01Who we are
Stashed is operated from the United States. We are the controller of the personal data described here. You can reach us at support@stashed.sh.
02What we collect
Waitlist
If you join the early-access waitlist we store your email address, which of three descriptions you picked (collector, investor or seller), and which form on the page you used. We also store where you came from, if your browser told us: the website that linked you to us (its address only, such as google.com, never the full page) and any campaign tags in the link you followed. Your IP address is used only in memory to rate-limit the form and is not stored by us. The list is held by our email provider (see “Who we share data with”). Your browser also remembers locally that you joined, so the form does not ask again; this is stored in your browser only and never sent to us.
Account
- Email and password. Passwords are stored only as a salted scrypt hash; we cannot read them.
- Social sign-in. If you sign in with Apple, Google or Discord we store the stable account identifier the provider gives us and, where the provider vouches for it, your verified email. We do not receive your provider password and request no other profile data.
- Username. The username you choose.
- Email verification and invitations. When we ask you to confirm your email address we store a one-time link token until it is used or expires, and the time you confirmed. If we invite you to the Service, we store the address we sent the invitation to and whether it was accepted.
- Sessions. A random session token, its creation and expiry time. On the web it lives in a cookie; the mobile app holds it on the device.
- Preferences. Your locale, time zone and display currency, if you choose them in Settings; otherwise we use what your browser reports, held in a cookie.
Your collection
Everything you enter to track your collection: portfolios, the cards and sealed products you hold, condition and grade, quantity, purchase date and price, sales you record, custom items you create, your binders, and your wishlist with any price targets you set. We also keep an audit log of changes to your collection (what changed and when) so that history and activity views work and so we can recover from mistakes.
Notifications
Your notification settings, and the alerts we have sent you (such as a wishlist card reaching your price target), which also appear in the app. Alert emails go only to an address you have confirmed. If you allow notifications in the mobile app, we store the push token your device gives us so that we can deliver them; it is removed when you sign out, and stops being used if the device stops accepting it. You can turn email and push alerts off in Settings, or turn notifications off on your device.
Usage we record
When you open a card’s page while signed in we log that view: your account, the card, the time, and your browser’s user-agent string. We deliberately do not record your IP address with it. We use this to understand which cards draw attention and to detect automated abuse of the Service.
On stashed.sh we count page views with our hosting provider’s analytics, which sets no cookies and stores no identifier for you. It records the page, the site that referred you, and your country, browser, operating system and device type, and we see these only as totals.
Technical data
Like any web service, our hosting provider processes your IP address and request metadata to deliver pages and defend against attacks, and keeps short-term request logs. We may also collect error reports when something breaks, which can include the page you were on and your account identifier but never your password.
What we do not collect
- No advertising identifiers, ad networks or tracking pixels.
- No analytics cookies, and no cross-site tracking.
- No payment details today — the Service is free during early access.
- No contacts, location, camera or photo access in the mobile app today. If we add a feature that needs one, we will ask your device for permission first and update this policy.
03Why we use it
| PURPOSE | DATA | LEGAL BASIS |
|---|---|---|
| Provide the Service | Account, sessions, your collection, wishlist, preferences | Performance of our contract with you |
| Value your collection | The cards you hold, matched against our market data | Performance of our contract with you |
| Send the alerts you ask for | Wishlist price targets, notification settings, confirmed email, push token | Performance of our contract with you |
| Security and abuse prevention | Session records, view log, request logs | Legitimate interest in keeping the Service working and fair |
| Understand and improve the product | View log, page-view totals, where waitlist signups came from | Legitimate interest; never used to profile individuals |
| Waitlist and launch emails | Waitlist email and answer | Your consent, withdrawable at any time |
| Service announcements | Account email | Legitimate interest in telling you about changes to the Service |
Market data itself — prices, sale histories and product information for cards — is about products, not people, and is not personal data.
