Privacy policy

In short

• What you save stays in your browser unless you sign in to sync.
• If you sign in, it’s stored on the server you chose, to sync your devices and to let the AI apps you connect read it.
• No ads, no analytics or tracking, no selling or sharing of your data.

On your device

The extension keeps what you save in the browser’s own storage for the extension: links, notes, to-dos, images, voice recordings and their transcripts, your folders, and, for each item, the address and title of the page you were on when you saved it. Settings (including your sign-in token and add-on settings) are kept there too. Removing the extension deletes all of it, so export a backup first (⋯ → Export backup) if you want to keep it.

The pages you visit

• The Stash dot is added to the pages you open so you can capture from any of them. The extension doesn’t read the text of those pages and doesn’t keep a history of where you go.
• It uses the page’s address to show, on the dot, how many things you have saved from that site. That count is worked out on your device and nothing about the page is sent anywhere.
• Selected text, a link, an image or the page address are saved only when you choose to (paste, + This page, or right-click → Stash).
• Website icons next to saved links come from the browser’s own icon cache; Stash makes no request for them.
• When you save a link, the extension asks that address for its page title, without your cookies. When you right-click an image to save it, the image is downloaded from where it is.

Microphone

The microphone is used only while you record a voice note, which you start with the mic button or the voice-note shortcut and stop yourself; the dot turns red while it’s on. The recording is saved on your device. It leaves your device only if you’re signed in, when it syncs to your server and is transcribed (see below).

If you sign in (sync)

Signing in is optional. The extension’s sign-in form comes filled in with the developer’s Stash server, and you can enter the address of another one (for example your own) instead; then that server holds your data, under its operator’s policy. On this server:

• Your account: email address and a password hash (scrypt; the password itself isn’t stored), the devices and AI apps you’ve signed in, with when they were last used.
• What you save: everything listed under “On your device”, so it’s the same on all your devices.
• Saved page text. When you save a link, this server visits that public address (without your cookies or sign-ins) and keeps the readable text, so search and your AI apps can use it. Pages that need a sign-in aren’t read.
• Transcripts. Voice notes are turned into text on this server itself; the recordings are not sent to any other service.
• Connection data: IP addresses are used to limit sign-in attempts and may be in the web server’s logs for a short time.

Your data is used only to run Stash for you: sync, search, the mind map and the AI apps you connect. It isn’t used for advertising, isn’t sold, and people don’t read it except when you ask for help or the law requires it. Data travels over HTTPS.

Deleting: deleting an item deletes it on the server too. Your account page can sign out devices, disconnect AI apps and delete your account, which deletes everything stored for it.

AI apps

You can let AI apps (for example Claude, ChatGPT or Cursor) read and add to your Stash, either through this server’s MCP link, which you approve in your browser, or through the local stash-mcp program on your computer. An app you connect can read your items and add, change or delete them. What it then does with them is covered by that app’s own privacy policy. You can disconnect an app at any time.

Connections on your computer

These stay on your computer (the address 127.0.0.1); nothing goes over the internet.

• AI access (MCP), off until you turn it on in ⋯ → AI access: the extension connects to the stash-mcp program if it’s running, so AI apps on this computer can use your Stash.
• Desktop app link: if the Stash desktop app is installed, the extension finds it and, after you approve the link in the app, keeps the two in sync and tells the app where the dot is on screen.

Seller Scout (optional add-on, off unless you turn it on)

• Instagram accounts you add are sent to your Stash server’s Seller Scout list. For sellers you accept, the server reads their public Instagram profile and website to build a shop preview.
• Send in DM: only when you click it, the extension opens your Instagram conversation with that seller in your own signed-in tab, attaches the preview image and types your message. You press Send. To do that it reads who the open conversation is with and whether the share link has appeared in it, so it can mark the seller as shared. It never signs in, never presses Send and doesn’t read or keep other conversations or messages.
• A password for a separate Seller Scout server, if you enter one, is kept in the extension’s storage on your device.

Other

• Stash isn’t meant for children under 13.
• Stash’s use of your information follows the Chrome Web Store User Data Policy, including its Limited Use requirements.
• If this policy changes, the date at the top changes.
• Questions or requests about your data: admin@mechaflare.in.