What leaves your iPhone, and why.

Who is responsible

Stash Me is made by Roman Volovelskyi, who is responsible for the data described here. Write to vistauser1990@gmail.com with any question about it.

Your stash stays yours

Everything you stash, with its tags, pictures and notes, is kept on your iPhone and in your private iCloud database, under your Apple Account. It syncs to your other devices through Apple. We can’t read it, and it never passes through anything of ours.

A deleted item is kept in Recently deleted for 30 days, then gone for good. You can erase everything the app keeps from iOS Settings, under Stash Me.

A photo is tagged on your iPhone itself. Its picture never leaves your iPhone, and neither does a file’s content or a contact card.

Sorting with an outside model

Only if you turn on Sort with an outside model, in Settings or when the app first asks, is an item’s text sent to be tagged. With it off, tags come from the item’s source and kind alone, and nothing leaves your iPhone to sort it.

With it on, for each item sorted the app sends:

• the item’s title, link and description, and a note’s text
• a place’s name, and for a photo the town or city it was taken in
• where the item came from and who it’s credited to, and what the app read about it there
• the tags you already have, so the sorting reuses them, and your most recent 50 tag corrections

It goes to our proxy, which runs on Cloudflare, and from there to OpenRouter, which passes it to the model provider that answers. The proxy sends it on without anything that identifies your iPhone and keeps none of it. OpenRouter and the provider handle it under their own privacy terms.

What the proxy keeps about your iPhone

Every request to the proxy is signed with a key made by Apple’s App Attest, which proves it comes from the real app on a real iPhone. The proxy knows your iPhone by that key’s identifier, which belongs to this install of the app and not to your name or your Apple Account. Under it, the proxy keeps:

• the key itself, to check the signature on each request, kept with no expiry for as long as this install is used
• how many items it sorted for you today, kept for 2 days
• how many items it has sorted for you toward the free twenty, kept with no expiry, since the free twenty are given once
• for each item it sorted, a one-way fingerprint of what was sent, kept for 30 days, so an item asked about again isn’t counted twice
• for an hour after it checks your purchase, that the sorting is unlocked
• how many feedback reports you sent today, kept for 2 days

The proxy never reads or keeps your IP address.

Purchases

The unlock is bought through Apple, and we never see your payment details. Once your free sortings are spent, the app sends the transaction Apple signed for your unlock, so the proxy can check it is genuine. It keeps nothing of it but the hour noted above.

Feedback

When you send feedback from Settings, the app sends what you wrote, any screenshots or files you attached, your email if you gave one, and the app’s version, the iPhone’s model and its iOS version. It is filed as an issue in a private GitHub repository, with its attachments in another private one, where only the developer reads it. Write to vistauser1990@gmail.com with your report’s number to have it removed.

Usage events

Only if you say Allow when the app asks to help improve Stash Me, or turn on Send usage events in Settings, does the app send anonymous usage events: counts of what you do in the app, such as how many items came in, which way you opened one and how a search or the sorting ended. Until you allow them, none are made.

Beside each event, Mixpanel’s code in the app adds the app’s version, the iPhone’s model, its screen size and its iOS version, the version of that code itself, and an anonymous id made for this install of the app, which belongs neither to your name nor to your Apple Account.

Your IP address reaches Mixpanel with each batch of events, as with any request over the internet. It is not used to work out where you are, since that is turned off, and it is not kept with the events.

They never carry what you stash: no title, link, tag or group name, note, search text or file name.

They go to Mixpanel, which processes them for us in the EU and keeps them for up to a year, then deletes them. Turn off Send usage events and they stop at once: anything not yet sent is dropped and the anonymous id is forgotten, so turning it on again starts afresh. Nothing is tracked across other companies’ apps or shared for advertising. To have the events already sent deleted, write tovistauser1990@gmail.com.

Cloudflare

Cloudflare runs the proxy and serves this site. Like any network, it sees your IP address to deliver each request. It keeps a short log of the proxy’s requests for finding faults, for no more than a few days, which never holds what an item says.

This site

This site sets no cookies, runs no tracking script and asks you for nothing. Cloudflare counts its visits from its own records of the requests it serves: how many, for which pages and from which countries. We see only those totals.

What we don’t do

• No account and no sign-up.
• No tracking across other companies’ apps or websites.
• Nothing sold or shared for advertising.

Your choices

Turn off Sort with an outside model at any time; nothing already tagged is untagged. Turn off Send usage events at any time; nothing more is sent. Delete any item, or erase everything from iOS Settings. To ask what the proxy holds under your iPhone’s key, or to have it removed, write to vistauser1990@gmail.com.

Children

Stash Me isn’t directed at children under 13, and we don’t knowingly collect anything from them.

Changes

If this policy changes, the new one is posted here with its date.