OurStash Privacy Policy

Effective date: November 9, 2026

OurStash is an iPhone app for saving posts, links and places into lists, on your own or together with friends. This policy explains what information OurStash handles, why, who can see it, how long we keep it, and the choices and rights you have. We have written it in plain English. If anything is unclear, email support@ourstash.app.

Who is responsible for your information

OurStash is made and run by HsienTsung Wu, an individual developer based in Massachusetts, USA ("we", "us", "our"). We decide how and why your personal information is used, so we are the "controller" of it under European data protection law and the "business" for the purposes of US state privacy laws, where those laws apply.

Privacy contact: support@ourstash.app (put "Privacy" in the subject line to help us find it).
Other ways to reach us are in the Terms of Service.

The short version

We collect what is needed to run the app: your account details (and a profile photo, if you choose one), the links you save, what you write about them, and who is in the lists you share. In every list, yours alone or shared, that includes the items you mark as Seen, your reaction to an item and the comments you write; in a list that is just yours only you can see them, and items you add while a list is just yours stay private to you, with their reactions and comments, after other people join. In a list whose owner has OurStash Plus, it also includes your up or down votes and, for a trip, the plan details the group writes (dates, days, times and a free-text Details field) and the reminders people set. If you give a list a cover photo, we store that photo. In a gift list we also store who each item is for, its price, whether it is bought and any claim.
We do not sell your information, show ads, use advertising tools or track you across other apps and websites. We use no third-party analytics in the app. We do not collect your location. The app sends us anonymous daily totals of which features are used, with no identifier, and you can switch that off in Settings. Our marketing website (not the app) uses Google Analytics to count visits (in the European Economic Area, the United Kingdom and Switzerland only if you allow it), unless your browser sends Global Privacy Control or Do Not Track or you turn it off; see "Website analytics".
OurStash Plus is an optional subscription bought through Apple. Apple handles the payment; we never see your card. Apple tells us what you bought and until when, and we keep that with your account to unlock Plus.
If you invite someone by email, we send them one invitation for you and keep only a scrambled (hashed) and a shortened form of their address.
People in a list you share see your name, what you added, the notes in that list, which items you have marked as Seen, your reaction and your comments (what you add while a list is just yours stays private to you, even after others join). A public link shows a list's name, the number of posts and its saved items (up to 100) to anyone who has the link, but never the comments, notes, who added what or the owner's name.
When you open a post, it opens in the platform's own app (YouTube, TikTok, Instagram or Facebook) if you have it, or otherwise in the in-app browser, and that platform receives information directly from your device under its own privacy policy, not from us. This version of OurStash has no embedded players.
You can delete your account in the app at any time (Settings → Delete Account). That deletes your lists, posts, notes, Seen marks, reactions, comments, votes, reminders, the lists you follow, your subscription record and the covers of lists you own, including what you added to friends' lists. Deleting your account does not cancel an OurStash Plus subscription; cancel it in your Apple ID settings, or Apple will keep charging you.

Information we collect

Information you give us

Sign-in details. You sign in with Apple, with Google, or with a 6-digit code we email you. We keep the email address the provider gives us, the provider's account identifier for you, and which sign-in methods you have used. With Sign in with Apple this can be a private relay address. We only treat an address as yours and use it to link accounts when the provider confirms it is verified (for Google, that is Gmail and Google Workspace addresses). An unconfirmed address from Google is stored with your sign-in method but is not used to link accounts or to email you.
Guest accounts. You can start using OurStash as a guest, without signing in. A guest account stores only the name you type: no email address and no Apple or Google identifier. If you later create an account (with Apple, Google or an email code), the guest account becomes that account and keeps the same lists and data.
Sign in with Apple. Apple also gives us a token that lets us revoke OurStash's access to your Apple ID when you delete your account. We store it encrypted and use it for nothing else.
Sign in with Google. We verify the sign-in token Google gives the app and keep your Google account identifier and email address. We never receive your Google password and do not access any other Google data.
Email codes. When you sign in with an email code, we send the code to your address through our email provider. We store only a scrambled (hashed) form of the code, and it expires after 10 minutes.
Your name. You choose the name shown to the people in your lists ("What should friends call you?"). It may be pre-filled from the first name Apple or Google gives us; we keep that suggested name only until you choose yours. A public page does not show your name.
Your profile photo (optional). If you choose one in Settings → Profile Photo, the app makes a small square copy (256 × 256 pixels) of the part of the picture you framed and uploads only that. We remove any hidden details stored in the file (such as where or when the picture was taken) before keeping it. We never import a photo from Apple or Google.
List covers (optional). A list or trip can have a cover: one of five colours, or a photo you pick from your photo library or take with the camera. The app makes a copy at most 1,200 × 600 pixels and about 120 KB and uploads only that; we remove hidden details from the file (such as where or when it was taken) before storing it. The owner and anyone who can add posts can set, change or remove a list's cover; it is shown to everyone in the list, to anyone following it and, if the list has a public link, to anyone with the link. A cover is never taken from a link you saved.
What you save and write. The links you save, the lists you create and their names, notes, titles you type for a post ("What's it about?"), addresses you type for a map place, and the dates you saved or changed things. In a shared list: which items you have marked as Seen and when; your reaction to an item (one emoji per item, which you can change or remove) and when; and the comments you write on items (up to 280 characters of plain text) and when. Before storing a comment we remove control and invisible characters from it, and our server refuses comments that contain certain slurs. For a list you own: its public-link setting, and, if you have OurStash Plus, whether voting, the Top picks sort, trip planning and reminders are on. In a list whose owner has Plus: your vote (up or down) on each item you vote on, with the time.
Gift lists. In a list where Gifts is switched on, for each item: who it is for (one name, or up to five, that you type; these are plain text and the people need not use OurStash), a price (typed by you, or filled in from the shop page, see "Details about a link") and whether it is Idea or Bought. If the owner has switched claims on, we also keep which member has claimed each item and when. Totals per person and for the list are worked out on your phone and not stored. The names you type are visible to the other members as described in "Who can see your information in OurStash", so do not type anything about another person that you would not want them or the group to read. If an item is moved to another list, its gift details and its claim are removed.
Trip plans and reminders. In a trip (a list whose owner has Plus and has turned trip planning on): the trip's start and end dates and time zone; for each item, its status (Idea, Decided or Booked), the day and time it is planned for (each item can also have its own time zone), and a free-text Details field of up to 1,000 characters where the group can write things like an address, a confirmation number or what to bring. Everyone in the list can read Details, so do not put anything in it that you would not share with the whole group, such as payment card numbers or passwords. Reminders: when you set one, we store which item it is for, the time, whether it is for you only or for everyone in the list, an optional note of up to 80 characters, who set it and whether it has fired.
Lists you follow. If you follow a public list, we store which list, when you followed it, whether you asked for "New items" alerts, and how far you have read.
Your OurStash Plus subscription. If you subscribe to OurStash Plus, you buy it from Apple inside the app, and Apple, not us, takes the payment; we never receive your card or bank details or your billing address. Apple sends the app a signed record of the purchase, which the app passes to our server, and Apple sends our server a notice when the subscription renews, is about to lapse, lapses, is refunded or revoked, or starts or stops being shared with your family. From these we keep: the product you bought (monthly or annual), whether you are in a free trial, when the current period ends, whether automatic renewal is on, whether the purchase is your own or shared with you through Family Sharing, Apple's identifiers for the purchase (which are not your Apple ID and do not identify you to us on their own), the date Apple signed the record, and whether it was refunded or revoked. So that Apple's records and ours match, the app gives Apple an "app account token" made from your OurStash account identifier when you buy; Apple stores it with the purchase, and it means nothing to Apple on its own. We also keep, on your account, the date until which Plus is active. We do not learn who else is in your Apple family.
Settings. Your notification setting, the lists you have muted, and which activity you have already seen. The app remembers on your phone, not on our servers, that it has shown you the one-time Plus offer, so it is not shown again.
Reports and blocks. If you report a post, a comment, a person or a list in the app, we keep the report: who sent it, what it is about (the post, comment, person or list, and the list it is in), the reason you picked and any note you wrote (up to 500 characters). If you block someone, we keep who blocked whom and when.
Email invitations. If you own a list, you can invite people to it by email. You choose each address: you type or paste it, or pick it with Apple's contact picker, which runs outside OurStash and gives the app only the email addresses you tick (never names, phone numbers or other contact details; the app never asks for access to your contacts). The app sends us the addresses (up to 10 at a time) and the role you chose, and our server emails each person one invitation on your behalf through our email provider (see "Email"). We use the full address only while we send the email and do not store it. We keep a scrambled (hashed) form of it, made with a secret key, to avoid duplicate invitations, enforce our limits and honour do-not-invite requests, and a shortened form such as "d***@example.com" so you can see who hasn't joined yet. We also keep a record of each invitation email sent (the hashed address, you as the sender, the list and the time) for 24 hours to enforce those limits. We never tell you whether someone already has an OurStash account. How long each of these is kept is under "How long we keep information".
Support messages. If you email us, we keep the message and your address for as long as we need to help you and keep a record of the request.

