← Back to Stash

Privacy Policy

Last updated: August 11, 2026

What We Collect

When you create a Stash account, we collect your email address, display name, and username. When you use the app, we store your collection data (cards, grades, conditions) and profile information you choose to provide (avatar, banner, bio).

Camera & Photos

Stash uses your device camera to scan Pokémon cards. Card images are processed on-device for identification. Scanned images are not stored on our servers unless you explicitly report a missing card.

How We Use Your Data

Your collection data powers your portfolio value tracking, public profile (if enabled), and leaderboards. We use aggregated, anonymized data to show community stats (total cards tracked, total value). We do not sell your personal data to third parties.

Analytics & Session Recording

We use PostHog to understand how people use Stash — which screens they visit, which features they use, and where they run into trouble. This includes device information (model, OS version, app version), an approximate location derived from your IP address, and a randomly generated identifier linked to your account.

We also record app sessions so we can see where the app is confusing or broken. These recordings are reconstructed layouts, not video of your screen, and several things are deliberately excluded:

  • Your camera feed is never recorded. Nothing the scanner sees is captured.
  • Images are masked — card photos, avatars, and banners are replaced with placeholders.
  • Passwords and sensitive fields are masked, and sign-in runs in an Apple or Google system screen we cannot record.
  • Network request contents are not captured.

Text shown in the app — such as card names, prices, and buttons — is visible in a recording, because without it a recording tells us nothing. We use this only to improve the app, and we do not sell it.

Third-Party Services

We use Clerk for authentication, RevenueCat for subscription management, Cloudflare R2 for image storage, PostHog for analytics and session recording, and Vercel for hosting. Each service processes data according to their own privacy policies.

Public Profiles

If your profile is set to public, your display name, username, avatar, collection stats, and showcased cards are visible to anyone. You can set your profile to private at any time in Settings, and hide individual cards from public view.

Giveaways

If you win a Stash giveaway, we'll contact you via in-app notification and/or the email address tied to your account. For physical prizes, we may ask you to provide a shipping address. Shipping information is used solely to deliver your prize and is deleted once fulfillment is complete. See the Giveaway Official Rules for full details.

Data Deletion

You can delete your account and all associated data directly from the app: Settings → Delete Account. Deletion is immediate and permanent — your profile, stash, wishlist, follows, and any uploaded images are wiped from our servers. You can also email us at hello@thestash.gg if you need assistance. Analytics and session recordings are held separately by PostHog and are not removed by in-app deletion — email us and we will delete those too.

Contact

Questions about this policy? Email us at hello@thestash.gg.