Privacy Policy

1. Introduction

StashHaven ("we", "our", or "the app") is a personal knowledge hub and bookmark manager available across mobile platforms (iOS, Android), web, and browser extensions (Chrome, Edge, Safari, Firefox).

This Privacy Policy describes our practices regarding the collection, storage, protection, and disclosure of information when you interact with the StashHaven ecosystem.

2. Information We Collect

2.1 Account Information

When you authenticate to enable multi-device synchronization, we store:

• Email Address: Used strictly to authenticate your identity and send transactional security notifications (such as password resets).
• Profile Name & Avatar: Display preferences configured by you inside the application settings.
• Guest Users: If you use StashHaven as a guest, zero personal identifiable information (PII) is transmitted to our cloud servers. All bookmarks remain stored strictly inside your local device cache.

2.2 Content You Save

• Bookmarked URLs: Web links, articles, videos, and social media posts you choose to save.
• User Notes & Custom Tags: Any contextual tags, summaries, or descriptions you append to a bookmark.
• Screenshots & Media Attachments: Images captured or uploaded via the Smart Screenshot Fallback feature are uploaded to an encrypted private storage bucket.

2.3 Diagnostic Telemetry & Error Logs

To monitor crash frequency and API stability, our client libraries transmit anonymized diagnostics containing non-reversible random session IDs. All outbound logs are passed through strict regex filters that scrub email addresses, bearer tokens, passwords, and sensitive query strings before transmission.

3. StashMind & LLM Data Practices

StashHaven features an intelligent assistant named StashMind, providing AI-powered knowledge retrieval.

• Ephemeral Processing: Link text sent to StashMind for auto-tagging or summarization is processed in-memory and discarded immediately upon prompt resolution.
• User-Initiated Only: Automated tagging is performed strictly upon link ingestion, and conversational queries are only executed when you type into the StashMind chat.

4. How We Use Information

We use the information collected solely for the following legitimate purposes:

• Delivering real-time bookmark and collection synchronization across your authorized devices.
• Rendering platform-specific metadata previews (titles, authors, thumbnails, and favicons).
• Verifying in-app subscription entitlements (via RevenueCat).
• Protecting our infrastructure against automated scraping, denial of service, and SSRF attacks.

5. Storage & Security Architecture

Data security is deeply embedded in StashHaven's architectural design:

• PostgreSQL Row Level Security (RLS): Every database row is secured with cryptographic policies ensuring that only the authenticated user ID has read or write permissions.
• TLS 1.3 / HTTPS Encryption: All communications between the mobile app, browser extension, web application, and database are encrypted in transit.
• Device Hardware Keyrings: Tokens and encryption keys are stored on mobile devices using iOS Keychain and Android Keystore.

6. Third-Party Service Providers

7. Your Rights & Self-Service Deletion

In full compliance with the European General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA):

• Instant Data Export: You can export all your bookmarks, tags, and collections into a standardized, machine-readable JSON or CSV archive directly from Settings → Export Data.
• 1-Tap Complete Deletion: You can permanently delete your entire account and all associated cloud data via Settings → Delete Account. This executes a cascading deletion across all database tables and cloud storage buckets immediately.

8. Contact Us

If you have questions, data protection requests, or security concerns, our privacy team is available to assist you.