Privacy policy

Who is responsible

Stash is run by Vatroslav Mileusnić, an individual based in Croatia (the data controller). You can reach me at vatroslav@stashitforlater.com for anything about your data, or to report abuse.

What I collect

Only what Stash needs to work:

• Your email address, from your Google account, when you sign in. That is your account identity.
• The things you save — the links and notes you type into Stash, the tags you give them, and the times you added or finished them.
• A page title and icon for each link, so your list is readable instead of a wall of raw URLs (more on this below).

That is all. No name, no profile, no payment data, no advertising or analytics cookies, no tracking across the web.

What my server does when you save a link

When you add a link, my server fetches that page one time to read its title and locate its icon. It stores only the title text and the icon's address — never the page contents, and never any image. The fetch is locked down so it cannot be tricked into reaching private or internal addresses. If you change or remove the link, the stored title and icon are updated or cleared.

Usage statistics

I keep a few aggregate numbers about how Stash is used — such as how many people use it on a given day and how many items get saved. These are counted on my own server from activity the app already has, with no cookies, no third-party analytics, and no tracking across the web. What I store is the aggregate — a date and a count — not a profile of what you personally do, and the per-day record behind it is kept only briefly.

Why I use it, and the legal basis

• To run your account and store and show your saved items — me delivering the service you signed up for (legal basis: performance of a contract, GDPR Art. 6(1)(b)).
• To keep the service secure and prevent abuse (legal basis: legitimate interest, Art. 6(1)(f)).
• To understand how Stash is used, through aggregate statistics, so I can keep improving it (legal basis: legitimate interest, Art. 6(1)(f)).

I will not use your data for any other purpose without asking you first.

Who else sees it

A short, fixed list of service providers:

• Google authenticates your sign-in (Google sees that you log in).
• Hetzner hosts the server your data sits on, in the European Union.
• Cloudflare routes email sent to my contact address.
• Brevo relays my email replies to you, in the European Union.
• Sentry receives crash reports when something breaks (technical error details, stored in the European Union).

That is the whole list. Your data is not sold, rented, shared, used for advertising, or handed to anyone else. Other Stash users cannot see your items — each account's data is isolated.

Where it is stored

On a single server in the European Union. There is no intentional transfer of your data outside the EU/EEA.

How long I keep it

Your saved items: until you delete them. Deleting hides them at once; they are then permanently removed within a week.

Your account: until you delete it. You can delete your whole account from inside Stash, which removes your items with it.

Your rights

Under the GDPR you can ask me to show you, correct, delete, export, or restrict your data, or object to how I use it. You can delete most of this yourself inside the app; for anything else, email vatroslav@stashitforlater.com and I will act on it. You also have the right to complain to the Croatian Personal Data Protection Agency (AZOP, azop.hr).

Children

Stash is not directed at children and is not intended for use by anyone under the age required to consent to online services in their country.

Changes

If this policy changes, the date at the top changes with it. Material changes will be noted on the page.