Stash is a privacy-first personal finance and net worth tracking application designed to help users organize their savings, investments, loans, expenses, and other financial records.
Stash does not sell personal financial data, display third-party advertising, monetize transaction histories, or require access to your online banking passwords or one-time passwords (OTPs).
This Privacy Policy explains what information Stash collects, why it is processed, how it is protected, when it may be shared with service providers, and what choices you have regarding your data.
The information processed by Stash depends on the features you choose to use.
When you create or use an account, Stash may process your name, email address, authentication identifiers, account creation and authentication metadata, and information necessary to maintain your Stash account. If you use Google Sign-In, basic profile information may be received from Google as described below.
Stash may store financial information that you manually enter or import, including:
Stash does not independently verify financial information that you provide.
If you use supported statement-import functionality, Stash may process files such as CSV statements to extract financial records. Where a file is processed only within your browser or device, the file itself is not intentionally retained on Stash servers unless explicitly stated. Parsed or confirmed transaction data may be stored in your Stash account if you choose to save it.
If you create a device PIN, Stash may store a cryptographic representation of the PIN rather than the PIN itself. The PIN is used for local or device-level access functionality where supported. Stash does not store the plaintext device PIN in persistent storage.
Stash or its infrastructure providers may process limited technical information necessary to operate and secure the service, such as authentication events, session information, browser or device information, IP address, timestamps, error information, and security-related logs. Such information is used for authentication, security, reliability, fraud prevention, troubleshooting, and service operation.
Stash is designed so that you do not need to provide your online banking credentials.
Stash does not ask you to provide:
Unless a future feature explicitly states otherwise, Stash does not log in to your bank account on your behalf or use credential-based bank scraping.
Information processed through Stash may be used to:
Stash does not use your financial records to build advertising profiles.
Where applicable under Philippine data protection law, personal information is processed only for legitimate and disclosed purposes. Depending on the processing activity, Stash may process information because it is necessary to provide the service you requested, you have provided consent where consent is appropriate, processing is necessary for legitimate interests such as account security and fraud prevention, or processing is required by applicable law.
Stash aims to collect and process only information reasonably necessary for these purposes.
Stash may use a combination of browser-side storage, device-side processing, and cloud infrastructure. Cloud-hosted functionality may use Supabase and PostgreSQL-based infrastructure.
Security measures may include:
No internet-connected system can guarantee absolute security.
Where Stash provides a device unlock PIN, the PIN is intended to provide an additional local access control. The application stores only a salted cryptographic hash or equivalent secure representation of the PIN rather than the PIN itself. A device PIN is separate from your email password or Google authentication credentials. You are responsible for keeping your PIN private and protecting access to your device.
Stash may use Google Sign-In to authenticate users. When you choose to sign in with Google, Stash may request only the minimum identity scopes necessary for authentication, such as openid, email, and profile. These may provide basic account information such as your Google account identifier, name, profile image, and email address.
Stash does not request access to Gmail messages, Google Drive files, Google Contacts, or Google Calendar unless a future feature expressly requests such permission and this Privacy Policy is updated accordingly.
Stash's use and transfer of information received from Google APIs is intended to comply with the Google API Services User Data Policy, including applicable Limited Use requirements. Google user data received for authentication is not used for targeted advertising, for sale to data brokers, to create advertising profiles, or to train generalized artificial intelligence or machine-learning models.
Stash may rely on third-party service providers to operate parts of the application, including providers for authentication, database hosting, cloud infrastructure, application hosting, security, error monitoring, and other technical services.
These providers may process limited information as necessary to perform services on behalf of Stash and are subject to their own contractual, privacy, and security obligations. Stash does not authorize service providers to sell your financial information for advertising purposes.
Stash does not display third-party advertisements inside the application. Stash does not sell your personal financial records or transaction history to advertisers, data brokers, lenders, or marketing companies. Stash does not use financial ledger information for targeted advertising.
If Stash's business model or use of personal information materially changes in the future, this Privacy Policy will be updated before the new use is implemented where required by law.
Stash may generate information derived from the financial records you provide, including calculated net worth, debt ratios, estimated interest, projected savings, simulated investment growth, estimated loan payoff schedules, and other financial metrics. These values are treated as part of your financial information for purposes of this Privacy Policy.
Stash retains personal information only for as long as reasonably necessary to provide your account and requested features, maintain security and service integrity, comply with legal obligations, resolve disputes, or enforce applicable agreements.
Financial records generally remain associated with your account until you delete them or delete the account, subject to limited retention permitted or required by law. Technical logs, backups, or security records may remain for a limited period after deletion where necessary for system integrity, security, fraud prevention, or legal compliance.
Where export functionality is available, you may download a copy of your Stash financial records in a supported structured format such as JSON. Exported files are no longer protected by Stash once they are stored outside the application. You are responsible for securely storing, transferring, or deleting exported copies.
You may request deletion of your Stash account and associated application data using the account deletion functionality available in Settings. Before deleting your account, you should export any information you wish to retain.
Account deletion may permanently remove financial records associated with your account and may not be reversible. Deletion requests will be processed subject to reasonable technical limitations, backup retention periods, and any legal obligations requiring limited information to be retained. Deleting your Stash account does not automatically delete information independently maintained by third-party providers such as Google.
Subject to applicable Philippine law, you may have rights concerning personal information processed by Stash, including the right to:
Some rights may be subject to legal exceptions or technical limitations. Requests may be submitted using the contact information provided below. You may also have the right to raise privacy concerns with the National Privacy Commission of the Philippines.
Stash is not intended for children below the age permitted to independently consent to the processing of their personal information under applicable law. Stash does not knowingly seek to collect financial information from children without appropriate authorization. If you believe a child has provided personal information without appropriate consent, please contact us so that the matter can be reviewed.
Stash uses reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or loss. These measures may include encryption, authentication controls, cryptographic credential storage, database access policies, Row-Level Security, restricted administrative access, and secure network communications.
No method of electronic storage or transmission can guarantee absolute security. You should use a strong account password, protect your device, keep your device PIN confidential, and maintain secure copies of important exported information.
If a security incident affects personal information, Stash will assess the incident and take reasonable steps to contain and remediate it. Where notification is required by applicable Philippine law, affected users and/or the appropriate regulatory authority will be notified in accordance with applicable requirements.
Some infrastructure or third-party service providers used by Stash may process or store information outside the Philippines. Where personal information is transferred or processed internationally, reasonable measures will be taken to ensure that the processing remains subject to appropriate privacy and security protections consistent with applicable law.
Stash may include references or links to banks, government agencies, financial institutions, or other external websites. Stash is not responsible for the privacy practices, security, accuracy, or content of independent third-party websites or services. You should review the applicable privacy policies of those services before providing information to them.
This Privacy Policy may be updated to reflect changes to Stash features, changes to infrastructure or service providers, changes to data-processing practices, changes in applicable law, or security and operational improvements.
The effective date at the top of this Privacy Policy will be updated when changes are made. Where required by applicable law, users will be provided with additional notice or consent mechanisms for material changes.
For questions, privacy requests, correction or deletion requests, or concerns regarding the handling of personal information, contact: support@stashexpenseapp.com
When submitting a privacy request, you may be asked to verify your identity before information is disclosed, corrected, exported, or deleted.