StashBuddy Privacy Policy

Last updated: 9 July 2026

This Privacy Policy explains what information the StashBuddy mobile application ("StashBuddy", "the app", "we", "us") collects, how it is used, and who it is shared with. StashBuddy is a household inventory app: it helps you track the food and products you have at home, their best-before dates, and your shopping list.

We designed StashBuddy to be private by default. The app works fully offline, requires no account, and collects no analytics. You only share data with us if you choose to create an account and enable optional cloud features.

If you have any questions, contact us at jambroviczg@gmail.com.

1. Summary

• You can use StashBuddy with no account and no internet. In that mode, none of your inventory data ever leaves your device.
• We do not use any advertising, analytics, or tracking technologies. There are no ad networks, no tracking SDKs, and we do not access your device's advertising identifier.
• We do not send push notifications. Reminders and alerts are generated entirely on your device.
• Optional features (account, cloud sync, backup, household sharing, community barcode data) do involve sending data to our servers or third parties, as described below. These are off unless you turn them on.

2. Information we collect

2.1 Data stored only on your device (no account required)

By default, everything you enter stays in a database on your device:

• Products (name, brand, barcode, category, storage location)
• Stock entries (quantity, best-before date, purchase date, price, notes)
• Consumption/purchase history
• Shopping list items
• Categories and storage locations
• Your scan history and app preferences/settings

If you never create an account, this information is never transmitted to us or anyone else. It remains on your device and is removed if you uninstall the app.

2.2 Account information (only if you sign up)

Creating an account is optional and only needed for cloud features. When you register, we collect:

• Email address (required)
• Password (required)
• Name (optional)

Your account is managed by Amazon Web Services (AWS) Cognito. Your login session tokens are stored securely on your device using the operating system's secure keystore. We do not offer multi-factor authentication.

You may alternatively sign in with Google. In that case Google shares your email address and name with us (via the standard sign-in profile scope) to create your account. We do not receive your Google password.

2.3 Cloud sync and backup (paid tiers / signed-in users)

If you subscribe and enable Cloud Sync (Pro or Family) or Backup, your inventory data is sent to and stored on our servers (AWS), linked to your account:

• Cloud Sync transmits your products, stock entries, prices, notes, consumption history, shopping list, categories and locations so they stay consistent across your devices.
• Backup uploads a copy of your full on-device database (which additionally includes your scan history and app settings) so you can restore it later.

This data is stored in AWS (DynamoDB and S3) in the EU (Frankfurt, eu-central-1) region and is associated with your account identifier.

2.4 Household sharing (Family tier)

If you create or join a Household, the following is shared with the other members of that household:

• Your inventory data (products, stock, shopping list, etc.), which becomes a shared household inventory.
• Your email address and name, which are visible to other household members and to anyone you invite (invitations are sent to an email address you provide).

Only join a household with people you trust with this information.

2.5 Barcode scanning

When you scan or look up a barcode:

• The barcode number is sent to product-data providers to look up the product: Open Food Facts (openfoodfacts.org) and Barcode Spider (barcodespider.com), either directly from your device or through our server.
• If you are signed in, the lookup goes through our server, which caches product information (including product images) to speed up future lookups.
• If you accept or correct the suggested product details, the barcode and the product name/brand/category you confirm are stored on our server as community data to improve results for other users, associated with your account identifier. Your personal inventory (quantities, prices, notes) is not part of this community data.

Barcode lookups from unauthenticated users contain only the barcode — no account or personal identifier.

2.6 Purchases

Subscriptions are processed by Google Play Billing. We do not receive or store your payment card details. To activate your subscription, your Google Play purchase token and the product identifier are sent to our server, which verifies the purchase with Google's Play Developer API and records the purchase against your account.

2.7 Device permissions

• Camera — used solely to scan product barcodes. We do not record or store photos or video; the camera is used only to read a barcode.
• Notifications — used to show you local best-before reminders and low-stock alerts (see Section 5).

3. How we use your information

• To provide the app's core inventory features (on your device).
• To authenticate you and, if you enable them, to sync, back up, and restore your data across devices.
• To enable household sharing among members you choose.
• To look up product information from barcodes and to improve community product data.
• To verify and activate your subscription.
• To operate, secure, and debug our backend service.

We do not use your information for advertising, profiling, or sale to third parties.

4. Who we share information with (service providers)

We share data only with the providers needed to run the features above:

These providers process data on our behalf to deliver the service and are not permitted to use it for their own purposes.

5. Notifications

All notifications are generated locally on your device and evaluated against your on-device data. StashBuddy does not use push notifications, does not create a push token, and does not send any notification data to a server. Notifications include best-before reminders and low-stock alerts, and you can turn them off in Settings.

6. Data retention and deletion

• Local data: removed when you uninstall the app, or when a different account signs in on the same device (you are asked to confirm before this happens).
• Signing out clears your session on the device but does not delete your local inventory.
• Deleting your account: you can delete your account from Settings. This removes your account from AWS Cognito and erases the data associated with it in our cloud — your cloud backups (in S3) and your synced inventory rows (in DynamoDB) are deleted as part of the same action. If you are a member of a shared household, deleting your account removes you from that household; data that belongs to the shared household as a whole (and to its other members) is not affected. If you own a household, you must delete or transfer it before deleting your account.

7. Children's privacy

StashBuddy is not directed to children under 13 (or the equivalent minimum age in your jurisdiction) and we do not knowingly collect their personal data.

8. Data location and transfers

Our backend and any cloud-stored data are hosted in the European Union (AWS eu-central-1, Frankfurt). Third-party providers listed in Section 4 may process limited data (as described) in their own regions.

9. Your rights

Depending on your jurisdiction (e.g. the EU/EEA under the GDPR), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict its processing. To exercise these rights, contact jambroviczg@gmail.com. You may also delete most data yourself directly in the app.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, notifying you in the app.

11. Contact

For any privacy questions or requests: jambroviczg@gmail.com