Information collected automatically

Sessions. Each signed-in device gets a session. We store a scrambled (hashed) form of its token, a device label such as "iPhone", when it was created and, to the hour, when it was last used. A session ends when you sign out, when you delete your account, after 90 days without use, and in any case one year after you signed in on that device.
Details about a link. When a YouTube or web link appears in the Add Link screen or the OurStash Share sheet, the app sends it to our server with your sign-in so it can show a preview, as soon as the screen shows it and even if you then cancel without saving. For a YouTube link, our server fetches the video's title, channel name, thumbnail address and length. For other web pages it reads the page's title, description, preview image address and site name. For Apple Maps and Google Maps links it reads the place name, address and coordinates written in the link itself. When the page shows a price in US dollars (or with no currency), our server also reads it and keeps it with the link, so it can pre-fill a gift's price. Our server identifies itself honestly as "OurStashBot"; it does not pretend to be a browser, and if a shop refuses it we do not try to get around that. If our server cannot preview a web page you save, or you are offline when you save it, your iPhone may load that page itself (using the link preview feature built into iOS) and send us its title (plain text, up to 200 characters) and a small picture (re-saved without hidden details, at most about 120 KB), to keep with the link you saved. This is done only for a link you chose to save, only from the person who saved it, and it never replaces a preview our server already has. Nothing else about the page, and nothing about what else you browse, is sent to us. We do not fetch anything for Instagram, Facebook or TikTok posts; for TikTok and map short links our server only expands the short link to find the full address.
A shared link cache. We keep a cache of public link details (such as a YouTube video's title) so the same link is not fetched twice. It is not tied to any account and entries are deleted after 30 days.
Sharing records. When you share or join a list we record who is in it, each person's role ("Can view" or "Can add posts"), who invited them, when they joined, and when and how they left. If following public lists is offered in a later release, we will also record who follows a public list (see "Lists you follow").
Activity. In lists with more than one person we record events such as "added a post", "added a note", "commented", "joined" and "left": who did it, in which list, and for which post. When someone tries to join a list that is full, we record that for the list's owner only. Activity stores identifiers only, never copies of titles, notes or comments, and is deleted after 30 days. Marking an item as Seen, reacting and voting create no activity record.
Public page views. Public list pages run no scripts and we do not count their views. If we later add a view count, we will update this policy first.
Notification tokens. If you allow notifications, your iPhone gives us a token for this app on this device, which we use only to send you OurStash notifications through Apple.
Sync records. To bring your other devices and your friends' devices up to date, we record which lists, posts and memberships changed and when.
Invite and public links. We store invite links only in a scrambled (hashed) form, with the list, the role they grant, how often they have been used and when they expire. A list's public link is a random code stored with the list.
Technical information. Our servers receive your device's IP address with each request, as any internet service does. We use it only in short-lived counters that limit abuse (for example too many sign-in attempts from one address); those counters expire within an hour. Sign-in limits also count code requests and wrong codes per email address; that count is kept with the sign-in code record for up to 24 hours after the last attempt (longer only while an address is locked after too many wrong codes) and then deleted. We also count, per account, how many comments you post in an hour, how many covers a list gets in a day and how many reminders a list has, to enforce the limits in the Terms.
Anonymous usage counts. Unless you switch it off (Settings → Privacy → Share Anonymous Usage Counts; it is on by default), the app keeps a tally on your phone of how often certain features were used that day (for example "saved from the Share sheet: 3", "opened the Add Link screen: 1", "sign-in code entered wrongly: 1", "Plus sheet shown: 1") and sends the totals to our server, normally at most a few times a day. Once a day it also says the app was used that day, with how long ago it was installed in broad ranges (such as "4 to 7 days"), the app version and the iOS version. These requests carry no account, device or advertising identifier, no sign-in token and no cookie, and never include links, titles, notes, list names, names, email addresses or anything you type. Our server only adds them to running totals per day across everyone (we do not keep the requests, your IP address, or any combination of version, iOS and install age), and we keep those totals for up to 400 days. We cannot tell from them who you are or what you did. The Welcome and sign-in screens are counted too, before you have an account; the switch is in Settings once you are signed in. Turning the switch off stops the tally and deletes any counts not yet sent. Debug versions of the app never send them. Our server also keeps daily totals, across everyone, of how many Plus trials started, subscriptions were bought, lapsed or cancelled, reminders were sent, public pages were viewed and lists were followed; none of these name a person.
Server logs. Each request writes one short diagnostic line: a request identifier, the type of request (the method and the address the app called, with invite and public link codes removed; it can include the internal identifiers of a list, a post or another person involved, for example the person you block), the result and an error code. Our background jobs log counts, and a failed notification can log the internal identifiers of the list and activity involved. Logs never contain your email, name, sign-in codes, tokens, titles, notes, addresses or links. We have turned off our hosting provider's log storage, so these lines can only be viewed live while we are debugging and are not kept.

