Privacy Policy

Version 2026-10-27
Effective date: 2026-10-27

Stash - Privacy Policy

Version: 2026-10-27 Effective date: 2026-10-27 Applies to: the Stash mobile app and the services behind it

This policy describes what the app actually does today, including the parts that are not ideal. Where a protection is planned but not yet built, it says so rather than implying it exists.

1. The short version

Stash is a food journal. You photograph and describe what you eat, and we store it so you can look back at it and find it again.

We collect what you type in, the photos you take, and where you were, because the app maps your meals.
We use it to run the app for you, not to build an advertising profile.
There is no ad tracking in Stash, no advertising networks, no session replay, no screen recording, and no automatic capture of your taps or the text you type.
We remove the hidden metadata from your photos, including GPS coordinates, before storing them.
Photos are stored on public web addresses, which is the one thing in this policy most likely to surprise you. Section 6 explains it.
You can delete your account from the app, and you have 30 days to change your mind.

The rest of this document is the detail.

2. Who is responsible for your data

Bitter Melon Technologies LLC, a California limited liability company, is responsible for the personal information described here. Contact details are in section 15.

During the alpha and beta, Stash is offered in the United States only, and this policy will be updated before Stash is offered anywhere else.

3. What we collect

Information you give us when you sign up

Username. Public inside the app. Other users can search for it.
Email address. Used to verify your account, to reset your password, and to tell you about your account. Not shown to other users.
Password. Stored only as a one-way hash. We never store or log your actual password, and we cannot read it.
Your confirmation that you are 13 or older, and your acceptance of the Terms. We record the time you accepted and the version you accepted.

Your taste profile

You are asked for these during onboarding, and you can change them later. They shape what the app shows you.

Allergies.
Dietary pattern, such as vegetarian, vegan, pescatarian, halal, kosher, or keto, and your own dietary restrictions.
Spice tolerance and how adventurous you would like your suggestions to be.
Favorite cuisines, ingredients you want to avoid, and free-form flavor notes.
Typical spend, preferred currency, and what counts as cheap or expensive to you.

Some of this touches on health, because allergies and dietary needs can be medical. We treat it as information you have chosen to record about your food preferences, and we use it only to personalize what the app shows you. We do not sell it and we do not share it for anyone else's advertising.

What you record in the app

Dishes and drinks. Names, descriptions, ratings, notes, cost, spice level, occasion, whether you would order it again, and similar fields.
Deals. Promotions you post, including the venue, price, schedule, and description.
Spots. Places you log, and new places you submit for review.
Photos. The pictures you take or pick from your photo library.
Trips, and the entries you group into them.

Location

Stash asks for your location while you are using the app, and only if you grant permission. It is used to place your meals on the map, to tag where you ate, and to show nearby places and deals. The map and the Discover experience are where location is used; if you have granted permission, the app may also check your last known location to tell you about nearby deals you have followed.

The coordinates we store are precise, not approximate, because a food journal that put your dinner on the wrong block would not work. When you search for a place by name, the text you search for is sent to our maps provider to turn it into coordinates.

You can refuse the location permission or turn it off in your device settings. The app still works, but map features and location tagging will not.

Purchases

Stash is free today and does not collect any payment information. If Stash offers paid features in the future, purchases would be handled by the Apple App Store, Google Play, and our purchase processor, RevenueCat. We would receive the fact and status of a purchase or subscription, never your card number.

Diagnostics and analytics

Two tools can collect information about how the app runs, and both are deliberately limited.

Crash and error reports (Sentry). When the app crashes or hits an error we collect the technical details of the failure so we can fix it. Before anything leaves your device, a filter removes personal details such as your email address and any access tokens. The crash reporter is not given your account identifier; a report carries only the scrubbed technical detail of the failure.
Product analytics (PostHog). We record a small, fixed set of events, for example that you signed up, logged in, finished onboarding, saved a dish, or opened a screen. The details attached to them are counts, categories, and yes/no flags, never free text or the content of your entries. You are identified only by an internal account identifier, never by your email or username.

Both tools are built into the app but stay inert until we configure them with a key. When a key is not configured, the code does nothing at all, and neither tool ever captures your screen, your taps, or the text you type.

In-app feedback

When you send feedback from inside the app, we store your message and also post a copy to our team chat (Microsoft Teams) so we notice it quickly. That copy carries the category you chose, the first 500 characters of your message, your username, the platform you are on (iOS or Android), and the build of the app you are running.

What your device tells us automatically

When the app talks to our servers, our servers see your IP address and basic request information, as any web service does. We use it to make the app work and to keep it secure against abuse.

4. What we deliberately do not collect or do

This list is exact, and it is meant to be held to.

