Privacy Policy

The Stashling iOS app is published by Bitss Bilişim Hizmetleri Anonim Şirketi (Bitss Bilişim Hizmetleri A.Ş.), a joint-stock company established in Türkiye. Bitss is the data controller (GDPR) and data controller / veri sorumlusu (KVKK) for personal information processed through Stashling.

Registered office: İlkbahar Mah. Konrad Adenauer Cad. No: 81/4, Çankaya, Ankara, Türkiye
Tax office / no.: Seğmenler V.D. 1780771111

Stashling turns TikTok and Instagram posts you choose to save into structured cards — recipes, places, products, activities, workouts, DIY, and more — and lets you search, organize, and chat with those saves.

For privacy questions, contact us at privacy@stashling.app. For product support, use support@stashling.app.

This policy applies to:

• The Stashling iOS app and Share Extension
• The website (including collection invite pages)
• Our backend API and processing pipeline that create cards, run chat, and store your library

It does not apply to TikTok, Instagram, Apple, Google, or other sites and apps you open from Stashling. Those services have their own policies. When you open a source post in TikTok or Instagram, or a web page in the in-app browser, those parties may collect data under their own terms.

3.1 Account information

You need an account to use the app. You can create one with:

• Sign in with Apple — we store Apple’s user identifier (sub) and, if you share them, your email (including a Hide My Email relay) and name.
• Google — we store Google’s user identifier, email, name, and profile photo URL. We do not store Google access or refresh tokens. Sign-in uses a one-time ID token.
• Email and password — we store your email, display name, and a one-way Argon2id hash of your password (with an application pepper). We never store your password in plaintext.
• Email magic link — we store your email and send a short-lived, one-time link. No password is created unless you set one.

We also store an internal account ID, whether your email is verified, your Pro subscription status, and timestamps. We do not store Apple or Google identity tokens after sign-in.

In v1, signing in with different methods (for example email, then Google with the same address) can create separate accounts. Those accounts are not automatically linked.

3.2 Content you save

When you save a TikTok or Instagram URL — from the Share Extension or by pasting a URL in the app — we collect:

• The URL you submitted
• Public post metadata (caption, creator handle and display name, thumbnail) retrieved so we can build the card
• Video or image media needed to process the save, including thumbnails and extracted keyframe images we store
• A transcript of spoken audio, created during processing so we can extract structured details. We do not keep a transcript field on the saved card; excerpts can still appear in AI debug traces until the account is deleted.
• The structured card we generate (title, description, type, and type-specific fields such as ingredients, steps, addresses, product links, activity details)
• Nutrition estimates for recipes (calories and macros derived from ingredient lookups)
• Research notes and source URLs when we look something up on the open web to identify a product, place, or activity the post did not fully specify
• Vector embeddings of your cards, used for search and organization
• Processing status and error information if a save fails

You may also edit cards, change their type, and organize them into collections. Those changes are stored with your account.

Saved posts often include other people’s data — creator names and handles, faces in thumbnails and keyframes, and voices in the audio we transcribe. We process that because you asked us to save a public post, so we can build and show your card. You should only save posts you are allowed to save.

3.3 Chat

If you use Chat, we store conversations, including your messages, which saved cards you focused, the assistant’s replies, web source citations (URLs, titles, favicons), and any organization actions you confirm (for example, adding cards to a collection).

Chat can search your library and, on Pro, search the open web. Web-search queries and the page excerpts returned to the model are processed as described in AI and automated processing.

3.4 Collections and sharing

Collections you create include a name, optional description, cover, trip dates if you set them, routing rules (including any natural-language rules you write), and which cards you add.

If you share a collection, we create an invite link. People who join become members. Members can see each other’s display name, email, and profile photo. Anyone with the invite link can see a preview: collection name and description, owner name and photo, member and save counts, and a few thumbnails — without signing in.

3.5 Purchases

Pro is an auto-renewable Apple subscription. Apple processes the payment. We learn your subscription status through RevenueCat (using your Stashling account ID) and store whether your account is Pro. We may also send your email to RevenueCat as a customer attribute so we can support you. We do not store your full card number. Restore Purchases uses Apple’s purchase records via RevenueCat.