Information we do not collect

No passwords. You sign in with Apple, Google or an email code.
No payment details. Apple handles every payment for OurStash Plus and never passes us your card, bank or billing details.
No location. The app never asks for your location and never reads it. Map places are places you chose to save, taken from the link or typed by you.
No access to your contacts or microphone, and no access to your photo library. If you pick an address for an email invitation, Apple's contact picker gives the app only the addresses you tick (see "Email invitations"). If you choose a profile photo or a list cover, you pick a single picture in the iPhone's photo picker; the app never sees your other photos. The app asks for camera permission only when you choose to take a cover photo, and uses the camera only while you take that picture; you can say no and pick a photo instead.
No advertising identifier, no third-party analytics or crash-reporting tools in the app (our marketing website uses Google Analytics, see "Website analytics"), no viewing history. (The anonymous usage counts described above contain no identifier and cannot be linked to you.) We do not record what you watch or for how long. No Google software runs in the app: Sign in with Google uses Google's own sign-in page in a system browser sheet (see "Who we share information with").
No copies of the videos, posts or web pages you save. We store the link and the details listed above, never the content itself.
No "suggested list" data. When you save something, the app may mark one of your lists as "Suggested", using simple rules (for example, a map link suggests a places list) and the posts you yourself saved earlier; this is worked out on your iPhone, nothing is sent to us for it, and nothing is saved into any list until you tap Save.

Information from other people

If a friend adds you to a list, we record your membership, as described above.
If a list owner removes you, we record that for up to 90 days so every device can agree on who is in the list.
If a list owner invites you by email, we receive your email address from them. We send you one invitation and keep only a hashed and a shortened form of your address; see "If you received an invitation".
If someone in a list sets a reminder for everyone, we send it to you as well, whether or not you have Plus, unless you have muted the list or turned activity notifications off.

Information kept on your iPhone

Some information stays on your phone and is not sent to us. Unless we say otherwise, it can be included in your iPhone's backups (iCloud or a computer), like other app data, until it is removed.

Addresses you invited. Your iPhone remembers the full email address of each person you invited from it, next to that invitation, so you can tell your pending invitations apart (your other devices show the shortened form). It is kept in the app's own storage, not shared with the Share extension and not sent to us. The app forgets an address when it next sees that the invitation was accepted, revoked or has expired, and forgets all of them when you sign out or delete your account.
Links waiting for you to sign in. If you share a link to OurStash, or open an invite or public list link, while you are signed out, the app keeps that one link on your phone so it can finish once you sign in. A shared link is used only if you sign in within an hour, and an opened invite or list link only within 24 hours; neither is sent to us before you sign in. The link stays in the app's storage until the app next checks it, even after those times, and is deleted when you sign out.
Links you copy. When you tap Copy Link (for an invite link, a public page or a post) or copy an address or a note, the app puts it on the iPhone's clipboard, like any copied text. It stays there until you copy something else. With Apple's Universal Clipboard it can also be pasted on your other Apple devices signed in to the same Apple ID, and other apps can read it when you paste into them. Anyone who has an invite link can join the list until the link expires, so be careful where you paste it.
Your "just me" reminders are stored on our server so that they reach all of your devices, but each device schedules the alert itself, with iOS, and the alert is shown by your phone, not sent by us.
The Plus offer flag. Whether the one-time Plus offer has been shown on this device.
Your Plus status for the app's own screens. The app reads your App Store purchase state from Apple on the device to decide what to show you (for example "Manage Subscription"); what other people can do in your lists is decided by our server, from the records described above.

Why we use your information and our legal bases

Where European law applies, each use needs a legal basis. Here is what we do and the basis we rely on.

Running OurStash for you. Signing you in, keeping you signed in, syncing your lists across your devices, fetching the details of links you save, sharing lists with the people you invite, showing public pages you turn on, keeping the Seen marks, reactions, comments and votes members add to a shared list, keeping trip plans and reminders, storing list covers, letting people follow public lists, and sending the sign-in code, the one-time welcome email and the email invitations you ask us to send. Basis: performing our contract with you (the Terms of Service).
Providing OurStash Plus. Checking the purchase record Apple gives us, keeping your subscription status up to date from Apple's notices, and unlocking Plus in the lists you own. Basis: performing our contract with you.
Emailing people you invite. Using the address you give us to send one invitation, and keeping a hashed form of it to limit repeat invitations and honour do-not-invite requests. Basis: our legitimate interest, and yours, in letting you invite people you know to a list, balanced by our limits and by the recipient's right to object (see "If you received an invitation").
Notifying you. Sending push notifications about activity in your shared lists, reminders people set for everyone, and, if you ask for them, alerts about new items in lists you follow. Basis: your permission, which you give through the iPhone notification prompt and the Activity notifications switch in Settings, and can withdraw at any time.
Keeping the service safe. Limiting abuse, preventing people from guessing codes and links, investigating reports, taking down pages that break our rules, debugging problems, and keeping records of removals. Basis: our legitimate interest in running a secure, lawful service, and in some cases a legal obligation.
Answering you. Replying to support and privacy requests and verifying who is asking. Basis: our contract with you, our legitimate interest in supporting the people who use OurStash, and legal obligations.
Improving OurStash. Counting, as anonymous daily totals, which features are used and where people stop (for example how many people open the Share sheet and how many finish saving), so we know what to fix. Basis: our legitimate interest in improving the app; the counts carry no identifier, and you can switch them off in Settings at any time.
Complying with the law. Responding to lawful requests, protecting people's safety and our rights, and keeping records the law requires. Basis: legal obligation and legitimate interest.

