Stash privacy

Thank you for choosing Stash. This Privacy Policy explains what Stash does with your information. In short: everything stays on your device, encrypted. Nothing is sent anywhere unless you turn on sync, and then only encrypted files go to your own Google Drive.

By using Stash, you consent to the practices described in this policy.

Information we collect

• Stash does not collect any personal data or information from its users. There is no Stash server and no Stash account. The app has no analytics, ads, crash reporting or tracking of any kind. It uses the network only for sync, after you turn sync on, and for the optional breach check, after you turn that on (see below).

• Storage and Use of Data: Everything you add to Stash (passwords, API keys, env files, SSH keys, database URLs, 2FA secrets, notes and tags) is stored only on your device, in an encrypted vault. The encrypted vault can be part of your phone's own backup (Google backup or a transfer to a new Android phone, which Stash allows only when that backup is end-to-end encrypted with your screen lock; iCloud or a computer backup on iOS). It stays encrypted with your passphrase there. Fingerprint and Face ID keys never leave the phone, and a phone restored from a backup turns sync off until you turn it on again. Users have full control over their data and can delete it at any time from within the app, or by uninstalling the app or clearing its storage.

• Backups and Exports: When you turn on backups or export your vault, Stash writes an encrypted file to a location you choose with the system file picker. If you choose a cloud folder, that file is handled by that service under its own policy. The file stays encrypted and can only be opened with your passphrase.

• Import and Export: You can import an export file from another password manager (Google Password Manager, Bitwarden, 1Password, Apple Passwords, KeePassXC) that you pick with the file picker. Stash reads it on the device, adds its items to your vault and offers to delete the file; nothing is uploaded. You can also export your passwords as a plain (not encrypted) Bitwarden JSON or Google CSV file to a place you choose, after re-entering your passphrase. Anyone with that file can read it, so delete it once you have imported it elsewhere. On supported systems you can move passwords directly between Stash and another password manager on the same device (Credential Exchange). The system passes them from one app to the other; no file is written and nothing goes through a server of ours.

• Sync (optional, off by default): If you turn on sync, you sign in with your Google account and Stash asks only for access to its own hidden app folder in your Google Drive (the drive.appdata scope). It cannot see or change any of your other Drive files. Before anything leaves the device, your vault is encrypted with a sync key that is itself locked by your Stash passphrase, so Google, the developer and anyone else without your passphrase see only ciphertext. Drive does see the number of files, their sizes and times, and each device's name (for example "Pixel 8"). The same applies to the Stash browser extension when you sign in to it. Stash keeps your Google sign-in on the device (Google Play services on Android, the iOS Keychain on iOS) and uses it only to talk to Google Drive. Turning sync off stops it; you can also delete every synced file from Drive.

• Breach check (optional, off by default): On your phone, the vault health screen can check your passwords against known data breaches using the Have I Been Pwned "range" service (api.pwnedpasswords.com). Stash hashes each password (SHA-1) on the device and sends only the first 5 characters of that hash. The service answers with hundreds of similar hashes, and Stash compares them on the device, so the service never learns a password, a full hash, or which one matched. Like any website, the service (and Cloudflare, which serves it) sees your IP address. Results stay on the device, inside the encrypted vault, and are deleted when you turn the check off. The browser extension never does this.

• Browser extension (Stash for Chrome): The extension works only with sync: it signs in to the same Google account and reads the same encrypted files from your Drive's hidden app folder, and unlocks them with your Stash passphrase. On every website, a small script notices when you submit a login form and passes that username and password to the extension, so it can offer to save them; if you don't save, they are dropped when you close the tab or the browser. When you open the extension it reads the current tab's address to list the logins saved for that site, and fills a login into the page only when you click it. On pages with a login form, it can also show a small Stash icon in the field that opens a menu of that site's logins; the menu runs inside the extension, so the website can't read it, and it fills only the login you click (or the one picked by the keyboard shortcut). Your vault is cached in the browser encrypted; the key that opens it is kept in memory only and is forgotten when the browser closes or after 15 minutes. The extension sends nothing anywhere except your encrypted files to and from your own Google Drive.

• Camera: The camera is used only while you scan a 2FA QR code. Frames are processed on the device and are never saved or sent anywhere.

• Autofill: If you turn on Stash for AutoFill, the system tells it which app or website you are signing in to (and on Android, the fields you are filling in), so it can suggest a matching login. This happens on the device, and nothing is sent anywhere.

• Biometrics: Fingerprint, Face ID or Touch ID unlock is handled entirely by the operating system. Stash never receives your biometric data; it is only told whether unlocking succeeded.

• Clipboard: Secrets you copy are marked as sensitive, so Android hides them from clipboard previews, and on iOS they stay on this device (no Universal Clipboard). Stash clears them from the clipboard after the time you choose in settings.

• Security: Stash takes user privacy and data security seriously. The vault is encrypted with a key derived from your passphrase (Argon2id), and screenshots of the app are blocked by default. Your passphrase is never stored; without it, the vault cannot be read, and it cannot be recovered. Your data stays on your device and is never shared with third parties. What leaves it is the encrypted sync files, only if you turn on sync, to your own Google Drive, and, only if you turn on the breach check, the 5-character hash prefixes described above.

• Children's Privacy: Stash is intended for general audiences and does not knowingly collect personal information from anyone, including children under the age of 13. Since Stash keeps no data outside the user's device, there are no records for us to hold or delete.

Changes to this policy

We may update our Privacy Policy from time to time.
Any changes will be reflected in the updated policy, and the effective date will be revised accordingly.
It is recommended to review the Privacy Policy periodically for any updates or modifications.

Contact

If you have any questions, concerns, or suggestions regarding our Privacy Policy or Stash, please contact us at labyrinthcode10@gmail.com

By using Stash, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.