Free accounts have monthly limits on new saves and chat turns. The numbers in force appear in Profile in the app and reset on the calendar month in UTC. Saving a URL you already have does not count as a new save.

3.6 Product analytics

We use PostHog (hosted in the EU) for product analytics and to debug AI. We do not record your screen, and we do not autocapture taps or screen views.

Product events are named actions (for example: an onboarding step was shown, you signed in, a card was opened, a chat was started or sent, the paywall was shown, a save was accepted or rejected, a card finished processing, Pro was granted or revoked). Event properties are identifiers, types, counts, app version, whether the build is debug / TestFlight / App Store, and whether the API is local or production. Product events do not include chat text, card titles, or save URLs.

LLM traces are separate. They record model work for ingest and chat and do include user content — prompts, save URLs, extracted card fields, tool arguments and results, and chat text — so we can debug extraction and the assistant. Traces are tied to the same analytics profile as your account.

Before you sign in, analytics may be anonymous. At sign-in we merge that anonymous profile into your account profile and store your email on it so we can find you if we are debugging a problem. We do not send your onboarding display name to PostHog. Signing out starts a new anonymous profile; the next sign-in does not inherit a previous user’s timeline.

The Share Extension does not run the PostHog SDK. Saves started from the share sheet are recorded as server-side product events and ingest traces only.

Our PostHog backend client runs with privacy mode off, and the iOS SDK is a standard PostHog install (replay and autocapture still disabled). Besides the events and traces above, PostHog may receive your IP address and a device identifier Apple provides to this app’s vendor (IDFV). That is not the advertising identifier (IDFA). We still do not collect IDFA or show an App Tracking Transparency prompt.

3.7 Website

The marketing website no longer collects waitlist signups. If you previously joined the waitlist, we may still hold your email and, if you provided it, your name, until you ask us to delete them or we delete the remaining list.

The website uses Vercel Analytics for aggregate traffic. It is not tied to your Stashling account and is not used to show you ads.

Collection invite pages may load thumbnail images from our storage so a guest can see a preview.

3.8 Technical and security data

We automatically process:

• App version, build number, platform, and whether the request came from the app or the Share Extension (sent as request headers, including for an unauthenticated configuration check used to force-update incompatible builds)
• IP address, used to rate-limit sign-in, registration, magic links, and password reset, to protect the service, and — because PostHog privacy mode is off — as part of analytics ingestion
• A vendor device identifier (IDFV) associated with the iOS app, sent by the PostHog SDK. Not IDFA.
• Approximate time of requests, job IDs, and diagnostic logs

Application logs may include account IDs, URLs, and diagnostic output from AI providers. We use them to operate, secure, and debug the Services.

We do not collect IDFA, advertising IDs, or precise device location. We do not show an App Tracking Transparency prompt because we do not track you across other companies’ apps and websites for advertising.

3.9 Push notifications

If you allow notifications, the app registers an Apple Push Notification service (APNs) device token with our servers and ties it to your account, along with a timezone so reminders can respect local quiet hours. We use that token only to send optional reminders about saves you already made (for example a recipe you have not opened, or places in the same city) and operational pings such as a collaborator adding a card. We do not sell the token or use it for advertising. Apple delivers the notification to your device. You can deny or later revoke OS permission in iOS Settings, set reminders to off in Profile, or sign out — signing out unregisters that device’s token. Deleting your account deletes stored device tokens with it.

3.10 Information we do not collect from the device

The app does not request access to:

• Camera, microphone, or photo library
• Contacts, calendar, or Health
• Precise GPS / “always” or “when in use” location

Maps. Place cards show a pin for the saved place. We do not show your current location. Apple MapKit and geocoding resolve a place from the name and address on the card. If several matches appear, we may send those candidates (including coordinates Apple returned) to our servers and to our AI provider so we can pick the right one. We do not store GPS coordinates as a field on the card by default. Opening a place in Maps, or using Look Around, is handled by Apple.

Clipboard. If you tap “Paste” when adding a URL, the app reads the clipboard once for that action. We do not monitor the clipboard in the background.