We do not make decisions about you by automated means that have legal or similarly significant effects, and we do not build profiles of you.

Who can see your information in OurStash

Members of a shared list see your name, which posts you added ("Added by"), the notes in that list (each with the name of the person who last wrote it), the titles and addresses you typed, and whether the list has a public link. Notes you wrote while a list was private become visible to members once you share it; the app tells you this the first time you share a list that has notes, and tells people who join with "Can add posts" that notes are visible to everyone in the list. Anyone who can add posts can edit the note on any post in the list, and anyone in the list can copy a post's link and title into a list of their own with "Save to…". Your notification mute setting is visible only to you. Once a list is shared, everyone in it, including people who join later, also sees which items you have marked as Seen (and when), your reaction to each item and your comments, each with your name; there is no switch for these, and the app says so under the comment box ("Everyone in this list, including people who join later, can see this"). In a list whose owner has Plus, everyone also sees your up or down votes, the trip plan (statuses, days, times and Details) and the reminders set for everyone. You can remove your own Seen mark, reaction, comment or vote at any time. The list's owner can delete any comment in the list.
Gift lists and claims. Members of a list with Gifts on see each item's price, who it is for and whether it is Idea or Bought. Claims have two modes, chosen by the list's owner, and every member can see which mode the list is in. In Surprise mode (the default), the list's owner is not sent any claim, who an item is for, or whether it is Bought: our servers withhold them, including from the activity list, notifications, counts, exports and the owner's other devices, so the surprise is kept. The owner still sees prices, and the other members see the claims. In Open mode the owner sees claims, who an item is for and its status like any member, and can claim items too. Claiming never creates an entry in the activity list. A notification about a claim says only "Someone claimed a gift" with the list's name, never the item, the person, who it is for or the price, and goes to members other than the person who claimed (and, in Surprise mode, not to the owner). When the owner changes the mode, members get a notification that names the owner and the list. If you block someone, or they block you, neither of you sees the other's claims, in either mode. A public page never shows gift details or claims.
Your profile photo, if you choose one, is shown to you and to the people you share a list with, next to your name, for as long as you share a list with them. It never appears on public pages, in invite links, in emails or in notifications. If either of you blocks the other, we stop sending either photo to the other person; a copy their app downloaded before the block can still show in a list you both belong to until they sign out or you change or remove your photo.
When you leave a list or are removed, the posts you added stay in the list and your name is replaced with "a former member". Your Seen marks, reactions, comments and votes in that list stay too, shown the same way.
Invite links. Anyone who opens an invite link sees the name of the person who sent it and the name of the list. An invite link stops working after 14 days or 25 uses, and the list owner can turn all invite links off at any time. Anyone who has the link can join, so share invites only with people you trust.
Email invitations show the recipient your first name (the first word of the name you chose) and the list's name, and say whether they will be able to add posts. An emailed invitation works once and expires after 14 days. Your email address is never shown to them.
Public links. If a list's owner turns on its public link, anyone with the link can see a web page with the list name, the number of posts, and up to 100 saved items. Each item shows its title (the title you typed, or the fetched title, or the website's name), the saved link with sharing and tracking parameters (such as YouTube and Instagram share identifiers) removed, and for YouTube and web links the channel or site name and a thumbnail. For a map place it shows the place name and the address that is part of the link. Instagram, Facebook and TikTok posts appear as text items. The page also has a "Report this page" link. A public page never shows notes, addresses you typed, Seen marks, reactions, votes, trip details, reminders, comments, who added what, the owner's or members' names, a cover or when things were saved. Public pages ask search engines not to index them, but anyone who has the link can open it and share it. Turning the link off removes the page within about a minute. If we take a page down for breaking our rules, the owner cannot turn it back on.
Reports and blocks. We never tell people that you reported or blocked them. Blocking someone hides their posts, notes, activity, Seen marks, reactions, comments and votes in the app on your devices (they are also left out of the counts and Top picks order you see), takes you out of lists they own and them out of lists you own, removes any follow between you, and means neither of you can join or follow the other's lists. It does not yet stop an invitation email they send to your address; to stop those, see "If you received an invitation". They can still see what you add to a list you are both in, unless one of you leaves it.
Notifications show the name of the person who did something and the list's name, for example "Mia added 3 posts", "Mia joined Weekend plans" or "Sam commented in Weekend plans". A reminder notification says only that a reminder is due in a list and, for a reminder someone set for everyone, who set it; the item and any note appear once you open it. A "new items" alert for a list you follow names the list. Notifications never contain post titles, notes, comments, reminder notes or links. Marking an item as Seen, reacting to it or voting on it never sends a notification.
Us. We do not read your lists or notes as part of running OurStash, and nothing in the app sends your content to us. A report you make sends us only what it points to, the reason and your note. We can, however, access what is stored on our servers when that is necessary: to fix a problem you report, to investigate a report of abuse or a legal request, to keep the service secure, or when the law requires it. We limit this access to what the situation needs.

We do not sell or rent your personal information, we do not share it for advertising, and we have no advertising partners. Our only analytics provider is Google Analytics, on our marketing website only (see "Website analytics"); the app's anonymous usage counts stay with us. We share information only as described here.

Service providers that work for us (processors)

These companies process information on our behalf. Our agreements with them restrict them to processing it on our instructions and to protecting it.

Cloudflare, Inc. (United States) hosts our servers, database, queues, web pages and the counters that limit abuse. Everything we store about your account and lists lives in Cloudflare's systems, including list covers and your subscription record. Cloudflare also routes email sent to support@ourstash.app to our mailbox. Cloudflare keeps its own network security and traffic records as part of running its service. (Cloudflare's privacy policy)
Resend, Inc. (United States) sends our emails: sign-in codes, the one-time welcome email, and the invitations list owners send. It receives the recipient's address and the content of the email (including the code, or for an invitation the inviter's first name, the list's name and the invite link), and keeps delivery records under its own retention settings. (Resend's privacy policy)

Platforms that act for themselves (independent controllers)

These companies receive information because you chose to sign in with them, to buy something from them, or to save or open their content. They use it under their own privacy policies, not under our instructions.

