Privacy Policy

Stash is a read-later app: you save links and notes, and an AI model summarizes them for you. This policy explains what personal information Stash processes, why, who else handles it, and your rights under South Africa's Protection of Personal Information Act (POPIA).

Who is responsible

Stash is run by Jayden Winterbach, an individual (not a company) based in South Africa. They are the responsible party and information officer for Stash under POPIA. Contact them about anything in this policy at stashlinked@gmail.com.

What Stash collects

• Account details: your email address and your password. The password is stored only as a one-way hash (scrypt), never in readable form.
• Google or GitHub sign-in: if you sign in with one of them, it tells Stash your email address, whether it has checked that address, and your account's ID number with them. Stash keeps only the ID and the email, to recognise you next time (an account made this way has no password until you set one). Stash never gets your Google or GitHub password, and can't read or change anything in those accounts. You can disconnect either one in Settings.
• Your content: the links you save, the text Stash extracts from those pages, AI summaries, notes, tasks, highlights, and tags.
• Settings: your time zone, whether daily reminders are on, and, if you add one, your own AI provider, model, and API key. The API key is stored encrypted.
• Sign-in and security data: session records and personal API tokens, both stored only as hashes; one-time password reset links, which expire after an hour; and short-lived counters of attempts per IP address, email, or account, used to block abuse and deleted once their time window ends.
• Notification subscriptions: if you turn on reminders in a browser, the push address your browser gives Stash for that device.
• Usage counts: how many free AI actions you've used each month, to apply the free allowance.
• Consent record: the date and time you agreed to these terms at sign-up.

Stash does not use analytics, advertising, or tracking tools, and does not collect your name, phone number, location, or payment details.

Why Stash uses it

• To run your account and provide the app (saving, summarizing, searching, reminders).
• To keep the service secure: signing you in, rate limits, and preventing abuse.
• To reply when you contact the operator.

The legal bases are your consent at sign-up, the need to process this information to provide the service you asked for, and the operator's legitimate interest in keeping Stash secure. Your information is never sold and is not used for advertising or to train AI models by Stash.

The operator can see account email addresses in order to manage accounts (for example to make a password reset link). As the person running the service, they can technically access the database, but they only look at your content when needed to fix a problem you reported, to keep the service secure, or when the law requires it.

Who else handles it

These service providers process information on Stash's behalf, only as needed to run it:

• Vercel hosts the app. Its servers run in the United States and keep standard request logs, including IP addresses.
• Neon hosts the database, on Amazon Web Services in the United States.
• AI models. To summarize a link or answer a question, Stash sends the relevant text of your content to an AI model. Summaries of saved articles and videos are made by a model the operator runs on its own server, rented from Oracle Cloud in Johannesburg, South Africa, and reached over an encrypted connection; the summarizer doesn't save the text, it only holds it in memory while it writes the summary. (The same server also keeps Stash's nightly backups; see below.) PDFs, Ask Stash, the note AI menu, and any summary that server can't make go to the provider the operator has configured: Google Gemini on Google's paid plan, under which Google doesn't use the text it receives to improve its products; it may keep it for a limited time to detect misuse, as its terms describe. If you add your own API key, all of this goes to the provider you chose instead (for example Google Gemini, OpenAI, Anthropic, Groq, OpenCode, or OpenRouter), under its own terms and privacy policy.
• Backups. Once a night, a copy of Stash's database (accounts, content, and settings, as stored) is saved on the operator's own server at Oracle Cloud in Johannesburg, South Africa, so it can be restored if something goes wrong. Only the operator can access it, and each copy is deleted after 30 days.
• Google (Gmail) sends password reset emails from stashlinked@gmail.com.
• GitHub hosts the app downloads on the Download page. When you download an app, GitHub receives your request (including your IP address) like any website; Stash doesn't see or record it.
• Google and GitHub, only if you choose to sign in with them. You sign in on their site, so they know you used your account to sign in to Stash, under their own privacy policies.
• Push services run by your browser's maker (such as Google, Mozilla, or Apple) deliver reminder notifications if you turn them on. The notification content is encrypted in transit.

When you save a link, Stash's servers fetch that page, so the website sees Stash's server, not your device. When you open a saved article in the reader, images in it load directly from the original websites, which can see your IP address. Stash asks your browser not to send them which page you were on.

Donations

If you donate by bank transfer, the operator's bank statement shows your name as your bank sends it, the amount, and your reference. That is used only to recognise donations and handle refunds, and isn't added to your Stash account. If you ask for a refund, the details you send are used only for that refund. Stash never sees your card details or banking login. If you donate with crypto, the transfer is recorded publicly on that blockchain (the sending address, amount and time), as with any crypto payment; the operator sees only that, and doesn't link it to your Stash account.

Stash also has an optional supporters wall on the Donations page. It's off unless you ask for it: in Settings you can choose a name (or stay “Anonymous”) and tick a box to have it shown publicly there. The legal basis is your consent, and the name shows only after the operator approves it. It's recognition only and changes nothing about your account. You can change or remove your name anytime in Settings, and it's removed automatically if you delete your account.

Storage outside South Africa

Stash's hosting, database, and AI providers are mostly in the United States, so your information is transferred and stored outside South Africa. POPIA allows this with your consent or where it is necessary to provide the service you asked for; you give that consent when you create an account. These providers are bound by their own data protection commitments and security measures.

How long it is kept

Your account and content are kept until you delete them. You can delete individual links and notes at any time, and you can delete your whole account in Settings, which permanently removes your account, content, settings, sessions, tokens, and notification subscriptions straight away (see how to delete your account, including if you can't sign in). Copies may remain in the database provider's backups for a short period, and in Stash's nightly backups for up to 30 days, before they expire. Security counters and reset links expire on their own as described above. Disconnecting Google or GitHub in Settings deletes Stash's record of that account straight away.

If you use Stash offline (in the apps, or in a browser where you turn it on), a copy of your links, saved articles, notes and tasks is also kept on that device so it works without a connection. It isn't encrypted beyond your device's own protection, so keep the device locked. The copy is deleted when you log out or turn offline use off. See the Cookie Policy.

Security

Stash uses HTTPS, hashes passwords, session tokens, and API tokens, encrypts stored API keys, and limits sign-in attempts. No system is perfectly secure. If a breach affects your personal information, you and the Information Regulator will be notified as POPIA requires.

Your rights

Under POPIA you may:

• ask what personal information Stash holds about you, and get a copy;
• ask for it to be corrected or deleted;
• object to its processing, or withdraw your consent (which means closing your account);
• complain to the Information Regulator of South Africa (inforegulator.org.za).

To use any of these rights, email stashlinked@gmail.com. You'll get a reply within 30 days. If you are outside South Africa, you may have similar rights under your local law, and the same address applies.

Children

Stash is for people aged 18 and over. Don't create an account if you are under 18.

Cookies

Stash uses one cookie to keep you signed in, and another for a few minutes while you sign in with Google or GitHub. See the Cookie Policy.

Changes

If this policy changes, the new version will be posted here with a new date. For significant changes, you will be told in the app or by email before they apply.

Last updated: 28 September 2026