No advertising, and no ad networks or advertising identifiers. Stash contains none.
No tracking of you across other apps or websites. We do not do it and we do not let anyone else do it through Stash.
No response to a "Do Not Track" signal is needed, because Stash does not track you across other apps or websites in the first place.
No selling your personal information, and no sharing it for anyone else's advertising.
No session replay and no screenshots of your screen. The analytics tool supports these features and they are switched off.
No autocapture. Your taps, gestures, and the text you type are not automatically recorded. Every analytics event is one we wrote deliberately.
No GPS or camera metadata kept inside your stored photos. See section 6.
No reading of your contacts, your calendar, your messages, or your photo library beyond the pictures you choose to add.
No microphone or audio recording.
No selling or sharing of your allergy or dietary information with anyone.

5. Why we use your information

We use it only for these purposes.

To give you the app: storing your entries and photos, showing your journal, your map, and your history.
To personalize what you see: using your taste profile and your past entries to decide what to show you.
To run your account: verifying your email, resetting your password, and telling you about important account events such as a scheduled deletion.
To let you share: showing what you have chosen to share to the people you shared it with, and showing deals you post to other users.
To keep Stash safe: handling reports and blocks, scanning stranger-facing images, reviewing submitted places, removing content that breaks the rules, and preventing abuse.
To fix and improve the app: diagnosing crashes and understanding which features are used.
To meet legal obligations.

We do not make any decision about you that has a legal or similarly significant effect using automated processing alone.

6. Photos, and an important limitation

What we do to a photo

When you add a photo, we remove the embedded metadata before storing it, including GPS coordinates, camera details, and timestamps. We keep the picture itself as you framed it, and we do not crop it unless you chose a crop.

Please note one gap. There is a fallback upload path in the app where a photo can reach storage without passing through that removal step, and a photo taking that path can keep its original metadata. We are closing it.

Where photos are stored, and who can reach them

Photos are stored with Amazon Web Services (Amazon S3), in the United States, and served over HTTPS. We may add a content delivery network in front of them later.

The stored photos are served from public web addresses. Anyone who has the address of a photo can open it without logging in to Stash. The addresses are not listed anywhere public and they contain a random identifier, but they are not secret, and the path includes your account number.

This means a photo's address, if it is shared or leaks, gives access to that photo. Photos are not currently protected by a login check.

We consider this a weakness rather than a design goal, and moving photo delivery behind signed, expiring links is planned. This paragraph will not be softened while the storage bucket stays public.

Scanning images that can reach strangers

Before a deal image, or any image that could be shown to people who are not your friends on Discover, is made visible, it is passed through automated image scanning (AWS Rekognition) to catch content such as explicit or hateful imagery. If an image does not pass, or the scan cannot reach a verdict, the item is published without that image rather than shown unchecked. The images you keep in your own private journal are not scanned.

7. What other people can see

Your username is visible to other users and can be found by search.
Your email address is not shown to other users.
Your journal entries are private to you by default.
Dishes you share go to the specific friends you send them to. They keep their copy.
Deals you post are visible to other Stash users on the Discover map once they pass the checks described in section 6. Do not post anything in a deal you would not want other users to see.
Your name on a deal is off by default. A deal you post shows your username as the contributor only when you turn on "Show my name" for that deal. With that setting off, the deal still appears on the map, without your name. A deal also carries no contributor name when you have scheduled your account for deletion, or when you and the person reading it have blocked each other, and deals that came from the data we loaded to start the map have no contributor at all.
Community aggregates are on by default. Stash uses combined, counted signals from other users, such as how many people in your network have liked or logged a dish at a place, to power recommendations and the map, and this is on by default. These aggregates are counted, never tied to a username, and no count is shown unless at least three people are behind it. You can turn this off in Settings, and when you do the recommendation model stops using your entries for it.
Spots you log feed a shared pool of places used across the app, and a new place you submit is reviewed before it is published to the community.
Menus you photograph for a place are private; other users can only see that a menu exists.
Your taste profile is used to personalize what you see and is not published to other users.

If you block someone, you and they stop seeing each other's shared content.

8. Who we share your information with

We do not sell your information. We share it only with the companies that run parts of Stash for us, and only so they can do that job. We require each of them to protect your information to at least the standard this policy sets, and to use it only for the work they do for us.

Who	What they do for Stash	What reaches them
Amazon Web Services	Photo storage (S3) and automated image scanning (Rekognition)	Your photos, the account number in the storage path, and the bytes of images shown to strangers
Mapbox	Maps, and turning place names into coordinates	Map and search requests, including coordinates and the place text you search for
OpenStreetMap Foundation (Nominatim)	Turns an area you search for on Discover into a place on the map. It is a public service that runs under its own privacy policy	The area text you search for, usually sent from our servers; when our servers cannot be reached or find nothing, the app asks Nominatim directly, which then also sees your device's IP address
Google Cloud	Hosts our servers (Cloud Run) and our database (Cloud SQL), in the United States	Everything the app sends, receives, and stores, as our host
Resend	Sends account emails	Your email address and the contents of the email
Sentry	Crash and error reporting	Technical error details, with personal details filtered out and no account identifier
PostHog	Product analytics	The limited set of events described in section 3, and an internal account identifier
Microsoft Teams	Delivers a copy of in-app feedback to our team	The category, the first 500 characters of your message, your username, the platform (iOS or Android), and the app build

If Stash offers paid features later, purchase processing would also involve the Apple App Store, Google Play, and RevenueCat, which would receive the status of a purchase or subscription and never your card number.

