list a box or request a booking without the site storing the box and the booking. Keeping sessions secure, preventing abuse, and counting visits in aggregate rest on our legitimate interests in running a service that works and isn't abused. We don't send marketing email, so we're not relying on consent for that today. If that ever changes, we'll ask first.

One thing does rest on consent: the tick box on a wanted post that lets us count it in totals published off the site. It's never pre-ticked, and refusing costs you nothing — the post goes up either way. Withdraw it any time by emailing hello@boxshare.ie and we'll untick it, which stops it counting from then on. A total already published can't be unpublished, but there's nothing in one that points back to you.

Who else processes it

BoxShare doesn't sell or share your data with advertisers. A few suppliers process it on our behalf, under contract, to keep the site running:

• Neon — the database, hosted in London, United Kingdom (covered by the EU's adequacy decision for the UK).
• Cloudflare — hosting, photo storage, and privacy-first visit analytics. Cloudflare is US-based and operates globally; transfers are covered by its standard data protection terms.
• Resend — the transactional emails about your bookings, sent from servers in Ireland.

Analytics and cookies

We use Cloudflare Web Analytics, which is cookieless. It doesn't set a tracking cookie, doesn't follow you between sites, and gives us only aggregate numbers — how many people saw a page, roughly where they came from. There's no advertising cookie on this site and nothing to consent to, which is why you aren't being nagged by a banner.

The one cookie we do set is the sign-in cookie that keeps you logged in. It's strictly necessary — without it the site can't tell it's you.

We also keep two counters of our own, so we can tell whether the site is actually useful. When you search for a box we add one to a tally of how many searches asked for that type of box, in that county, in that hour, and how many results came back — so we can see what people need and where we're sending them away empty. And when you arrive through a link we've shared somewhere specific (an address like boxshare.ie/from/…), we add one to a tally of arrivals from that link, by hour.

Neither counter records who you are. There's no account, no IP address, no exact town, no dates, and nothing you typed — only the totals themselves, which is why we can't work backwards from them to a person, and neither can anyone else.

How long we keep it

Sign-in sessions expire on their own. Everything else is kept while your account exists, because a booking history is what makes reviews and disputes checkable. Ask us to delete your account and we'll remove your personal data, along with your listings and wanted posts. Where a review or booking involved someone else, we may keep the minimum needed to keep their side of the record honest.

The two counters described above are kept indefinitely, because a tally with nobody in it is a statistic rather than a record of you — deleting your account doesn't change them, and there's nothing in them to delete.

Being straight with you: there's no self-serve delete button yet. Email hello@boxshare.ie and it gets done by hand.

Your rights

You can ask for a copy of what we hold, have it corrected, have it deleted, restrict or object to how it's used, or ask for it in a portable format. Email hello@boxshare.ie — we'll reply within a month, and it's free.

If you're not happy with how we've handled it, you can complain to the Irish Data Protection Commission at dataprotection.ie.

Changes

If this notice changes in a way that matters, the date at the top changes too, and anything genuinely new will be flagged on the site rather than slipped in quietly.