Privacy Policy

When you create an account, we collect your email address, name, and any profile information you provide. Account registration and authentication is handled by Clerk (clerk.com). Clerk processes your credentials securely on our behalf. Please review Clerk's Privacy Policy for more details on how they handle authentication data.

StashSync.app stores the notes, bookmarks, files, and Collections you create or upload ("Content"). Your Content is stored locally on your device using browser IndexedDB and synced to Cloudflare's global edge network when you are online. By default your Content is private and only accessible to your own authenticated account. We do not read, analyze, or sell your Content.

You may explicitly choose to publish specific items (notes, bookmarks, files, or Collections) using a public share link, or list them on your Public Profile. See Section 6 for how public sharing and Public Profile data are handled.

We use the following analytics services to understand how the Service is used and to improve it:

• Google Analytics — collects anonymized data about page views, session duration, device type, browser, and general geographic location. Google Analytics uses cookies and similar tracking technologies. You can opt out via the Google Analytics opt-out browser add-on.
• Cloudflare Analytics — collects aggregate, privacy-preserving metrics about traffic (page views, request counts) without cookies or cross-site tracking. See Cloudflare's Privacy Policy.

We use Sentry to capture application errors and performance issues. Sentry may collect your IP address, browser type, operating system, and the actions you were taking when an error occurred. This data is used solely to diagnose and fix bugs. See Sentry's Privacy Policy.

If you subscribe to StashSync.app Pro, payments are processed by Lemon Squeezy. We do not store your payment card details. Lemon Squeezy handles all billing data in accordance with PCI-DSS standards. See Lemon Squeezy's Privacy Policy.

Our infrastructure (hosted on Cloudflare Workers) may automatically record standard server log data such as your IP address, request timestamps, and HTTP response codes. This data is used for security and operational purposes and is not linked to your account.

You can generate a public share link for any individual note, bookmark, file, or Collection. While a share link is active, the linked content is publicly accessible to anyone who has the link. You can set an expiration (24 hours, 7 days, 30 days, or never) and revoke a link at any time, which immediately invalidates public access.

For shared Collections, you can additionally toggle each member item (note, bookmark, or file) on or off without un-sharing the whole Collection.

Aggregate metrics such as view and download counts may be recorded for each share link and displayed back to you, the owner. These metrics do not identify the viewer.

StashSync.app offers an optional Public Profile feature. The Public Profile is off by default and only becomes visible on the public web when you explicitly enable it from your account settings.

When enabled, the following information may be displayed publicly at username.stashsync.app (or a /profile/[username] fallback URL):

• Your chosen username
• Display name, bio, and avatar (if provided)
• Social links you add (e.g., X, GitHub, LinkedIn, website)
• The notes, bookmarks, files, and Collections you have individually marked as "listed" on your profile
• Theme choice (light or dark) and pinned items

You retain full control over what appears on your Public Profile. Each piece of Content has an independent "Show on profile" toggle, and you may disable your Public Profile at any time, which immediately removes it from the public web.

By default, profile pages and shared content are configured to be not indexed by search engines (via noindexmetadata and the X-Robots-Tagheader where applicable). You may opt in to search-engine indexing from your Public Profile settings. Public file shares always send a noindex header regardless of this setting.

You are solely responsible for any Content you publish — whether through a public share link or via your Public Profile. Do not publish information you do not have the right to share. Once content is public, it may be accessed, cached, or referenced by third parties (including search engines, where you have opted in), and we cannot guarantee its removal from such third-party systems after you revoke the share link or unlist the item.

If you encounter a Public Profile or shared item that you believe violates our Terms of Use — for example, content that is infringing, abusive, or impersonates someone — you can let us know via the Report a Public Profile page. We review every report and respond as quickly as we can.