Stash — Privacy Policy
Stash is a home-inventory app: you photograph your belongings, organise them into containers, and find them again later.
Stash is currently in closed internal testing and is not publicly available. This policy describes how the app handles your information during that test.
The short version
- Stash works offline. Your inventory lives on your device unless you choose to sign in.
- There are no ads, no analytics SDKs, and no third-party trackers.
- Nothing you put into Stash is sold, rented, or shared for advertising.
- If you sign in, your inventory syncs to our own server so it reaches your other devices and anyone you deliberately share with.
What Stash stores on your device
Whether or not you sign in, Stash keeps the following in its own private app storage:
- Your inventory — sites, containers, items, names, notes, quantities, tags, and any expiry dates you set.
- Photos you take or attach to items and containers.
- App preferences — settings and display choices.
If Android Auto Backup is enabled on your device, Android copies the inventory database and preferences to your own Google account backup. Photos are excluded from that backup. This is handled by Android, under your Google account, not by us.
If you sign in
Signing in is optional and uses Google Sign-In. When you sign in we receive and store:
- Your email address and Google account identifier, used to identify your account and to let people share inventory with you by email.
Once signed in and syncing, the inventory described above — including photos — is uploaded to our servers so it can reach your other devices. Photos are stored in a private storage bucket that is not publicly readable.
Sharing
You can share a site with other people by email address. Anyone you grant access to can see the contents of that site, and editors can change it. Sharing only happens when you initiate it, and you can remove someone's access at any time.
Google Drive backup
Stash offers an optional backup to your own Google Drive, used mainly to preserve photos, which Android's own backup does not cover.
This uses Google's app-data scope, meaning Stash can only read and write files in a hidden folder that belongs to Stash. It cannot see, read, or modify any other file in your Drive. The backup is stored in your Drive under your Google account, and counts against your own storage. You can disconnect at any time from Settings, and delete the data by removing the app's data from your Google account settings.
Permissions Stash asks for
- Camera — to photograph items and to scan container QR codes. Stash works without it; you just cannot take photos or scan in-app.
- Notifications — for expiry reminders you have set, and to tell you if backups are repeatedly failing. Optional.
- Internet — required only for sign-in, sync, sharing, and Drive backup.
Stash does not request location, contacts, microphone, or access to your photo library beyond images you explicitly pick or capture.
Who processes your data
- Supabase — hosts the database and photo storage behind sync and sharing. Access is restricted per-account at the database level.
- Google — provides sign-in, and Drive storage if you connect it. Google also gives us aggregate, anonymised crash and performance reports through the Play Console if your device is set to share app usage data with Google; those reports are controlled by your Android settings, not by Stash.
We do not use advertising networks, marketing platforms, or analytics providers.
How long data is kept
Data you sync is retained while your account is active. Deleting an item, container, or site removes it from your devices and from our servers. Data held only on your device is removed when you uninstall the app or clear its storage.
Your choices
- Use Stash without an account. Do not sign in, and nothing leaves your device.
- Stop syncing. Sign out; your inventory stays on the device.
- Disconnect Drive backup at any time from Settings.
- Request a copy or deletion of your data by emailing the address below. Because Stash is in internal testing, this is handled manually and we will respond as quickly as we can.
Children
Stash is not directed at children under 13 and we do not knowingly collect their information.
Security
Traffic between the app and our servers uses HTTPS. Stored data is access-controlled so that an account can only reach sites it owns or has been given access to. No system is perfectly secure, and Stash is early software under active development — please do not use it as the sole record of anything you cannot afford to lose.
Changes
If this policy changes materially, the date at the top will change and testers will be told in the release notes.
Contact
Questions, data requests, or anything that looks wrong: privacy@roll4six.com