Privacy Policy

Effective 25 October 2026

This policy explains what information the Stash Findr mobile app ("the app") collects, why, who it's shared with, and the choices you have. The app is made and run by Misha Babets, an individual developer ("I", "me"), who is responsible for your data. Contact: mishababec@gmail.com.

In short: your catalog and photos are stored on your device or in a cloud storage account you connect. When you share a catalog with other people, its photos may pass through my cloud storage for up to 30 days so they can reach them. Some content is processed by service providers only when you use a feature that needs it. I don't sell your data. Free users see ads; where the law requires it, you're asked for consent before ads are personalized.

1. What the app collects

Account information. A random account identifier. If you sign in with Google, Apple or email: your email address, and your name and profile picture if the sign-in service provides them. With Sign in with Apple you can hide your email; I then receive an Apple relay address.
Your content. The cards, catalogs, photos, notes and other details you add. It's stored on your device, and with a signed-in account it may also be stored on my servers so it can sync between your devices. Photos are kept on your device or, if you connect one, in your own cloud storage account.
Content you share. With Pro you can share catalogs and cards with other people. They see the shared cards, catalogs and photos and the name on your account, and you see theirs. If photos are shared through Stash Findr's cloud, they're uploaded to my cloud storage and kept there for up to 30 days, only so the people you share with can download them; each of them keeps their own copy. If you share through your iCloud, the photos stay in your iCloud.
Content you send to smart features. When you use AI features or voice input, the photos, text or speech needed for that request are processed to return the result. AI features send the item's photos and your note (when creating a card), the words of an AI search, and the names of your catalogs, tags and fields through my server to OpenAI, only after you agree in the app; you can withdraw that under Profile → AI & OpenAI. Voice input is turned into text by your phone's speech service (Apple or Google).
Purchase information. What you bought and the store's transaction identifiers. Payments are handled by Apple or Google; I never see your card details.
Crash and error reports. If the app crashes or runs into an error, a report is sent so I can fix the problem: the error, the app's last technical steps before it (no card or catalog content), your account identifier, device model, operating system and app version.
Diagnostic log. The app keeps a short technical log on your phone (what it did and what went wrong, with identifiers but not your cards' content) for the last few days. It stays on your phone unless you choose to send it to me from Profile → About.
Usage statistics. Which screens are opened and which actions are taken — for example that a card was created, a search was run, or a purchase screen was shown or closed — with counts such as how many photos a card has, and a random app-instance identifier, your account identifier, device model, operating system, app version and approximate country. It never includes what you write or photograph: no card or catalog names, search words, email or photos. The advertising identifier isn't collected for this.
Ads (Free version). Google's ad service, built into the app, collects your device's advertising identifier (on iOS only if you allow tracking), IP address and device information to show and measure ads.

The app asks for camera, photos, microphone and notification access only for the features that need them.

2. Why it's used

To provide the app: your account, content, sync, AI and voice features, and purchases. This is needed to give you the service you asked for.
To keep the app working and fair: fixing crashes and preventing fraud and abuse.
To improve the app: understanding which features are used and where people get stuck, from usage statistics. This is based on my legitimate interest in making the app better; it isn't used for ads.
To show ads in the Free version. Ads are personalized only with your consent where the law requires it, and you can withdraw consent at any time.
To keep purchase records as required by law.

3. Who receives data

I share data only with service providers that help run the app, and only what they need for their task:

cloud hosting, database, crash reporting and usage statistics providers (Google Firebase, including Google Analytics for Firebase);
cloud storage for photos of shared catalogs (Cloudflare R2);
AI processing (OpenAI, USA), for the AI features you agreed to; speech recognition by Apple or Google, for voice input;
sign-in providers you choose (Google, Apple);
app stores, for payments (Apple, Google);
advertising providers, for ads in the Free version (Google AdMob; see how Google uses data from apps that use its services);
the cloud storage service you connect yourself, which holds your photos in your own account;
the people you choose to share catalogs or cards with, who see what you share.

These providers process data under their own privacy and security terms. OpenAI does not use content sent through its API to train its models. I don't sell your personal information. I may disclose data if the law requires it, or to protect the rights and safety of users or the app.

Some of these providers are located in the United States and other countries. For users in the EEA, UK and Switzerland, such transfers are protected by the European Commission's Standard Contractual Clauses or equivalent safeguards.

4. How long data is kept

Data on your device stays until you delete it or uninstall the app.
Content you send to AI features is kept by OpenAI for up to 30 days, only to monitor for abuse, and then deleted; speech is kept by Apple or Google under their own terms.
Photos of shared catalogs in my cloud storage are deleted after 30 days at the latest, and right away when you stop sharing or delete your account. Copies the people you shared with already have stay on their devices.
Account data is kept while your account exists and deleted when you delete your account (see Delete account).
Purchase records are kept, without your name or email, as long as needed to prevent fraud and meet legal obligations.
Crash reports expire automatically after a limited period.
Usage statistics are kept for up to 14 months, then deleted automatically.

5. Your choices and rights

Ads consent. Where required, a consent form appears before ads are personalized. You can change your choice in the app's privacy settings, turn off tracking on iOS (Settings → Privacy & Security → Tracking) or reset ad personalization in your Android settings.
Remove ads entirely by buying Pro.
Permissions can be turned off at any time in your phone's settings.
Access, correction, deletion and export. You can ask for a copy of your data, or ask me to correct or delete it. If you're in the EEA, UK or Switzerland, you can also restrict or object to its use, and complain to your local data protection authority.
California residents can ask to know, delete and correct personal information, and opt out of its "sale" or "sharing" for targeted advertising. I don't sell personal information for money; to opt out of ad personalization, use the app's privacy settings, your device's ad settings, or email me. I won't treat you differently for using these rights.

To use any right, email mishababec@gmail.com. I may ask you to confirm you own the account, and I'll reply within 30 days.

6. Security

Data is encrypted in transit, and access to server data is limited to your own account. You can also lock the app with a PIN or biometrics. No system is perfectly secure, but I work to protect your information.

7. Children

The app isn't directed at children. I don't knowingly collect personal information from children under 13 (or under 16 in the EEA and UK). If you believe a child has provided personal information, contact me and I'll delete it.

8. Changes

If this policy changes, I'll update the date at the top. For significant changes, I'll also let you know in the app.

9. Contact

Misha Babets · mishababec@gmail.com