Your information

Privacy policy

Effective 23 October 2026

Who is responsible

This policy covers the Stow mobile app and this information website. Stow's developer operates the app and its Supabase project. For privacy questions, access requests or deletion requests, use the support email shown on Stow’s Google sign-in screen.

Information you save

Stow processes the QR and barcode contents, links, text, names, notes, categories, favourites and optional images you choose to save. These are kept in the app's local storage. Version 1.0.13 separates saved items by signed-in account. Unsigned-in and pre-existing items stay in a separate device space. Signing out preserves that account's items on the device. Copying device items to an account is an explicit action. Camera scans and photo imports are processed on your device; using the scanner does not automatically upload a scan or your photo library to the developer.

Google sign-in

If you connect a Google account, Google and Supabase process the sign-in. Stow requests basic identity permissions: openid, email and profile. These can provide your account identifier, email address and basic profile information such as your name and profile photo. Stow uses your account identifier to associate a cloud backup with you and your email for account display and an optional passcode-recovery link.

If you choose Google Drive backup, Stow also requests drive.appdata permission to access its own hidden app folder. It cannot access your other Drive files. Stow does not request access to your Gmail messages or contacts. Google account information is used to provide sign-in, backup and recovery, not for advertising, sale or training general-purpose AI models.

Optional cloud backup

When you choose Back up now, or enable automatic backup and make changes while Stow is open, Stow uploads a snapshot of your saved items, notes, categories, order, favourites and saved item images to your selected location. Google Drive stores it in Stow's hidden app data folder in your Google account, rather than the normal file list. Stow Cloud stores it in the developer's Supabase project. Older app versions offer only Stow Cloud. Switching locations does not move or delete an existing backup. A later backup replaces your previous active snapshot. Automatic backup is optional and runs while the app is active. It may pause for lost connectivity, expired Google Drive access or changes from another device. Signing out does not delete a cloud snapshot. Earlier versions support manual backup only.

Backups are linked to your signed-in account. For Stow Cloud, database access rules restrict app users to their own backups. Google Drive backups use the permission you grant to your own Google account. They are not end-to-end encrypted: the project operator and its service providers may be able to access the stored data as needed to operate, support or secure the service. Do not treat Stow as storage for payment-card credentials or other highly sensitive secrets.

Passcodes and biometrics

Your app passcode is checked using a verifier and device secret held in platform secure storage. The passcode is not included in a cloud backup. This is an app access lock; it does not encrypt all saved item content. Fingerprint or face authentication is handled by your device's operating system. Stow receives an authentication result, not your fingerprint or facial template.

If you explicitly link passcode recovery, the app stores the linked account ID and email in secure storage on the device. Recovery requires a fresh sign-in with that account or successful device biometrics.

Permissions and external links

Camera access is used for scanning. Photo access is used for images you select. You can decline permissions and use other input methods. Opening a saved website or loading a remote image contacts the relevant third-party service, whose own privacy policy applies. Stow cannot control the content of scanned links.

Providers and connection information

Google provides account authentication and optional Google Drive storage. Supabase provides account infrastructure and optional Stow Cloud storage. This website is hosted through Cloudflare Pages. Those services may process connection information, IP addresses and operational or security logs when you use them. Provider infrastructure can process data in countries outside your country of residence under the providers' applicable safeguards.

Read the Google privacy policy, Supabase privacy policy and Cloudflare privacy policy for their handling of information. Stow currently includes no advertising or behavioural analytics SDK, and this website adds no analytics scripts or advertising cookies. The website stores a local display preference in your browser so the introductory animation plays only on your first visit.

Retention and deletion

Local items remain until you delete them or the app's local data is removed. Deleting a local item does not remove it from a previously uploaded backup. You can replace the cloud snapshot with a new backup that excludes deleted items. If automatic backup is enabled, subsequent backups can also reflect local deletions. Version 1.0.13 keeps up to three previous backup snapshots on the uploading device and up to three device copies before a restore or copy operation. These local recovery copies can still contain previously deleted items. They are removed when the app’s local data is removed. They are not cloud version history.

You can remove Stow’s hidden Google Drive app data through Google Drive’s Manage apps settings. This does not delete local items or a separate Stow Cloud backup. For deletion of your Stow Cloud backup or Stow cloud account, use the support email shown on Stow’s Google sign-in screen, writing from the address you used to sign in and say what you want removed. We may need to verify that the request is yours. Signing out or removing Stow's Google access does not by itself delete existing Supabase data. Provider recovery copies and security records may remain subject to the providers' retention practices and any applicable legal requirements.

Your choices and rights

You can use local storage without Google sign-in, choose whether to create a cloud backup, revoke Stow's Google access in your Google account settings, and manage device permissions. Where applicable, you can request access, correction, deletion or a copy of your personal information, object to processing or ask for a restriction. Use the support email shown on Stow’s Google sign-in screen to make a request. You can also raise a concern with your local data-protection authority.

We use the information you choose to save and the identity information needed to provide the features you request. Optional camera, photo, biometric and backup features are controlled by your choices. Security and operational information is used to keep the service functioning and protect it against misuse.

Policy updates

This page will be updated when Stow's data handling changes. The effective date is shown above.