Onboarding answers (including a display name you type before sign-in, how often you save, and similar questions) stay on your device unless you later provide a name through Apple or Google sign-in. They are not sent to PostHog.

We use information to:

• Create and maintain your account and keep you signed in
• Fetch the public post you asked us to save, extract structured cards, store your library, and show it on your devices
• Power search, smart collection routing, chat, and (on Pro) web search in chat
• Look up nutrition for recipe ingredients and, when a product, place, or activity is not identifiable from the post, search the open web to fill identity and missing action fields
• Provide shared collections and invite links you create
• Enforce free-tier limits and provide Pro via Apple subscriptions
• Send transactional email (verify address, magic link, password reset, welcome)
• Send optional push notifications you have allowed, using an Apple device token stored with your account
• Understand how the product is used, debug AI, prevent abuse, and keep the service secure
• Comply with law and enforce our terms

We do not sell your personal information. We do not use it for third-party advertising or cross-context behavioral ads. We do not train our own foundation models on your content. Our AI providers process your content to provide the features above; see their policies for any independent training practices.

Card extraction and Chat use large language models and related APIs. Outputs can be wrong. You can edit, reclassify, or delete cards, and you can delete conversations.

Depending on the feature, we may send to AI providers:

• Captions, transcripts, and keyframe / carousel images from the post you saved
• Audio from that post, for transcription
• Your chat messages and relevant card content
• Search queries (library search embeddings, and Pro web-search queries)
• Ingredient strings for nutrition matching; place names and MapKit candidate lists for pin disambiguation; collection names and routing rules for auto-sort

We also send LLM traces of this work to PostHog (EU), including user content, as described in section 3.6.

We share information with service providers who process it on our instructions to run Stashling — not to sell it. Current categories:

When you share a collection, other members see the profile fields in section 3.4. When you open TikTok, Instagram, Apple Maps, or a web page, those services receive what any visit would send.

The Share Extension may call TikTok’s oEmbed endpoint and Apple’s Link Presentation to show a preview of the URL you are sharing. That sends the URL to those services for the preview only.

We may disclose information if required by law, to protect Stashling or others from harm or fraud, or in connection with a merger, acquisition, or sale of assets (we would require the recipient to honor this policy or give you notice).

On your iPhone we store:

• A session token (JWT) in the Keychain
• A copy of that token in an App Group shared with the Share Extension so you can save from TikTok or Instagram without opening the main app. That copy is stored in shared user defaults so the extension can read it.
• A local cache of cards, collections, and conversations (SwiftData) for faster browsing, plus cached images
• Preferences (units, companion-place deletion, onboarding progress, ingredient checkmarks)

Signing out removes the token and purges the local library cache on that device. The Share Extension only accepts a web URL (and may receive a thumbnail the host app attached to the share). It does not have photo-library permission.

The in-app browser is Apple’s Safari view. We do not inject scripts into those pages. Cookies there are Safari’s, not Stashling account cookies. The app itself uses a bearer token in an Authorization header, not a website cookie, to call our API.

• Account, library, chat, and collections — until you delete the relevant item or we delete your account.
• Session JWT — until it expires (about 30 days) or you sign out.
• APNs device token — until you sign out of that device, revoke notification permission and the app unregisters it, or we delete your account.
• One-time auth links (verify, magic link, password reset) — minutes to 24 hours in Redis, then they expire.
• Downloaded video used only to process a save — deleted from worker disk after the job unless we are debugging a local environment.
• Thumbnails and keyframes — stored while the card exists. After you delete a card or account, object-storage files and backups may remain for a limited period until they are overwritten or purged.
• URL dedup records — a hash of each URL you have saved, so saving the same post twice does not create a duplicate card. These last as long as the account.
• Former waitlist — until you ask us to remove you or we delete the remaining list. The website no longer collects new waitlist signups.
• Product analytics events — kept as usage metrics. After account deletion they are not tied to your email or account ID.
• LLM traces — deleted when we delete your account, because they contain your content.
• Security logs and rate-limit records — a limited period needed to operate and protect the service.

Canceling Pro in Apple’s subscription settings stops future billing. It does not delete your Stashling account or library.