Apple Inc. provides Sign in with Apple (Apple gives us your identifier, the email you chose to share and a revocation token), the Apple Push Notification service (which carries our notifications to your iPhone; Apple handles the token and the notification text), and Apple Maps on your device (map pictures and place lookups). We also ask Apple to revoke OurStash's access to your Apple ID when you delete your account. Apple also sells OurStash Plus. When you subscribe, you buy from Apple under Apple's Media Services terms: Apple takes the payment, keeps your payment details and purchase history, handles Family Sharing, refunds and cancellation, and gives us the purchase record described above. Apple receives the app account token (made from your OurStash account identifier) with the purchase. (Apple's privacy policy)
Google LLC provides Sign in with Google (Google tells us your account identifier, email address and first name) and the YouTube API Services, which our server uses to look up the title, channel, thumbnail and length of YouTube videos you save. Those lookups come from our server and send Google the video's identifier, not your account. When you open a YouTube video, it opens in the YouTube app or in the in-app browser (see below). Our server also contacts Google to expand shortened Google Maps links. How Sign in with Google works in the app. When you choose Sign in with Google, OurStash opens Google's own sign-in page in a secure browser sheet provided by iOS; you sign in on Google's page, not in OurStash, and Google handles that page and what you enter there under its own privacy policy. Google then gives the app a sign-in token with your Google account identifier, email address and name (and, if you have one, the address of your Google profile picture). We use and keep only your account identifier, email address and first name, as described above, and none of it is used for advertising or tracking. Sign in with Google puts no Google software in the app. (Google Privacy Policy)
Meta Platforms, Inc. (Instagram and Facebook) and TikTok receive information directly from your device when you preview their posts in OurStash or open them (see "Content loaded on your device" below). Our server expands TikTok short links by contacting TikTok; that request is not tied to your account.
Websites you save are contacted by our server to read the page's title, description and preview image (our server identifies itself honestly as "OurStashBot" and does not disguise itself as a browser) , and your device loads thumbnails from the website or platform that hosts them, which sees your device's IP address.

Other disclosures

If the law requires it, for example to comply with a court order or lawful request, or to protect people's safety, prevent fraud or abuse, or defend our rights.
If OurStash changes hands. If the app is transferred to a company we create or to a new owner, your information would go with it. The new owner would have to keep the promises in this policy or give you notice and a chance to delete your account first.
With your direction. When you share a list, turn on a public link or send an invite, you are asking us to show information to those people.

OurStash Plus

OurStash Plus is an optional subscription ($2.99 a month or $24.99 a year, with a 1-month free trial where Apple shows one) that unlocks voting with Top picks, up to 25 people per list, trip planning and reminders in the lists you own, for everyone in them. The Terms of Service explain the subscription itself (renewal, trial, cancellation, refunds, Family Sharing and what happens when it ends). This section is only about information.

Apple handles the purchase. You buy Plus from Apple inside the app. Apple takes the payment and keeps your payment details, your Apple ID and your purchase history under its own policy. We never receive your card or bank details, your Apple ID, or your Apple family's details.
What Apple tells us. The signed purchase record and the notices listed under "Your OurStash Plus subscription" above. If you subscribed through Family Sharing, Apple tells us only that the purchase is shared with you, not by whom.
What we do with it. We verify that the record really came from Apple, store it with your account, and compute the date until which Plus is active. The lists you own are marked as having Plus so that everyone in them gets the Plus features, and the people in those lists can see that the list has Plus (for example, voting is available). They cannot see what you paid or when it renews.
Trials and purchases are counted in our anonymous daily totals (how many started, bought, lapsed or cancelled), with no identifier.
Restoring. "Restore Purchases" asks Apple for your current purchases on this Apple ID and sends us the records again. If one Apple ID has been used with several OurStash accounts, the most recent restore decides which account gets Plus, and the app tells you.
When Plus ends, we keep your subscription record with your account (so a renewal or a refund can be matched to it), stop marking your lists as Plus, and delete nothing you or your lists' members added. The record is deleted when you delete your account.
Testers and App Review who buy with Apple's test (sandbox) environment are handled the same way; those purchases are never counted in our totals.

Content loaded on your device from other platforms

Some of what OurStash shows comes straight from other companies' servers to your phone, without passing through ours. In each case that company receives your device's IP address and the usual details a web request carries (such as your device type and language), and may set its own cookies, under its own privacy policy.

Previews. When you save or view an Instagram, Facebook or TikTok post, your device may load a preview of that post directly from the platform, using the link preview feature built into iOS (the request goes from your phone to the platform, not through Apple or us). The preview stays on your device and is never sent to us; only a title you type and confirm yourself is saved to your account.
Shop pages. If our server cannot preview a shop's page, or you are offline when you save it, your device may load the page directly from that shop, using the same iOS link preview feature, to read its title and a picture. The shop receives your device's IP address and the usual details of a web request. Only the title and a small picture are sent to us, and only for a link you chose to save.
Thumbnails. Pictures for YouTube and web links are loaded by your device from YouTube or the website that hosts them. Thumbnail images you've viewed may be stored on your device in a cache that is cleared when you sign out or delete your account, and are not included in backups. List covers and profile photos come from our server, not from other platforms.
Opening posts. This version of OurStash does not play videos or posts inside the app and loads no platform players or embed scripts. When you open a YouTube, TikTok, Instagram or Facebook post, it opens in that platform's own app if it is installed; otherwise, and for websites, it opens in the in-app browser (Apple's Safari view inside OurStash, with a Close button to come back). Either way you are visiting that platform or website directly: it receives your IP address, device information and what you view, may show its own ads and set its own cookies, and handles all of this under its own privacy policy. The in-app browser keeps its own cookies and website data, separate from the Safari app. OurStash does not receive or store what you view there, and we keep no viewing history.
Maps. Map pictures and place names come from Apple Maps on your device. Apple receives the coordinates or place text being shown, not your account. Lookups are kept in memory on your device only and are never sent to our servers.
Opening a post in another app, in the in-app browser or in Safari takes you to that platform or website, under its own privacy policy.

Their privacy policies: YouTube (Google), TikTok, Instagram, Facebook (Meta) and Apple.

YouTube API Services

OurStash uses the YouTube API Services to show details of YouTube videos you save, such as the title and length. This version does not play videos inside the app; a video opens in the YouTube app or the in-app browser. By using OurStash you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms) and Google Privacy Policy (https://policies.google.com/privacy).

