Privacy Policy

Last updated: February 27, 2026

Effective date: February 27, 2026

Introduction

StashPile ("we", "us", "our") is operated from the European Union. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the StashPile browser extension and associated services (collectively, the "Service").

We are committed to protecting your privacy and handling your data transparently. This policy applies to all users of the StashPile Chrome extension and the stashpile.dev website.

By using our Service, you agree to the collection and use of information as described in this policy. If you do not agree with this policy, please do not use our Service.

Data Controller

Email: general@stashpile.dev

What Data We Collect

Data You Provide Directly

• Email address — collected when you create an account or sign in using our email-based one-time password (OTP) authentication.
• Bookmarks — the page title, URL, and favicon of tabs you explicitly choose to save. We only access the currently active tab when you perform a save action; we never access your browsing history, existing browser bookmarks, or other tabs.
• Folders and collections — the names and organizational structure you create to manage your bookmarks.

Data Collected Automatically

• Session data — when you sign in, we store your IP address and browser user agent string alongside your session token. This is used for session security and fraud prevention.
• Anonymous analytics events — we collect aggregated, non-personally-identifiable usage data such as extension installation, updates, uninstalls, page views (popup or new tab), and feature usage counts (e.g., bookmark created, folder created, data imported/exported). When you uninstall the extension, Chrome may open a goodbye page on stashpile.dev that records an anonymous uninstall event (anonymous identifier and extension version only). All personally identifiable information (email, URLs, titles, page content) is stripped from analytics events before they are sent.
• Error reports — when the extension or API encounters an error, anonymized diagnostic data (error messages, stack traces, and context) may be sent to our error monitoring service. We configure our error reports to exclude personally identifiable information where possible.

Data We Do NOT Collect

• Browsing history
• Browser bookmarks (from Chrome's built-in bookmark manager)
• Passwords or financial information (payments are handled entirely by our payment processor)
• Location data, microphone, or camera access
• Data from other tabs or windows (we only read the active tab when you explicitly save a bookmark)
• Keystrokes or form input on web pages
• Content of web pages you visit

How We Use Your Data

We use the collected data for the following purposes:

We do not use your data for advertising, profiling, or selling to third parties.

Data Storage and Security

Where Your Data Is Stored

• Server-side: Your account data and synced bookmarks are stored in a PostgreSQL database hosted in the European Union. Session cache and sync metadata are stored in Redis, also hosted in the EU.
• Client-side: The extension stores your bookmarks, folders, and collections locally on your device using IndexedDB (via Replicache). Minimal preferences and anonymous identifiers are stored in chrome.storage.local and localStorage. This local data never leaves your device unless you are a signed-in, paid subscriber with sync enabled.

Security Measures

• All data transmitted between the extension and our servers is encrypted via HTTPS/TLS.
• Authentication sessions use HTTP-only, secure cookies with SameSite=None to prevent cross-site request forgery.
• Server endpoints are protected by rate limiting (120 requests per minute per IP).
• Security headers are enforced on all API responses (X-Content-Type-Options, X-Frame-Options, Content-Security-Policy, Referrer-Policy, Permissions-Policy).
• CORS is restricted to specific, authorized Chrome extension identifiers.
• We follow the principle of least privilege — the extension only requests the minimum permissions necessary (activeTab, storage, unlimitedStorage).

Data Retention

• Account data: Retained for as long as your account is active. You may request deletion at any time (see "Your Rights" below).
• Session data: Sessions expire automatically after 14 days of inactivity.
• Sync metadata: Cached sync records (Client Version Records) expire after 48 hours.
• Local data: Stored on your device indefinitely until you uninstall the extension, clear browser data, or delete it within the app.
• Analytics data: Retained by our analytics provider (PostHog) according to their retention policies. No personally identifiable information is included.
• Error reports: Retained by our error monitoring provider (Sentry) according to their retention policies.

