Stash

Privacy Policy

Last updated 3 October 2026

Stash is a game played on real streets: you record walks, runs and rolls, collect and plant Stashes, and see how you and your friends are doing. This page says what Stash keeps about you, why, who else handles it, and how to delete it. It is written to be read in a few minutes.

Stash is run by [operator to be named] — write to the address under Contact — who decides how your data is used.

Your account

• Email address and password, to sign you in. Your password is stored only as a secure hash by our database provider; nobody at Stash can read it.
• Username, an optional display name and an optional profile photo. Your friends, and people who find you in search, see these. So does anyone who opens a run link you share (it says who shared it), anyone who can read a run you comment on, and — under your "Show my name on Stashes" switch — anyone who looks at a Stash's story. A profile photo is a public file: anyone with its address can open it. You can switch search off in Settings → Privacy.
• Your settings: units, appearance, whether you move on foot or by wheelchair, and your privacy switches.

Where you go

• Activities and their routes. When you record an activity, Stash keeps its route, distance, time, pace, laps and splits. Location keeps updating in the background only while an activity is recording; finishing the activity stops it.
• Your routes are yours. Only you can read the full route of your activities. Friends can see that an activity happened, how far and how long it was — and a map of it only if you switch "Show my route to friends" on, with the start and end cut off. You can make your activities visible to nobody but you in Settings → Privacy.
• A link you choose to share shows that one run — your username, the distance, time, pace, laps and splits, and the route with the start and end cut off — to anyone who has the link — until you turn the link off.
• Stashes. Stash keeps the spot where you collect or plant a Stash, and the notes you leave in them. Every Stash has its story: who has collected it, named only as your privacy switches allow. While a Stash is on the map, anyone can see its story with the spots rounded to about a kilometre and only the town named.
• Starter Stashes are placed around where you first open the map. Their exact spots are visible only to you.
• Stash reads your location to show the Stashes near you and the leader of your area, but does not keep where you were when you only looked.

Steps

On iPhone, with your permission, Stash reads your daily step totals from Apple Health — the total for each day, nothing else — and keeps them for the step leaderboard. Stash never writes to Apple Health. Friends see your daily totals unless you make your activities visible only to you.

Step totals are health data. Stash reads them only after you allow it in Apple Health, which is your consent. If you withdraw it in the Health app, Stash receives no new step totals; those already saved stay on your account until you delete it.

What you do with other people

• Friends, claps and comments: who you are friends with, the claps you give and the comments you write on runs.
• Scores: your Marks and step totals appear on leaderboards to your friends, and on the everyone board only if you are findable in search.
• Reports: if you report a note or a profile, Stash keeps what you reported and when, so it can be looked at.
• Running plans you build are private to you.

Support messages

Messages you send through Help and support, and Stash's replies, are kept until you delete your account, so the conversation is there when you come back.

Notifications

If you allow notifications, Stash keeps your device's push token so it can tell you about friend requests, claps, comments, replies and the like. Signing out removes it.

Stash Plus purchases

Stash Plus is bought through the App Store or Google Play. Your payment is handled entirely by Apple or Google — no card or bank details ever reach Stash. Stash uses RevenueCat to learn whether you have Stash Plus: RevenueCat receives your purchase and renewal records from the store under a random identifier created for this purpose, not your account id, email or name. Stash keeps whether your Stash Plus is active, until when, whether it renews and which store it came from.

On your phone only

Stash keeps a small log of errors on your phone (Settings → Diagnostics) to help explain a problem if you ask for help. It never leaves your phone unless you copy it yourself.

This website

stashgame.net is served by Cloudflare, which keeps short-lived connection logs — your IP address, your browser and the pages you asked for — to deliver the site and protect it from abuse. The site sets no cookies, stores nothing in your browser and runs no analytics. Opening a shared run link sends the link's token to Stash's own database to fetch that one run, and nothing about you beyond what any web request sends — your IP address and browser. See the Cookie Policy.

Who else handles your data

Stash uses these services to run, and they process data only to provide them:

• Cloudflare — serves this website (see "This website").
• Supabase — our database, sign-in and server functions, hosted in the European Union (Frankfurt, Germany). Everything above is stored there.
• Expo — delivers push notifications to your device (it receives the push token and the notification's words).
• RevenueCat — tells Stash whether you have Stash Plus (see above).
• Apple and Google — the app stores, payments, Apple Health on iPhone, Apple Maps on iPhone and Google Maps on Android, and push delivery.

Stash does not sell your data, does not show ads and does not use advertising or tracking tools.

Where your data is kept

Everything Stash keeps is stored by Supabase in Frankfurt, Germany, in the European Union. If you are in Saudi Arabia, this means your data leaves the Kingdom; Stash relies on its data processing agreement with Supabase, which includes the standard contractual safeguards, for that transfer. [confirm with a lawyer] If you are in the United Kingdom, the same agreement is the basis under the UK's international transfer rules.

Expo (push delivery), RevenueCat (Stash Plus) and Cloudflare (this website) are based in the United States and process the little they receive under their own data processing terms. [confirm with a lawyer]

How long it is kept, and deleting it

Your data is kept while you have an account. Delete account in Settings deletes your account and everything tied to it — profile, photo, activities and routes, steps, Stashes you planted, collections, friends, claps, comments, plans, support messages and push tokens — straight away.

• Deleting your account does not cancel a Stash Plus subscription; only the App Store or Google Play can. Cancel it there first.
• RevenueCat's purchase record, under its random identifier, is not removed when you delete your account. It no longer points to any Stash account.
• Notifications already sent to other people — a clap, a comment, a friend request, "collected your Stash" — stay in their notification centres and may keep your username and the first part of a comment.
• An internal log records when someone at Stash looked at or acted on an account (for example, answering a support message), so that this access is accountable. It keeps the account's id, the action, the reason, and — where a name, username or photo link was removed or reported — that value. Never your activities, routes or Stashes.

You can also ask for a copy of your data, or for something to be corrected, by writing to the address below.

Your rights

You can ask to see the data Stash keeps about you, receive a copy, have it corrected or deleted, object to a use of it, or withdraw a consent you gave — in the app (Settings → Privacy and Settings → Delete account) or by writing to the address below. Stash answers within thirty days. You can also complain to the data protection authority where you live — for example SDAIA in Saudi Arabia or the ICO in the United Kingdom.

Children

Stash is not meant for children under 13, and does not knowingly keep data about them. If you believe a child under 13 has an account, write to us and we will delete it.

Changes

If this policy changes in a way that matters, the app will say so before the change takes effect. The date at the top is the latest version.

Contact

Write to support@stashgame.net or use Help and support in the app.