OurStash does not ask for access to your YouTube or Google account data through the YouTube API Services, and it does not use the YouTube API Services to collect or store information about you. Video details we fetch are stored with the post you saved and in a shared cache that is refreshed after 7 days and deleted after 30 days. If you signed in with Google, you can review and remove OurStash's access to your Google account at any time on Google's security settings page: https://security.google.com/settings/security/permissions.

Website analytics

This section is about our marketing website at ourstash.app (the home page, Features and the use-case pages), not the app. The app has no third-party analytics. The pages our server shows (this policy, the Terms, Support, invite pages and public list pages) do not use Google Analytics either.

What we use. Google Analytics 4, provided by Google LLC, helps us understand how many people visit our website and which pages help them. We use it only for that. We have turned off Google signals, advertising features and ad personalisation and set every advertising consent to "denied", and we do not use it for advertising, remarketing or cross-site tracking. We do not send Google a name, an email address, an account identifier or anything else that links a visit to an OurStash account, and website visits are never connected to your use of the app.
What is collected. When a page loads (and, in the European Economic Area, the United Kingdom and Switzerland, only after you choose Allow), Google's script records a page view: the page address and title, the page you came from (the referrer), your browser and device type, screen size and language, and an approximate location (country, region and city) that Google works out from your IP address. Google states that Google Analytics 4 does not log or store IP addresses. If you tap an App Store button, it also records that tap. Our server does not receive any of this.
Cookies. Google Analytics sets two first-party cookies on our website, "_ga" and "_ga_" followed by an identifier, to tell visits apart. They hold a random number, not your identity, and expire after at most 90 days (renewed when you visit again). Without analytics, our website sets no cookies.
Who receives it. Google processes this information for us as our service provider under Google's terms for Google Analytics and its data processing terms. We have turned off the settings that let Google use it for its own purposes, such as data sharing with Google products and services. See how Google uses information from sites that use its services.
How long it is kept. Google keeps the visit records for 2 months (the shortest setting); we may keep reports that only contain totals, such as visits per page per day.
Your choices. If you visit our website from the European Economic Area, the United Kingdom or Switzerland, or from a location we cannot determine, we do not load Google Analytics or set its cookies unless you choose "Allow" in the banner we show you; if you choose "No thanks", nothing is requested from Google, and we remember either answer in your browser for 6 months. You can change your mind at any time with "Analytics preferences" at the bottom of any page. Our website does not load Google Analytics at all (it makes no request to Google) if your browser sends Global Privacy Control or Do Not Track, or if you turn analytics off with "Analytics preferences" at the bottom of any page of the website, which remembers your choice in your browser. You can also block cookies or scripts in your browser, or install Google's opt-out browser add-on.

Email, notifications and your choices

Email

We send email only to run the service: the 6-digit sign-in code when you ask for one, one welcome email when an account is created, and the invitations list owners ask us to send. We do not send newsletters or marketing email, and our emails contain no tracking pixels. Receipts and renewal, trial and price-change emails for OurStash Plus come from Apple, not from us.
Invitations. Only a list's owner can invite people by email. Each invitation comes from OurStash's own address, never the inviter's, with support@ourstash.app as the reply address. It contains the inviter's first name, the list's name, whether the recipient will be able to add posts, a button with the invite link (which works once and expires after 14 days), a link to OurStash on the App Store, and a note that it was sent on the inviter's behalf and can be ignored. There is no personal message. Its footer says why the person is getting it and how to report abuse or stop these emails, and links to this policy and our Terms. It also carries a standard unsubscribe header, so many mail apps show an Unsubscribe button that emails us a request to stop.
Limits on invitations. One owner can send at most 20 invitation emails in any 24 hours, and at most 10 for one list in any hour. One address receives at most 3 invitation emails in any 24 hours from everyone together, and at most one a day for the same list. We also cap how many emails OurStash sends in a day. We never send an invitation to an address on our do-not-invite list, and we never re-send one automatically.
Every email we send says it comes from OurStash, has a working reply address, and links to this policy, so the recipient knows who sent it and why.
If you receive an email from OurStash you did not expect, you do not need to do anything. To report it or to ask us not to email an address again, reply to it or write to support@ourstash.app.

Push notifications

OurStash asks for permission before sending notifications, and only sends them about activity in lists you share, reminders set for everyone in a list you are in, and, if you turn them on for a list you follow, new items in that list.
You can turn them off at any time in the app (Settings → Activity notifications), mute a single list from its menu, turn "New items" off for a list you follow, or turn them off for the app in iOS Settings. Signing out removes this device's notification token from our servers. A "just me" reminder is an alert scheduled on your own phone; cancel it from the item or the list's Reminders screen. Reminders for everyone are sent by our server, which checks for due reminders every 10 minutes, so they arrive around the set time.

List owners can turn a public link off, turn off all invite links ("Reset Invite Links"), change members' roles, remove members, delete any comment, stop sharing or delete the list at any time. Anyone can leave a list and remove their own Seen marks, reactions, comments and votes.
Before you share a list, remember that its notes become visible to the people you invite.

Do Not Track and Global Privacy Control

OurStash does not track you across other sites or apps and does not sell or share your information for advertising. Our marketing website honours both signals: if your browser sends Global Privacy Control or Do Not Track, it does not load Google Analytics at all (see "Website analytics"). The pages our server shows for this policy, the Terms, Support and invitations contain no trackers and no third-party scripts; public list pages run no scripts.