Cookies

The stashpile.dev website may set session cookies when you sign in or interact with the site. These cookies are used to maintain your session and are strictly necessary for the operation of the service. They are not used for advertising or tracking. You can control or delete cookies through your browser settings.

Third-Party Services

We use the following third-party services to operate StashPile. All of these services process data within the European Union or European Economic Area. Each service receives only the minimum data necessary for its function, and we use only processors that are contractually required to protect your personal data (including data processing agreements where required by law).

Polar (Payment Processing)

• Purpose: Processing subscription payments.
• Data shared: Your user ID and email address (to create checkout sessions and manage subscriptions).
• Privacy policy: https://polar.sh/legal/privacy

We do not store or have access to your payment card details. All payment information is handled exclusively by Polar.

Plunk (Email Delivery)

• Purpose: Sending authentication emails containing one-time passwords (OTP).
• Data shared: Your email address and the OTP code.
• Privacy policy: https://www.useplunk.com/legal/privacy

PostHog (Product Analytics)

• Purpose: Understanding aggregate usage patterns to improve the product.
• Data shared: Anonymous event data only. All personally identifiable fields (email, URLs, titles, favicons, page content) are stripped before transmission.
• Privacy policy: https://posthog.com/privacy

Sentry (Error Monitoring)

• Purpose: Detecting, diagnosing, and resolving software errors.
• Data shared: Error logs, stack traces, and diagnostic context. We minimize the inclusion of personal data in error reports.
• Privacy policy: https://sentry.io/privacy/

Anonymous and Free Usage

You can use StashPile without creating an account. In this mode:

• All data is stored exclusively on your device (in IndexedDB).
• No personal data is sent to our servers.
• No email address is collected.
• Anonymous analytics events may still be collected (with no personally identifiable information).
• Your data will not sync across devices.

If you later create an account, you may choose to migrate your locally stored data to your account for syncing.

Data Export and Portability

You can export all of your bookmarks, folders, and collections at any time as a JSON file directly from the extension. This allows you to maintain a personal backup or transfer your data to another service.

Your Rights Under GDPR

As a data subject under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access — You may request a copy of the personal data we hold about you.
• Right to rectification — You may request that we correct inaccurate personal data.
• Right to erasure ("right to be forgotten") — You may request that we delete your personal data. Upon request, we will delete your account and all associated data (bookmarks, folders, collections, sessions).
• Right to data portability — You can export your data at any time using the built-in export feature in the extension.
• Right to restrict processing — You may request that we restrict processing of your personal data under certain circumstances.
• Right to object — You may object to the processing of your personal data based on our legitimate interests (e.g., analytics).
• Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at general@stashpile.dev. We will respond to your request within 30 days.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority.

Privacy Rights for California and Other US Residents

If you are a resident of California or another US state with similar privacy laws:

• We do not sell your personal information. We have not sold personal information in the past 12 months.
• You may have the right to know what personal information we collect, use, and disclose; to request deletion of your personal information; and to non-discrimination for exercising your privacy rights.
• To exercise these rights, contact us at general@stashpile.dev. We will respond within the time period required by applicable law.

Account Deletion

You may request full deletion of your account and all associated data by emailing general@stashpile.dev. Upon receiving your request, we will:

1. Delete your user account and authentication data.
2. Delete all your bookmarks, folders, and collections from our servers.
3. Invalidate all active sessions.
4. Confirm deletion via email.

Note that locally stored data on your device is not affected by server-side deletion. You can clear local data by uninstalling the extension or clearing your browser's storage.

Children's Privacy

StashPile is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that data promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at general@stashpile.dev.

Browser Permissions

The StashPile extension requests the following browser permissions:

The extension does not request permissions for browsing history, all URLs, downloads, cookies, or any other sensitive browser data.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify users through the extension or via email for significant changes.

We encourage you to review this policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: general@stashpile.dev Website: https://stashpile.dev