Privacy Policy

Effective TODO: EFFECTIVE_DATE

Stashsum is built so that we cannot see your financial data. This policy says exactly what reaches us and others, and what does not.

Summary

• Your ledgers, accounts, balances, tags and notes stay on your device. We never receive them in readable form.
• There is no account, no analytics, no advertising, no tracking and no cookies.
• If you turn on sync, your data is encrypted on your device before it leaves; our server stores only ciphertext it cannot decrypt.
• If you buy Pro, the payment is handled by Lemon Squeezy; we see your order in its dashboard, not in the app.

1. Data on your device

Everything you enter is stored in your browser's storage on your device (IndexedDB), together with your preferences (theme, language, dismissed hints), cached exchange rates and, if you use them, your sync key and license key. None of this is sent to us. Clearing the app's site data or uninstalling it deletes it.

Backups and Excel files you export are created on your device and saved where you choose. We never receive them.

2. Sync (optional, Pro)

When you turn on sync, your device creates a random key that never leaves your devices except inside the recovery code you keep and an encrypted pairing package (below). Your data is encrypted with it (AES-256-GCM) before upload.

Our server stores, for each sync group:

• the encrypted data;
• a hash of an access token derived from your key, used to check that a device may read or write;
• a version number and the times of the last update and the last access.

It cannot decrypt the data. It does not know who you are, except that a sync group created with a license key is linked to a hash of that key (see Abuse limits). We can also see keys and the buyers' names in Lemon Squeezy's dashboard.

A sync group is deleted:

• when you choose Delete the cloud copy in the app's sync settings (sync then stops on all your devices, which keep their data);
• when you reset sync (the old group is deleted);
• after 400 days without any access.

Turning sync off on one device does not delete the group, because your other devices may still use it.

Pairing a device passes an encrypted package through the server. It is deleted when the new device collects it, or after 5 minutes.

A paid license key, briefly. When you buy Pro from the app, the server holds your new license key under a hash of a random code so that the app can collect it: until the app collects it plus at most 10 minutes, and never more than 24 hours (see section 4).

Abuse limits. To limit how many sync groups can be created, the server counts creations per network address (the times of the last 24 hours only; this counter records no sync group). Each license key may own at most three sync groups at a time. To enforce that:

• the server keeps, under a hash of the key (never the key), the identifiers of the sync groups created with it (and, for a few minutes while a sync group is being uploaded, the time of that create);
• each of those sync groups keeps the same hash and its own identifier.

So whoever holds a key can tell which sync groups it created, their size and when they were last used, but never what is in them.

3. Server logs

For each request the server writes one log line: your IP address, the method, the kind of request (with any identifier replaced by a placeholder) and the result code. It never logs sync data, identifiers, tokens or license keys. Logs are kept by our hosting provider for at most 7 days.

4. Buying Pro

Lemon Squeezy is the merchant of record for Pro on the web. It collects your name, email address, billing country, payment details and what is needed for tax, under its own privacy policy. As the seller, we can see your name, email address, country and order in its dashboard, and we use them only to provide support and refunds and to meet legal obligations. We never receive your payment details.

License keys. Your key is used in these cases:

• When you activate a key, your device sends it to our server, which checks it with Lemon Squeezy under a random device name (never your device's name); your device does not contact Lemon Squeezy itself.
• When a sync group is created, the key is checked with Lemon Squeezy again, without any device name.
• About once a day, when the app is open and online, a device that holds a key asks our server whether it still works, and our server asks Lemon Squeezy; this is how a refunded purchase ends Pro.
• When you ask for a refund in the app, our server sends your key to Lemon Squeezy to find the order, checks that it is within 14 days, and asks Lemon Squeezy to refund it.
• When you buy Pro from the app, the app sends a random code to our server, which asks Lemon Squeezy for an English checkout carrying that code (if our server cannot, the app opens a checkout link that carries the code).
• Lemon Squeezy sends us your new key with that code, and we hold the key under a hash of the code until the app that made the code collects it and turns Pro on, plus at most 10 minutes after that, and never more than 24 hours.

We keep only what section 2 says.

Purchases in the App Store or Google Play are handled by Apple or Google under their policies.

5. Services we rely on

The app loads no other third-party code, fonts or images.

6. Your rights

Because we hold almost nothing that identifies you, most requests are answered by the app itself: your data is on your device, and you can export or delete it at any time, and you can delete the encrypted copy on our server yourself with Delete the cloud copy.

For your purchase data, or any other request (access, correction, deletion, objection), contact us at support@stashsum.com. You may also complain to your local data protection authority.

7. Children

The app is not directed at children under 16, and we do not knowingly collect their personal data.

8. Changes

We will post changes here with a new date and, for material changes, tell you in the app before they take effect.

9. Contact

Stashsum · support@stashsum.com