How long we keep information

Your account, lists, posts, notes, typed titles and addresses, Seen marks, reactions, comments, votes, trip plans and the covers of lists you own: until you delete them or delete your account. A Seen mark, reaction or vote you remove is erased at once. A comment you delete, or that the list's owner or we delete, disappears for everyone at once and is erased from our database 30 days later.
Gift details and claims: gift details (who it is for, price, status) stay with the item until the item is deleted or moved to another list, or you edit them. A claim is erased when the person releases it, the item is deleted or moved, gifts are switched off for the list, the person leaves or is removed, either side blocks the other, the list is deleted or the claimant deletes their account.
Your profile photo: until you remove it (Settings → Profile Photo → Remove Photo) or delete your account. The apps of people you share lists with keep a copy on their phone for display, which is deleted when they sign out.
List covers: until someone in the list replaces or removes the cover, the list is deleted, or its owner deletes their account. A replaced cover photo is overwritten. Members' and followers' apps keep a copy for display; a public page's cover can stay in web caches for about a minute after it changes.
Reminders: a reminder that has fired or been cancelled stays in the list's Reminders screen ("Earlier") for 30 days and is then deleted; it is deleted sooner if the item or the list is deleted or the person who set it deletes their account.
Lists you follow: until you unfollow, the owner removes you, the public link is turned off, either of you blocks the other, or either account is deleted.
Deleted posts and lists: the note, typed title and typed address are erased at once. A small record of the deleted item (its link, fetched details and the place details read from the link, without anything you wrote) is kept for up to 90 days so your other devices and other members' devices can learn about the deletion, then erased. The Seen marks, reactions, comments, votes, trip details and reminders on a deleted post are shown to no one from that moment and are erased together with that record; its reminders are cancelled.
Your OurStash Plus subscription record: while your account exists, including after the subscription ends; it is deleted with your account. Apple keeps its own purchase records under its policy.
Sessions: until you sign out, delete your account, or 90 days without use, and in any case one year after you signed in on that device.
Guest accounts: until you create an account (it is then an ordinary account, kept as described here). If you delete the app without creating an account, nobody can open the guest account again, so we delete it, with its lists and saves, automatically: normally within 30 days of its last session ending, and in any case at most about 13 months after it was last used.
Email codes: until used, or 10 minutes.
Activity: 30 days.
Invite links: they expire after 14 days or 25 uses and are deleted within 30 days after expiring; links the owner turns off are deleted within about an hour.
Email invitations: the shortened address is erased when the invitation is accepted or revoked. A revoked invitation is deleted, with its hashed address, about a day after it was sent (or within about an hour, if it was revoked later than that). Any other invitation, used or not, is deleted within about an hour after it expires, 14 days after it was sent. An invitation our email provider refuses is deleted at once. If the owner deletes their account, their invitations are deleted with it.
Record of invitation emails sent (the hashed address, the sender, the list and the time, never the address): 24 hours after each email, even if the sender deletes their account or the list, so that deleting either cannot reset our limits.
Do-not-invite list: if you ask us not to send you invitations, we keep a hashed form of your address on it until you ask us to remove it.
Addresses remembered on the inviter's iPhone: until the app sees that the invitation is no longer pending, or the inviter signs out or deletes their account (see "Information kept on your iPhone").
Membership records of people who left or were removed: 90 days.
Notification tokens: until you sign out, delete your account, or 60 days without use.
Shared link cache: refreshed after 7 days, deleted after 30 days.
Sync records (which items changed, so devices can catch up): kept while the item exists, trimmed to the latest change as devices catch up, and the records addressed to one particular member (for example the catch-up records a new member receives) are deleted after 90 days.
Abuse counters: by IP address, at most one hour; by email address (code requests and wrong codes), up to 24 hours after the last attempt, or until a lock for too many wrong codes ends; comment, cover and reminder limits, for the hour or day they cover.
Server logs: not stored (see above).
Website analytics: Google keeps visit records for 2 months; the "_ga" cookies expire after at most 90 days (see "Website analytics").
Anonymous usage totals: up to 400 days. Counts not yet sent stay on your phone for at most 3 days and are deleted when you switch usage counts off.
Apple sign-in token after account deletion: if Apple does not confirm the revocation straight away, we keep retrying for up to 7 days, then delete it.
Support emails: as long as needed to resolve your request and keep a record of it, normally no more than two years.
Reports: up to 1 year after they are sent, then deleted, whether or not we acted on them.
Blocks: until you unblock the person, or until either of you deletes your account.
Takedown records: when we take down a public page, we keep the list's identifier and the date so the page cannot be turned back on, for as long as the list exists.
Backups: our hosting provider keeps restore points of our database for 7 days so we can recover from mistakes or failures. Deleted information can remain in those restore points for up to 7 days before it is gone for good.

Deleting your account

You can delete your account at any time in the app: Settings → Delete Account. If you cannot use the app, email support@ourstash.app from the address on your account and we will delete it for you, after confirming the request is yours.

Deleting your account does not cancel an OurStash Plus subscription. Subscriptions are managed by Apple: cancel in iOS Settings → your name → Subscriptions (or in the app, Settings → OurStash Plus → Manage Subscription) before or after deleting, or Apple will keep charging you. The Delete Account screen tells subscribers to cancel first.

When you delete your account:

Your account, profile photo, sign-in methods, sessions, notification tokens, subscription record and any pending sign-in codes are deleted, and we ask Apple to revoke OurStash's access to your Apple ID if you used Sign in with Apple.
Lists you own are deleted, with every post, note, comment, reminder, cover, public page and membership in them. People you shared them with, and people following them, lose access on their next sync.
Posts you added to other people's lists are removed from those lists, and notes you wrote on other people's posts are erased, wherever those posts are now. Your Seen marks, reactions, comments, votes and reminders in other people's lists are deleted at once too (including comments you had already deleted), and their members' devices drop them on their next sync.
You are removed from lists you joined and from lists you follow.
Email invitations you sent are deleted, with their hashed and shortened addresses. The record of invitation emails you sent (hashed addresses, never the addresses) is kept for 24 hours after each email, as described above, and then deleted.
Reports you sent and every block you are part of (people you blocked and people who blocked you) are deleted. A report someone else made about you is kept until it is a year old; it holds identifiers, the reason and the reporter's note, never your content.
The 90-day deletion records and 7-day backups described above still apply, and the shared link cache, which holds no account information, is unaffected.

What other people keep: a copy someone saved into their own list with "Save to…" belongs to them, so it stays (a copy holds the link and typed title, not your note). Notifications already shown on their devices are not recalled. Emails we sent you remain in your inbox and, for a time, in our email provider's records. Apple keeps its records of your purchases.

Guest accounts: if you delete the app without creating an account, we delete the guest account and its data automatically, as described in "How long we keep information". If you create an account (with Apple, Google or an email code), the same data stays in your account.

Signing out does not delete your account. It ends the session on this device, removes this device's notification token, and erases your lists from this device; they stay in your account until you delete them.

Your rights and choices

Everyone who uses OurStash can:

See and correct their information: your name, lists, posts, notes, comments and plans are all in the app, where you can change or delete them.
Get a copy of the information we hold about you, in a machine-readable form.
Delete their account and information (Settings → Delete Account, or by email).
Ask questions or object to how we use their information.