In the app

• Edit or delete individual cards and conversations
• Leave a shared collection; owners can remove members
• Sign out (clears the session and local cache on that device, and unregisters that device’s push token)
• Turn off reminder notifications in Profile, or disable Stashling notifications in iOS Settings
• Delete your account from Profile → Delete Account (you will be asked to confirm)
• Restore or manage subscriptions in Apple’s Settings

Account deletion

In the Stashling app, open Profile and tap Delete Account. That permanently deletes your account, library, chats, collections you own, and memberships in collections you joined. You can also email privacy@stashling.app from the address on the account if you cannot use the app; we may need to verify it is you. We aim to complete a verified request within 30 days, or sooner if local law requires.

When we delete an account, we:

• Delete the account record and content you own (cards, chat, collections you own, memberships, and stored push device tokens)
• Remove your email from analytics and stop using your account ID as the analytics identity
• Delete LLM traces for that profile
• Keep nameless product events (counts and types, not your email, chat, or saved URLs)

Deleting your Stashling account does not cancel an App Store subscription. Cancel in iOS Settings → Apple ID → Subscriptions, or we cannot stop Apple from billing you.

Former waitlist

Email privacy@stashling.app to be removed from any remaining waitlist records.

Legal rights (Türkiye, EEA, UK, Switzerland, California, and similar laws)

Depending on where you live, you may have the right to access, correct, delete, or export personal information; to object to or restrict certain processing; to withdraw consent (for example, a former waitlist email); and to lodge a complaint with a supervisory authority. California residents also have rights under the CCPA / CPRA, including to know, delete, and correct. We do not sell personal information or share it for cross-context behavioral advertising.

If you are in Türkiye, Law No. 6698 on the Protection of Personal Data (KVKK) also applies. You may exercise the rights in KVKK Article 11 — including learning whether we process your data, requesting information, correction, deletion or destruction, and objecting to processing — by emailing privacy@stashling.app. If we do not resolve your request, you may complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

Where GDPR applies, we process account and library data to perform our contract with you; security, fraud prevention, and product analytics on legitimate interests in running a safe, useful service; remaining waitlist records on the consent you gave when you signed up; and some records where the law requires it.

To exercise a right, email privacy@stashling.app. We aim to respond to verified requests within 30 days, or sooner if local law requires. We will not discriminate against you for exercising privacy rights.

Stashling is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact privacy@stashling.app and we will delete it.

Bitss is established in Türkiye. Stashling is used internationally, so personal information may be processed in Türkiye, the European Union, the United States, and other countries where our providers operate:

• PostHog product analytics and LLM traces: EU cloud by default
• OpenAI, Exa, ScrapeCreators, USDA, RevenueCat, Resend, Apple, Google, and our application hosting / object storage: typically the United States or the region those companies operate in

When we transfer information out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the providers’ standard contractual clauses or equivalent mechanisms, plus the fact that you requested the service. Transfers from Türkiye to other countries are made in line with KVKK rules on cross-border transfers (including your request for the service and, where required, the mechanisms the Board accepts).

We use HTTPS, hashed passwords (Argon2id with a pepper) for email accounts, signed session tokens, and access controls on our API. No method of transmission or storage is 100% secure. If we become aware of a breach that affects you, we will notify you and regulators as required by law.

Stashling is not affiliated with, endorsed by, or sponsored by TikTok, Instagram, Meta, Google, Apple, or USDA. You should only save posts you are allowed to save. Opening a source post uses that platform’s app or site; we are not responsible for their practices.

We will post updates here and change the “Last updated” date. If a change is material, we will notify you in the app or by email before it takes effect. Where the law requires consent (including in the EEA and UK), we will ask for it rather than treating continued use as acceptance. If you do not agree with a change, you can stop using Stashling and request deletion of your account.

Bitss Bilişim Hizmetleri Anonim Şirketi
İlkbahar Mah. Konrad Adenauer Cad. No: 81/4, Çankaya, Ankara, Türkiye
Seğmenler V.D. 1780771111
Product: Stashling
Privacy: privacy@stashling.app
Support: support@stashling.app or the contact form

You can also open this policy from Profile in the Stashling app. See also our Terms of Use.