We may also disclose information if the law requires it, if we need to enforce our Terms, or if it is necessary to protect someone's safety. If our business is transferred to another company, information would transfer with it, and we would tell you.

9. Where your information is held

Our servers and our database are hosted by Google Cloud in the United States, and your photos are stored on Amazon S3 in the United States. If you use Stash from somewhere else, your information is transferred to the United States.

During the alpha and beta, Stash is offered in the United States only, and this policy will be updated before Stash is offered anywhere else.

10. How long we keep things

Your account and your entries are kept until you delete them or delete your account.
Entries, trips, and deals you delete wait 7 days in Recently Deleted, where you can restore them. After 7 days they are permanently deleted, within about a day after that.
Photos are kept until your account is permanently deleted. When an entry or a deal is permanently deleted, the copies of its photos shown on Discover are deleted with it.
Email verification and password reset links are stored only as a hash, are single use, and expire after a short time.
Crash reports and analytics events are kept according to our providers' retention settings.
Server logs are kept for a short operational period and then rotated out.
Moderation reports and the record of moderation actions are kept after a report is resolved, so that repeat problems can be seen.

We have not yet committed to a fixed number of days for logs, analytics, and resolved moderation records, and we will state those periods here once they are set.

11. Deleting your account, and what survives

You can delete your account in the app.

We schedule the deletion 30 days out and email you. During those 30 days you can recover the account: sign back in and choose to keep it. Signing in alone does not cancel the deletion, you have to choose. We email you again shortly before the deadline.

After 30 days the deletion runs and is permanent.

What is removed: your account record, your dishes and entries, your trips, your friendships and shares you sent, your taste profile, your blocks and the reports you filed, your recommendation data, and your photos in storage.

What is not removed, and you should know this before you delete:

Deals you posted stay on the Discover map. They are unlinked from you, so they no longer show who posted them, but the deal itself remains, because other users rely on it.
Spots you added stay in the shared pool of places, unlinked from you, for the same reason.
Dishes you shared with a friend stay in that friend's collection, because it is their copy of something they were given. Your username currently remains attached to that saved copy so that they can still see who sent it.
Anything we are required to keep by law, and routine backups, until they age out.

If you want your account removed without using the app, email us at the address in section 15.

12. Your choices and your rights

Inside the app you can:

Edit or delete any entry, photo, deal, or spot you created.
Change your taste profile at any time.
Turn off community aggregates in Settings.
Block and unblock other users, and report content.
Turn off the location permission in your device settings.
Delete your account.

Depending on where you live, you may also have the right to ask for a copy of your information, to correct it, to have it deleted, to object to or restrict how we use it, and to complain to your data protection regulator. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised any of these rights.

To exercise any of these, email us at the address in section 15 and we will respond. We will need to be satisfied that the request is really from you.

Please be aware there is no self-service export in the app yet. A request for a copy of your data is handled by hand today.

Stash does not sell your personal information and does not share it for advertising, so there is nothing to opt out of on that front.

13. How we protect your information

Traffic between the app and our servers uses HTTPS.
Passwords are stored only as a one-way hash that we cannot reverse, and are never logged.
Email verification and password reset links are stored only as a hash, are single use, and expire after a short time.
Every request for your data is checked against the account making it, so you can only reach your own entries.
Sign-in attempts are protected against automated guessing and abuse, and sign-in errors are deliberately vague so they cannot be used to discover whether an account exists.
Analytics and crash data pass through a filter that removes personal details before leaving your device.

No service is perfectly secure, and we cannot promise your information will never be accessed improperly. Note the photo storage limitation in section 6, which is a real and current exception to the protections above.

If a security breach affects your personal information, we will notify you and the relevant authorities where the law requires it, and within the time the law requires.

14. Children

Stash is not for children under 13, and we do not knowingly collect information from them. The app asks you to confirm you are 13 or older when you sign up. If you are a minor, you may use Stash only with a parent or guardian's permission.

If you believe a child under 13 has an account, contact us and we will remove it.

15. Contact us

Email: [email protected]
Post: Bitter Melon Technologies LLC, 2108 N Street STE N, Sacramento CA 95816

We aim to answer privacy questions promptly.

16. Changes to this policy

We will update this policy as the app changes.

When we make a material change we will raise the version number and show you the new policy in the app before you carry on using Stash. For smaller corrections we will update the version and the effective date here. The version and effective date at the top always tell you which policy is current.