Privacy Policy

Last updated: October 23, 2026

This policy explains what the Staash app collects, who can see it, who processes it for us, and how to delete it. "Staash", "we" and "us" mean the people who run the app. Questions go to [email protected].

The short version

Staash is for showing other people what you own, so posts are public by default. You can make any post visible to your followers only or to you only, and you can make your whole account private.
Every photo you add is checked by Google's Gemini AI on our server before it is stored. Only the photo is sent, not your name or email.
There is no analytics, advertising or tracking in the app. We do not sell or rent your data.
Deleting a post, a comment or your whole account erases it, photos included.

What we collect

Your account: your email address and password. The password is stored only in scrambled (hashed) form, and we never see it. If you use Sign in with Apple, we get an Apple user ID and the email address Apple shares, which can be a private relay address.
Your profile: your handle, display name, bio, profile photo, and whether your account is private.
Your posts: the photos; the product they show (brand, name, model and category); and anything you add: caption, #tags, @mentions, price paid, purchase date, rating, condition, whether you own it, want it or sold it, and who can see the post.
What you do in the app: likes, saves, comments, who you follow and who follows you, follow requests, who you block, reports you send, your notifications and your notification settings.
Photo checks: for every photo you add, we keep the result of the check: accepted or refused and why, the product the AI saw, the photo's size and a fingerprint of the file. When a photo is refused, we keep only this record. The photo itself is never stored. A photo that passes but is never posted is deleted, with its record, within two days.
Push notifications: if you turn them on, we store a push token for your device, whether it is an iPhone or Android phone, and its language. The token is removed when you sign out or delete your account.
Technical logs: our hosting provider records requests, such as the time and IP address, to keep the service secure. These logs are kept for a short time.

We do not collect your location, contacts, advertising ID or browsing activity. The app contains no analytics, advertising or crash-reporting software.

Who can see what

Posts: a new post is visible to Everyone using Staash: on your profile, in feeds, in search, on #tag pages and on the product's page. When you post, you can choose Followers only or Only me instead.
Private account: turn on Private account in Settings, and only followers you approve see your posts.
Your profile: your handle, display name, profile photo, bio and counts are visible to everyone using Staash, even when your account is private.
Comments and likes on a post can be seen by everyone who can see that post.
Blocking someone hides your posts and comments from each other.
Reports are anonymous: the person you report is not told who reported them.
Post photos are not public files. The app fetches each one through a link that stops working after an hour, and our server only hands out that link to people allowed to see the post. A photo from a followers-only or only-me post, or from a private account, cannot be opened by anyone else, even with its address. Profile photos are public.

Photos and Google Gemini

Before any photo is stored, our server sends it to Google's Gemini AI service. Gemini checks that the photo shows no nudity. For a post photo, it also checks that the main subject is one of the kinds of things Staash is for, and it names the product so you don't have to type it. Profile photos go through the same nudity check.

Only the photo and our instructions are sent. Your name, email and account are not.
We use Google's paid Gemini API. Under Google's terms for it, Google does not use the photos or its answers to improve its products. It keeps them for a limited time, only to detect misuse, and may process them in any country where it has facilities.
A refused photo is not stored by us. Only the record of the check is kept (see above).

How we use your information

To run the app: your account, profile, posts, feeds, search, comments and notifications.
To keep Staash safe: checking photos, acting on reports, and removing content and accounts that break our Terms of Use.
To email you about your account only: confirming your email and resetting your password. We send no marketing email.

We use your information because it is needed to provide the app you signed up for, and, for safety work, because we have a legitimate interest in keeping Staash free of abuse.

Who processes your data for us

Supabase stores the database, sign-in and photos, and runs our server code. The data is kept in Australia (Sydney), encrypted in transit and at rest.
Google runs the Gemini AI that checks photos, and delivers push notifications to Android phones (Firebase Cloud Messaging).
Apple provides Sign in with Apple and delivers push notifications to iPhones.

They act on our instructions. We share data with others only if the law requires it, or to protect someone from serious harm.

Deleting things

A post: open it, tap •••, then Delete. It disappears for everyone at once. Its photo files are deleted from storage, and its caption, price, rating, tags and photo-check records are erased. Comments other people left on it are hidden with it.
A comment: long-press it and choose Delete comment. It disappears and its text is erased.
Your account: Settings, then Delete account, then type DELETE. This erases your sign-in, profile, profile photo, posts and their photos, comments, likes, saves, follows, blocks, notifications, push tokens and photo-check records. It also erases anything stored with your account by earlier versions of the app (formerly Qurate). It happens straight away. If removing a photo file fails, the server retries it automatically.

A few things remain after you delete your account:

Products you added to the shared product list (brand, name, model), with no link to you.
Reports you sent, with no link to you, and reports about your content, so we can keep handling abuse.
Copies in our hosting provider's backups, until those backups expire (within 30 days).
Google's misuse logs for recent photo checks, for the limited time described above.

Your rights

See and correct your information: your profile and posts are in the app, and you can edit them there.
Get a copy of everything we hold about you: email us and we will send it within 30 days.
Delete your posts, comments or account in the app, at any time.
Object or complain: email us first. You can also complain to the data protection authority where you live.

Items from earlier versions

Staash used to be a private catalogue app called Qurate. If you used it, the items you catalogued are still stored with your account, but this version of the app does not show them. Email us to get a copy or to have them deleted. Deleting your account deletes them too.

Children

Staash is not for children under 13, and we do not knowingly collect information from them. If you think a child under 13 has an account, email us and we will delete it.

Security

All traffic between the app and our servers is encrypted (HTTPS). Data is encrypted at rest by our hosting provider. Only the server code we run can write or delete photos. The database checks who is allowed to see each post, and each post photo, every time it is opened.

Changes to this policy

When we change this policy, we update the date at the top. For important changes, we also let you know by email or in the app.

Contact us

Questions about privacy, a copy of your data, or anything else:

[email protected]