Privacy Policy

This policy applies to the Stasheroo website, dashboard, authentication flow, API, uploaded attachments, and public share pages. It does not cover websites or services operated independently by authentication or infrastructure providers.

We handle information in the following categories:

• Account information: your email address, display name, account identifiers, authentication provider, and basic sign-in timestamps supplied through Supabase authentication.
• Inventory content: item labels, descriptions, quantities, notes, collection names, collection colors and order, and the relationships between items and collections.
• Attachments: files associated with item records, including new JPEG, PNG, and WebP image uploads, together with filenames, file types, file sizes, and storage records needed to retrieve them. Existing document attachments remain readable where available; new document uploads are not currently offered.
• Sharing information: whether a collection has an active share link and the digest and lifecycle information needed to rotate, revoke, expire, or serve that link. The raw link is shown only when a link is first created or replaced.
• Operational information: hosting, authentication, database, and storage providers may process IP addresses, device or browser details, timestamps, and request or error metadata needed to deliver and protect their services.

Stasheroo does not currently offer payments, run advertising, or use behavioral marketing trackers. We therefore do not collect payment-card details or build advertising profiles through the beta.

We use this information to:

• authenticate you and maintain your signed-in session;
• create, display, update, search, organize, and delete your inventory;
• store attachments and provide time-limited access to them;
• create, display, rotate, and revoke collection share links;
• respond to support, privacy, and account-deletion requests; and
• diagnose faults, prevent abuse, and maintain the service.

We do not sell your personal information or inventory content. We do not use your inventory to train a general-purpose artificial intelligence model.

Stasheroo uses Supabase Auth for email magic-link and, when configured, Google sign-in. The provider you choose processes the information required to authenticate you under its own terms and privacy policy. Stasheroo receives the resulting account identity and session information.

The web app stores authentication session data in your browser so you can remain signed in. Signing out removes the active local session through the authentication service. Browser or provider security settings may affect how this works.

Your dashboard is available only after sign-in, but a share link is different. A collection share link is a public bearer link: anyone who has the complete URL can open it without an account and can pass it to someone else. Each collection has one active link. The page can show the collection name, item labels, descriptions, quantities, and allowlisted attachment information; private notes and storage keys are not part of the public response.

Attachment downloads use signed URLs that expire after 60 seconds. Rotating or revoking the collection link prevents future access through that link, but an attachment URL that was already issued may continue to work until it expires. Only share information you are comfortable making available to every recipient of the link.

Stasheroo relies on service providers to operate the beta. These currently include Supabase for authentication, PostgreSQL-compatible database infrastructure, and S3-compatible object storage for attachments, together with web and API hosting. Those providers process data on our behalf to provide their part of the service and may maintain operational logs under their own policies.

Providers may process information in countries other than your own. Data protection rules can differ between those locations.

Account and inventory information is kept while your account is active and as needed to operate the beta. You can delete item and collection records from the dashboard. You can remove individual attachments from the item page and start account deletion from Account settings.

Account deletion first records a durable deletion tombstone, blocks further access, requests deletion of the authentication identity, and queues storage cleanup. Cleanup workers retry failed object and metadata work, so storage removal is eventually consistent rather than immediate. If you need confirmation or follow-up for uploaded files, contact the address below. Limited information can also remain in provider backups, security logs, or records needed to resolve abuse, security, or legal issues. Backup and deletion-ledger retention periods are not currently promised and await formal operator and legal review; there is no automatic expiry commitment for those records.

You can use the product controls to:

• review your inventory and edit your collection settings and display name;
• request an email change when supported by your sign-in method;
• delete items, collections, or your account; and
• rotate or revoke any active public collection link.

You may also ask for access, correction, deletion, or a copy of information associated with your account. Available rights depend on where you live. Send requests from your account email to contact@stasheroo.app. We may need to verify that the account belongs to you before acting.

We use access controls, signed attachment URLs, and service-provider security features intended to limit unauthorized access. No online service can promise absolute security or uninterrupted availability. Keep a separate copy of inventory records or documents you cannot afford to lose, and report suspected account or share link misuse promptly.

Stasheroo is not directed to children. Do not create an account or upload personal information unless you are legally able to agree to the service terms, or a parent or guardian has provided any consent required where you live.

We may update this policy as the beta changes. The date at the top will change when a revised policy is prepared. Before launch, the final policy must identify the operator and state when it takes effect. If a later change materially affects how current account data is used, we will provide an appropriate notice in the product or by email.

For privacy questions or requests, email contact@stasheroo.app. For product help, email contact@stasheroo.app.