STASH APP
App privacy policy.
How the Stash app for iPhone, iPad and Android handles your information. This policy applies to the installed app.
This policy covers the installed Stash app. The Stash website and its browser demo are described in the separate Website notice.
App privacy policy updated 2 October 2026.
Controller & scope
The controller responsible for the Stash app is:
Graham Miranda UG (haftungsbeschränkt)Hasselfelder Str. 23
38889 Blankenburg (Harz), Germany
privacy@grahammiranda.network
Managing director: Graham Craig Miranda. Commercial register: Amtsgericht Stendal, HRB 36794.
USt-IdNr. / VAT ID: DE459781189 · § 5 DDG
This policy applies to the Stash app (Android package network.grahammiranda.stash) on iOS, iPadOS and Android. It does not cover the Stash website or browser demo.
Privacy contact: privacy@grahammiranda.network
Data we collect
We collect only the data the app needs. This table matches our Google Play Data safety declaration and our App Store privacy answers.
| Data type | Collected | Shared | Required? | Purpose |
|---|---|---|---|---|
| Email address | Yes | No | Optional (guest mode) | Account & sign-in |
| Photos | Yes | No | Optional | Core feature |
| Voice or sound recordings | Yes | No | Optional | Core feature |
| Other user-generated content (names, notes, rooms) | Yes | No | Optional | Core feature |
| Device or other IDs (push token) | Yes | No | Required | Notifications & sync |
We do not show ads, run advertising or analytics tracking, build user profiles, or sell your data.
Guest mode: if you do not create an account, your rooms, items, photos and voice notes stay on your device and are not uploaded.
Permissions the app asks for, and why
- Camera — to photograph where you put something.
- Photo library — to attach a picture you already took.
- Microphone — to record a voice note.
- Notifications — to send reminders you set.
Voice notes are stored with your items. Turning a voice note into searchable text may use the speech service built into your device (Apple on iOS, Google on many Android devices), which may process the audio under its provider's own terms.
Purposes & legal bases
We process personal data only where the GDPR allows it:
- Providing your account and the app's core features — Article 6(1)(b) GDPR (performance of a contract).
- Keeping the service secure, preventing misuse, and sending notifications where permitted — Article 6(1)(f) GDPR (legitimate interests).
- Anything optional that asks first, such as notifications or platform speech processing — Article 6(1)(a) GDPR (consent). You can withdraw consent at any time.
Processors & transfers
We use Google Firebase to run the app's backend:
Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, and Cloud Messaging), project stach-98617, provided by Google Ireland Limited and Google LLC.
Photos and voice notes are stored in your account's own space in Firebase Cloud Storage, isolated from other users.
Google may process data in the United States and other countries. Transfers rely on the EU-U.S. Data Privacy Framework (Google LLC is certified) and, where needed, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).
We do not sell your personal data or share it for advertising.
Retention & deletion
We keep your account data while your account is active. When you delete your account, we delete the account and its items, photos and voice notes, then remove remaining copies from backups within 30 days.
We may keep limited records longer where the law requires it, for example tax or accounting duties, or to defend legal claims. We then use them only for that purpose.
How to delete your data
- In the app: open Settings and choose Delete account. This removes your rooms, items, photos and voice notes.
- You can also delete individual items, rooms, photos or voice notes in the app without deleting your account.
- On the web: use our account deletion form.
Open the account deletion form ↗
We aim to complete deletion requests within 30 days.
Your rights
Where the GDPR applies, you can ask for access to, correction of, deletion of, or a copy of your data, ask us to restrict processing, or object to processing based on legitimate interests.
Where processing is based on consent, you can withdraw it at any time. This does not affect processing already done.
To exercise your rights, email us. We answer within one month: privacy@grahammiranda.network
You can also complain to a supervisory authority. For us, that is the Saxony-Anhalt data protection authority: Saxony-Anhalt data protection complaint form ↗
International visitors
The app is offered worldwide. The GDPR rights above apply where the GDPR applies. You may have additional rights under your local law, for example in California, Brazil, Canada, the United Kingdom or Australia. Mandatory local rights are not affected.
Children
The app is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe someone under 16 has used the app, contact us and we will delete the data.
Security
Data is encrypted in transit using TLS. We control access, and Firebase security rules keep each user's data isolated so one account cannot read another's. No system is perfectly secure, so please use a strong password and keep your device and apps up to date.
Changes
We may update this policy as the app changes. We will publish the new version here, update the date above, and tell you in the app before a material change takes effect.
Documents
Related pages. The company's published legal pages cover other Graham Miranda services.
App privacy policy updated 2 October 2026.