Privacy Policy

Overview

This Privacy Policy explains what information Stashd ("we", "us", "the app") collects when you use the app and this website (letsgetstashd.com), and how it's used. Both are operated by LetsGetStashd™ Ltd, a company registered in England and Wales (company no. 17304979), registered office 66 Paul Street, London, EC2A 4NA, United Kingdom.

This website

If you submit your email address through the "Notify me" form on this site, it's stored in our Firestore database for one purpose only: emailing you when Stashd launches. We don't use it for anything else, and it's never sold or shared. You can ask us to delete it at any time via Support.

Cookies

This website uses Google Analytics (GA4) to understand traffic — how many people visit, and roughly where from. GA4 sets a small first-party cookie to do this. We only load it if you click "Accept" on the cookie banner shown on your first visit; if you click "Decline" (or don't respond), no analytics cookie is set and no data is sent to Google. You can change your mind at any time — manage cookie preferences. We don't use any advertising or cross-site tracking cookies.

Information we collect (the app)

• Account information — when you sign in with Apple or Google, we receive your name and email address (or the private relay address Apple/Google provides) and create a Stashd account identifier.
• Location data — precise GPS location, to show nearby stashes, guide you to them, and let you place your own. Location is collected while the app is in use, and also in the background while you have an active hunt in progress (for live distance/direction tracking and hunt notifications).
• Photos — access to your camera to take a proof photo when you find a stash, and to your photo library if you choose a photo as your profile avatar.
• Content you create — stash titles and descriptions, trail names, your friends list, and messages you send to other players via direct message, stash-contact, or trail chat.
• Messages are not end-to-end encrypted — messages you send are stored on our servers and automatically checked against content-moderation rules to detect violations of our community guidelines. This scanning happens at send time; message content is not retained for any other purpose or reviewed by humans unless a breach is flagged.
• Device and diagnostic information — crash reports and basic app usage analytics, to find bugs and understand which features are actually used.
• Push notification tokens — so we can notify you about things like friend requests or hunt updates.

How we use your information

• To operate core app features — dropping and finding stashes, trails, and friends.
• To keep the app secure and prevent abuse (e.g. verifying requests come from a genuine copy of the app via Apple/Google device attestation).
• To diagnose crashes and improve the app based on usage data.
• To send you notifications you'd expect from a social app (friend requests, hunt progress) — you can turn these off in your device settings.

Sharing

We don't sell your personal data. Stashd's backend runs on Google Firebase / Google Cloud Platform — Google hosts our database, file storage, sign-in, crash reporting, analytics, and push notifications infrastructure, and processes data on our behalf under Google's data processing terms. Signing in also involves Apple or Google as your chosen identity provider, governed by their own privacy policies. This website also uses Google Analytics if you accept the cookie banner (see Cookies, above). We don't share your data with anyone else except where required by law.

International transfers

Because our infrastructure provider (Google) operates data centres globally, your information may be processed outside the UK. Where that happens, it's covered by Google's standard contractual clauses / the UK International Data Transfer Addendum, which require an equivalent standard of protection.

Data retention

We keep your account data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we're required to retain something for legal or security reasons (e.g. abuse-prevention logs).

Your rights

Under UK GDPR, you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise any of these, or to delete your account entirely, email us via the Support page. If you're unhappy with how we've handled your data, you can also complain to the UK's Information Commissioner's Office (ico.org.uk).

Children's privacy

Stashd isn't directed at children under 13, and we don't knowingly collect personal data from children under that age. If you believe a child has created an account or provided us with personal data, contact us via Support and we'll delete it.

Security

We use reasonable technical and organisational measures — including encrypted connections and Firebase's access-control rules — to protect your information. No method of transmission or storage is 100% secure, so we can't guarantee absolute security.

Changes to this policy

We may update this policy from time to time; the "last updated" date above will change when we do. Material changes will be flagged in the app.

Contact

Questions about this policy? Reach us via the Support page.