04Cookies and local storage
We use only cookies the Service needs to function. There are no advertising or analytics cookies, so we show no cookie banner.
| NAME | PURPOSE | LIFETIME |
|---|---|---|
| stashed:session | Keeps you signed in | Until you sign out; up to 10 days if you chose “remember me”, otherwise the browser session |
| stashed:oauth | Protects a social sign-in in progress against forgery | Minutes; deleted when sign-in completes |
| stashed:portfolio | Which portfolio you are viewing | Persistent |
| stashed_display | The locale and time zone your browser reports | Persistent |
| stashed_collection_view · stashed_collection_density · stashed_sidebar · stashed_chart_overlays | Layout and chart display preferences | Persistent |
| stashed_verify_banner | Remembers that you dismissed the email-confirmation reminder | The browser session |
| stashed:waitlist (local storage, stashed.sh only) | Remembers that this browser joined the waitlist | Until you clear site data |
| stashed:attribution (session storage, stashed.sh only) | Where this visit came from, sent with a waitlist signup | Until you close the tab |
05Who we share data with
We share personal data only with providers that process it on our behalf, under contract, to run the Service:
- Hosting and content delivery — serves the website and application, processes requests, and counts page views (United States).
- Database hosting — stores your account and collection (United States).
- Email delivery — holds the waitlist and sends our email, including verification emails and alerts.
- Push notification delivery — relays alerts to the mobile app through Apple’s and Google’s push services.
- Error monitoring — receives error reports when something breaks.
- Apple, Google, Discord — only if you choose to sign in with them; each sees that you signed in to Stashed, under its own privacy policy.
Card images are served from image storage and content networks outside our servers. Like any site an image is loaded from, they see the IP address of the device that loads it.
We do not sell personal data, share it for advertising, or give it to data brokers. We may disclose data if the law requires it, to protect the rights or safety of users or the public, or to a successor if Stashed is acquired — in which case this policy continues to apply and you will be told.
06Where data is stored
Our servers and database are in the United States. If you use the Service from elsewhere, your data is transferred to and processed in the United States. Where required, we rely on our providers’ standard contractual clauses or equivalent safeguards for those transfers.
07How long we keep it
- Account and collection data — for as long as your account exists. When you ask us to delete your account, your portfolios, items, lots, sales, wishlist, binders, notifications, push tokens, audit log, sessions, view log and sign-in links are deleted with it.
- Sessions — expire after 10 days of inactivity or when you sign out.
- Push tokens — removed when you sign out of the app.
- Waitlist — until you unsubscribe or ask to be removed, or until we close the waitlist after launch.
- Request logs and error reports — held by our providers for a short rolling period (typically 30 days or less).
- Backups — our database provider keeps point-in-time backups for a limited window; deleted data ages out of them.
08Your rights and choices
Wherever you live, you can ask us to access, correct, export or delete your personal data, or to stop a particular use of it. Email support@stashed.sh from the address on your account and we will respond within 30 days. You can edit your collection, preferences and notification settings yourself in the app, and unsubscribe from waitlist emails with the link in any message.
If you are in the European Economic Area, the United Kingdom or Switzerland, these are your rights under the GDPR and equivalent laws, including the right to object to processing based on legitimate interest and to complain to your local data-protection authority. If you are a California resident, the CCPA gives you the rights above and the right not to be discriminated against for exercising them; we do not sell or share personal information as the CCPA defines those terms.
We honour a browser’s Global Privacy Control signal; since we neither sell data nor run cross-site tracking, there is nothing further it needs to switch off.
09Security
Traffic to the Service is encrypted in transit. Passwords are hashed with scrypt. Access to production data is limited to the operator of the Service and to our database roles, each of which can reach only the tables its job needs. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.
10Children
The Service is for people aged 16 and over. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe someone under 16 has created an account or joined the waitlist, contact support@stashed.sh and we will delete their data.
11Changes to this policy
We will update this page when our practices change and revise the effective date at the top. For material changes we will tell you by email or in the app before they take effect. The Terms of Service govern your use of the Service.
Contact
Privacy questions or requests: support@stashed.sh.