Privacy Policy

Stash is created and operated by Miodrag Milosevic, an individual developer, not a registered company. Miodrag Milosevic is responsible for the personal information processed to provide Stash. This policy covers the website, Android application and browser extension.

Stash serves users worldwide. This policy describes our data practices wherever you use the service; your privacy rights may vary under the laws that apply to you.

Contact us about privacy or your information at miodragmilosevic96@gmail.com. We do not sell or rent your personal information.

1. Information we process

• Account information: your email address, account identifier, and authentication information. Supabase manages authentication and password storage. If you sign in with Google, Google supplies account information to the authentication provider, including your email and potentially your name or profile image.
• Saved content: URLs, titles, descriptions, preview and favicon URLs, collections, tags, notes, and the times links were saved. Pro users can also upload images, which are resized and re-encoded on your device before being stored in a private storage bucket.
• Subscription information: your plan, Paddle customer and subscription references, subscription status, and renewal or expiry details. Checkout sends your email and Stash account identifier to Paddle to associate a payment with your account. Paddle handles payment details; Stash does not store your full card details.
• Technical and support information: service providers may process IP addresses, request details, browser information, and error or security logs. If you contact us, we process your message and the information you choose to include.

2. Why we use information

We use this information to authenticate you, save and search your content, operate subscriptions, respond to support requests, prevent abuse, and troubleshoot the service. We do not use your saved content for advertising or sell it to data brokers. Access to private content is limited to what is needed for support, service operation, security, or legal obligations.

Where data protection law requires a legal basis, we rely on providing the service you request for account and content processing; legitimate interests in security, reliability, and support; and legal obligations where applicable. Where consent is required, you may withdraw it by contacting us. Without the account information needed for authentication, we cannot provide an account.

3. Link previews and external websites

When you save a URL, our server may request the page to retrieve its title, description, favicon, and preview image. The destination receives the URL and a request from our server, including its IP address. Do not save URLs containing passwords, private access tokens, or other secrets.

Your browser may load favicons and preview images directly from the websites that host them. Those sites can receive your IP address and browser request information. Stash requests these images without a referrer, so the image request does not include the Stash page address. Opening a saved link takes you to an external website, which has its own privacy practices.

4. Android app and browser extension

The Android app stores your login session in secure device storage. When you choose Share to Stash in another app, Stash receives the text or links you chose to share. Image and file pickers access files you select for uploads or import; Stash does not scan your photo library or other apps.

You can delete your account from Settings or follow the instructions at Delete your Stash account.

The extension reads the active tab's URL and title when you open the popup or use the save shortcut. It sends the selected page information to Stash when you save a link. It keeps a login session and preferences in browser extension storage. It does not collect your browsing history or continuously monitor the pages you visit. You can disconnect it from its popup.

5. Providers and sharing

• Supabase provides authentication, the database, and uploaded-image storage.
• Paddle processes paid purchases and billing under its own privacy policy.
• Google Play processes Android store purchases. RevenueCat receives your Stash account identifier and store purchase information to verify and restore Pro access. Stash does not receive your store payment card details.
• Google processes sign-in if you choose that option. Your account emails are sent through the authentication email delivery service.
• Hosting and infrastructure providers process requests and technical information needed to serve and secure the website.

Information may also be disclosed where legally required or necessary to address fraud, abuse, or security incidents. Depending on provider locations, processing may occur outside your country. Where applicable law requires safeguards for international transfers, those safeguards must apply.

6. Cookies and local storage

Stash uses essential session cookies to keep you signed in and browser storage for the extension's session and preferences. We do not add advertising trackers or a separate website analytics service. Paddle checkout may use its own cookies or similar technology for payment processing, security, and related purposes, as described in its privacy policy.

7. Retention and deletion

Account information and saved content are kept while your account remains active, unless you remove them sooner. Deleting a link removes its saved record and associated uploaded image. Deleting your account removes account records and saved content from the active service.

Copies may remain in provider backups or technical logs until they expire under the provider's retention practices. Billing providers may retain transaction records for their legal obligations. Support correspondence is kept for as long as needed to resolve requests and related obligations. Account deletion cancels web subscriptions through Paddle before removing your account. Google Play subscriptions must be cancelled separately in Google Play; deleting your Stash account does not cancel them.

8. Your choices and rights

You can update saved content, export links as HTML or JSON, and delete your account in Settings. Depending on applicable law, you may also request access, correction, erasure, portability, restriction, or object to certain processing. Contact us to make a request; we may need to verify your identity. You may complain to the relevant data protection authority where that right applies.

9. Children and security

Stash is not intended for people under 16. If you believe a child has provided information, contact us so we can investigate and remove it where appropriate. We use authentication and access controls to protect private content, but no online service can guarantee absolute security.

10. Changes and contact

We will update the date above when this policy changes and communicate material changes through the service or by email where required. For questions or privacy requests, contact Miodrag Milosevic at miodragmilosevic96@gmail.com.