A short, plain-words summary of these choices (what we collect, deleting your account, switching things off, reporting content) is on our Privacy Choices page.

To exercise any of these, email support@ourstash.app from the address on your account. If you write from another address, or someone acts for you, we will ask for enough information to confirm the request comes from you or from a person you have authorised (for example, a code we send to your account's address). We answer within one month, or within 45 days if you are a California resident; if a request is complex we may take longer, up to the maximum the law allows, and we will tell you why. We never charge for these requests unless the law allows it for requests that are clearly excessive. We do not treat anyone differently for using their rights.

If you are in the European Economic Area, the UK or Switzerland

You have the right to access, correct, delete and receive a copy of your personal information, to restrict or object to how we use it (including any use based on our legitimate interests), to withdraw consent at any time where we rely on it (for example notifications), and to lodge a complaint with your data protection authority. Our legal bases for each use are set out above. If you believe we have not handled your information lawfully, we would like the chance to put it right first, but you can complain at any time to the authority in the country where you live or work, to the UK Information Commissioner's Office, or to the Swiss Federal Data Protection and Information Commissioner.

If you are a California resident

California law gives you the right to know what personal information we collect, use and disclose; to receive a copy of it; to correct it; to delete it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for using these rights. In the past 12 months we have collected the categories described in "Information we collect": identifiers (your account identifier, email address, device session and notification token, Apple's identifiers for your Plus purchase, and the email addresses of people you invite, which we store only in hashed and shortened form), personal information such as your name, commercial information (your OurStash Plus subscription record: the product, period and status, never payment details), internet or network activity (the links you save and the pages you open in the app, and the pages you visit on our marketing website, through Google Analytics), and the content you create (lists, notes, typed titles and addresses, Seen marks, reactions, comments, votes, trip plans, reminder notes and list covers). We collect them from you, from your device, from your sign-in provider and, for Plus, from Apple, for the purposes described above, and we disclose them only to the service providers and platforms described above. We do not collect precise geolocation, and we do not ask for sensitive personal information; anything you choose to write in a note, comment or trip's Details is up to you. We do not sell your personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We have no advertising, no advertising partners and no advertising ID. Our Privacy Choices page summarises these choices. You may make a request yourself or through an authorised agent; we will ask the agent for proof of authority and may confirm the request with you directly. We acknowledge requests within 10 business days and answer within 45 days (extendable once by 45 days). We do not disclose personal information to third parties for their own direct marketing, so California's "Shine the Light" law gives you nothing further to request.

Everywhere

We extend these rights to everyone who uses OurStash, whether or not your local law requires it. You can also complain to the consumer protection office where you live. In Massachusetts, where we are based, that is the Massachusetts Attorney General's Office (https://www.mass.gov/ago). In the US, the Federal Trade Commission also accepts complaints at https://reportfraud.ftc.gov.

If you received an invitation

Someone who uses OurStash entered your email address to invite you to a list. We sent one email on their behalf through our email provider, Resend, and we store only a hashed and a shortened form of your address, for the times listed under "How long we keep information". We did not tell them whether you have an OurStash account. You don't need to do anything: the invitation works once, expires after 14 days, and is never sent again automatically.

To stop invitations, use your mail app's Unsubscribe button, or email support@ourstash.app from that address. We add a hashed form of your address to our do-not-invite list, usually within 2 business days and always within 10. Anyone who tries to invite you after that is told only that the email was not sent, the same message they see when an address can't receive email, so they are not told that you asked us to stop.
To have us delete what we hold, email us from that address and we will delete every invitation for it, with its hashed and shortened forms, and the record of invitation emails sent to it. Resend keeps its own delivery records under its retention settings. We act only on a request sent from the address itself, and we do not tell you who invited you or to which list.
If you have an OurStash account and block the person who invited you, they cannot add you to their lists, but blocking does not yet stop their invitation emails; to stop those, ask us as above.
To report an invitation as abuse, reply to it or write to support@ourstash.app. The rights under "Your rights and choices" apply to this information too.

If you opened a public list page

Anyone can open a public list page without an account. The page shows what the list's owner chose to make public (see "Public links"). It runs no script, sets no cookie and loads no ads or third-party content. To report a page, use the "Report this page" link at its bottom.

Children

OurStash is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you are under 13, please do not use OurStash or send us any information. If you live in the European Economic Area or the UK, you must be at least 16, or the lower age (never under 13) at which your country lets you agree to online services on your own. If you believe a child has given us personal information, email support@ourstash.app and we will delete it and close the account.

Security

We take reasonable technical and organisational measures to protect your information, appropriate to a small service holding the kinds of information described here. All connections to OurStash are encrypted (HTTPS). Session tokens, email codes and invite codes are stored only in scrambled (hashed) form, the addresses of people invited by email only as a keyed hash and a shortened form, Apple sign-in tokens are encrypted, and we never handle passwords or payment details. Purchase records are accepted only when their signature chains to Apple's root certificate. Every request checks that you are allowed to see or change the list it concerns, our servers refuse to fetch addresses that could reach private networks, our legal, invitation and public list pages run no scripts, our logs exclude personal content and are not stored, access to our systems is limited to the developer, and secrets are kept in our hosting provider's secret store, not in code.

No service can promise perfect security. If we learn of a breach that affects your information, we will tell you and the relevant authorities as the law requires. If you think your account has been misused, or you have found a security problem, email support@ourstash.app right away.

International transfers

We are based in the United States, and our servers and service providers process information there and, in Cloudflare's case, at network locations around the world. If you use OurStash from outside the United States, your information is sent to the United States, where privacy law may differ from your country's. Where European law applies to a transfer to our service providers, we rely on the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) in our agreements with them, and on a provider's certification under the EU-US Data Privacy Framework where it holds one. When you choose to open content from YouTube, TikTok, Instagram or Facebook, to sign in with Apple or Google, to buy OurStash Plus from Apple,, your device sends information to those companies directly under their own policies and transfer arrangements.

Changes to this policy

We may update this policy as OurStash changes. We will change the effective date at the top. If a change is significant, we will tell you in the app or by email at least 14 days before it takes effect, unless the change is needed sooner for legal or security reasons, in which case we will tell you as soon as we can. Earlier versions are listed at the bottom of this page, and are also available on request.

Contact us

Questions, requests or complaints about privacy: support@ourstash.app.

Earlier versions: 2026-11-08 · 2026-11-02