Interim information
Privacy notice
Updated
This interim notice describes information handled when you use xStash and contact support.
It will be expanded with confirmed operator details, a fuller provider list and record-specific retention information. For questions about responsibility for your information or details relevant to your account, contact privacy@xstash.io.
Information and purposes
- Accounts and authentication
- Account and registration information can include your name, email, username, phone number, country and date of birth, together with verification, sign-in, passkey, session and consent records. This supports account creation, access, recovery, account settings and security.
- Files and related metadata
- The app handles the content you add, such as photos and files, and information used to organise it, such as item identifiers, filenames, timestamps and indexes. Local storage and enabled cloud sync handle content and metadata according to your storage choice. Service records can include storage usage, sync activity and file activity needed to operate and troubleshoot those features.
- Devices and notifications
- Device and installation identifiers, push registration tokens, notification choices and delivery records are used to register devices, send notices and diagnose failures. Delivery records can include provider acceptance and the app’s reports that a notice was received or opened. These reports do not establish that an alert appeared or that you read it.
- Support
- Conversation subjects, messages, files you attach and reply records are handled to help with your request. Support messages and attachments are readable by the support team. Share only what is needed; do not send passwords, recovery keys, verification codes or raw push tokens.
- Service, billing and security records
- Account status, plan and purchase information, entitlements, transaction references, operational logs, security events and deletion or export requests support billing, service operation, abuse prevention and account administration.
- Enabled diagnostics
- When you enable diagnostic sharing or submit a problem report, diagnostic information can include crash or performance reports, your description, app logs and device status. Check the app’s diagnostic settings and review material before sending it.
Your storage and permissions
The app offers “On this device” and “Sync to cloud” storage choices where available. Review the current setting, sync status and any warning about pending uploads before changing storage or erasing a device. A local storage choice does not remove the need for account, billing, security or support processing when you use those services.
Use app and operating-system settings to manage permissions. Denying a permission can limit the related feature. The iPhone app’s Privacy review works from text already indexed on the device to identify potentially sensitive photos; it is a feature of the app, not a guarantee that every sensitive item is found.
Notifications and your choices
Offers and discounts, and news and product updates, have separate email, push and in-app choices in notification settings. Essential security, billing and account notices are handled separately from those optional categories. Your operating system controls whether banners, sounds and lock-screen previews can appear. The app also has a push or alerts choice for the current device.
Apple Push Notification service (APNs) and, when configured, Google Firebase Cloud Messaging (FCM) handle identifiers and notification data needed for remote delivery. Network conditions, device settings and provider availability can delay or prevent alerts. Open the app to check your inbox and account information.
Providers and international processing
Hosting, storage, communication, diagnostic and payment providers can process information needed for the features you use. App-store providers handle purchases made through their stores. Support staff handle information you send in a conversation. These public pages may be served through Cloudflare, which handles web requests needed to deliver the pages.
Processing locations can depend on the service and provider and may be outside your country. This interim notice does not establish that all information stays in one country or that every provider uses the same safeguards. Ask the privacy contact for information relevant to your account; a complete provider and transfer schedule is still being confirmed.
Security and access
xStash includes encryption and account-security features. Their scope differs between vault content, metadata, support, billing and operational records. This notice makes no blanket promise that every category is end-to-end encrypted or inaccessible to the service. Keep your password and Secret Key safe, and review authorised devices in the app.
Retention, export and deletion
Retention depends on the type of record, the features used and deletion processing. Record-specific periods and backup handling are still being confirmed; this notice does not promise a universal retention period or immediate erasure of every copy.
Use “Export my data” where available to request an export. To request account deletion, open your account or Profile screen and choose “Delete account”. The app asks for confirmation and schedules deletion, with an export and a displayed date. A cancellation option is available while deletion can still be stopped; it may be unavailable once erasure has begun. Check the app’s current status and contact support if a request fails.
Removing the app or signing out does not submit an account-deletion request. Account deletion also does not remove copies you previously downloaded or shared. Some records may need further handling for legal obligations or unresolved billing or security matters; ask the privacy contact about the scope of your request.
Questions and data requests
For access, correction, deletion or other privacy requests, email privacy@xstash.io or use Help & Support in the app. Say what you need without including secrets. Identity verification may be needed before account information can be disclosed or changed. Available rights and applicable requirements depend on your circumstances and law.
For practical steps, read Help & support. Updates to this interim notice will be dated on this page.