Privacy

Box IO is published by KRMS Products LLC, Owatonna, Minnesota. This page covers the Android app and the account site at box-io.com. It was last updated on October 22, 2026.

Android app

The Android app is a client for a Box IO server you choose. You type that server’s address on the sign-in screen. A server on your own network can be an HTTP address. A public server can be HTTPS.

The app sends your username and password only to that server, and only to sign in. It does not send them to box-io.com. After sign-in it keeps two things on the phone: the server address, and the session token that server returned. It does not keep the password.

From then on the app loads and saves projects, widget layouts, device-key names, and virtual-pin values on that same server. Buttons, sliders, and the input box send the value you set back to that server. Signing out deletes the session token from the phone. Uninstalling the app deletes the server address and the token.

The app has no advertising SDK and no third-party analytics SDK. The only Android permission it requests is Internet. KRMS Products LLC does not receive the pin values, device keys, or dashboard layouts from the app.

Account on this site

An account on box-io.com is separate from the username on your own Box IO server. Creating an account stores a username, an email address, and a password hash. The site also stores license records, whether auto-renew is on, and a Square customer id when you pay. Square processes the card payment. This site does not store the card number.

A failed sign-in stores the IP address with the failure count so the form can lock for a short time. A password reset stores a hashed token until it expires or you use it. Forum posts are stored with your account and are visible to people who can open the forum.

The Android app does not sign in to this site and does not buy the license. The license is installed on the Docker server from the server’s own License page.

Contact

Questions about this page: kasey@krmsproducts.net.