Privacy Policy

Last updated: 21 September 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Nico Wiedemann
Im Allmend 19
77746 Schutterwald
Germany
E-mail: stashpad@wiedemann.rocks
Website: stashpad.org

No data protection officer has been appointed; the conditions of § 38 BDSG are not met. An e-mail to the address above is enough for any data protection matter.

2. Definitions

This policy uses the terms of the GDPR. Personal data is any information relating to an identified or identifiable natural person. Processing is any operation performed on such data, from collection through storage to erasure. The controller is whoever decides on the purposes and means of processing; a processor processes data on the controller's behalf. Consent is a freely given, informed and unambiguous agreement to a specific processing operation. The full definitions are in Art. 4 GDPR.

3. Hosting and server log files

This website and the Stashpad Cloud service run on a rented server from netcup GmbH, Daimlerstrasse 25, 76185 Karlsruhe, Germany. The servers are located in Germany. A data processing agreement under Art. 28 GDPR is in place with netcup. No content delivery networks are used; the fonts are served from our own server and are not loaded from Google or any other provider.

Each request is automatically logged with the data your browser transmits: IP address, date and time, the address requested, the response status, the amount of data transferred, the referring page, and your browser type and operating system. In the access log the IP address is stored shortened - the last digits are removed, so no individual connection remains identifiable. Full addresses can still appear in the server's operational logs, for example on aborted encrypted connections or errors. This is technically necessary to deliver the site and serves the security of operations, for example detecting and repelling attacks. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after 30 days at the latest, unless a specific incident requires longer retention as evidence. This data is not combined with other sources.

4. No analytics, no advertising, no consent banners

This website uses no analytics or statistics services, no advertising networks and no services that recognise visitors. No cookies are set for those purposes. In the account area the site stores in your browser only what sign-in and language selection require - the session token, the device identifier and the chosen language. These leave your browser only when the requested service needs them, and they require no consent under § 25(2)(2) TDDDG because they are strictly necessary for the service you explicitly requested.

5. Waiting list

If you join the waiting list, we store your e-mail address and the language you chose. Sign-up is confirmed by double opt-in: you receive an e-mail with a confirmation link, and the entry becomes active only once you follow it. We store the time of sign-up and of confirmation in order to be able to demonstrate consent. If you do not confirm, we delete the entry 30 days after the last confirmation e-mail: without confirmation there is no consent, and so no reason to keep your address. We send no reminder beforehand.

The legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw it at any time without disadvantage - an e-mail to us or the unsubscribe link in any message is enough - after which the entry is deleted. Messages to the waiting list contain no tracking pixels; we measure neither opens nor clicks.

6. The Stashpad application on your device

Stashpad is a local application. With cloud sync switched off, your stashes, contexts and attachments never leave your device and no personal data reaches us. Three things do open network connections, each only for the purpose named:

• Updates. The app asks GitHub whether a newer version exists and downloads it from there. GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, thereby learns your IP address. The legal basis is our legitimate interest in secure, up-to-date software under Art. 6(1)(f) GDPR. The check can be switched off in the settings.
• AI prompt enhancement. This feature is off until you enter a provider and a key yourself. After that, the content you ask to improve is sent from your device directly to that provider - or to a model on your own machine if that is what you configure. We are not involved in this transfer and process no data in it; the provider's own privacy terms apply. Your key is stored in your operating system's keychain, or encrypted on your device where no keychain is available, and is never transmitted to us.
• Cloud sync. Only if you switch it on; see section 7.

7. Account and Stashpad Cloud

Account and sign-in

Stashpad Cloud requires an account. We process your e-mail address and, if you set a password, its cryptographic hash - the password itself is not stored. You may instead sign in with a one-time link by e-mail, with a passkey (WebAuthn), or with your GitHub account. With GitHub sign-in we receive your GitHub identifier and e-mail address in order to link them to your account; only what sign-in requires is transmitted. Your account also holds the language you chose, your subscription status and - to protect against misuse - the identifiers and names of the devices you have linked, along with the time of the last sync.

The legal basis is Art. 6(1)(b) GDPR, because this data is necessary to perform the contract, and Art. 6(1)(f) GDPR for securing the service.

Synchronised content

With cloud sync switched on, the content of your stashes and contexts and your attachments are stored on our server so that your devices see the same state. What they contain is entirely up to you. They are encrypted on your own machine before they are uploaded, with a key we do not keep. A stolen backup, or a copy of our database, is unreadable. Attachment file names are encrypted too, because a name is often as revealing as the file.

There is one deliberate exception. An access key for the Stashpad MCP server carries its own copy of your key, so an AI tool can reach your queue while your computer is switched off. While a request using that key is being served, our server can read the content that key grants access to. Access keys can be revoked in your account at any time, and revoking one removes its copy. If you create no access key, we cannot read your content at all.

So as long as an access key exists, this is not end-to-end encryption in the strict sense, and we would rather say that plainly than describe a guarantee we do not give. Two further limits worth knowing: what is stored on your own computer is not affected by any of this, and files you uploaded before switching encryption on stay as they were until they have been converted.

The key exists only on your installations and in a recovery code shown to you once. If you lose every installation and that code, your content cannot be recovered - not by you, and not by us. This is not a policy we could make an exception to: we hold the encrypted data and no key that opens it.

Attachments are held in an object store running on the same server in Germany. The legal basis is Art. 6(1)(b) GDPR.

Access by your own tools (MCP)

You can create an access key so that an AI tool of your choice can read or write your queue through the Stashpad MCP server. Anyone holding such a key can reach the content it grants access to, and so can our server while it is serving a request that carries the key - see the exception described above, which exists precisely so an agent can work while your computer is off. Keys can be revoked in your account at any time, and revoking one removes its copy of your encryption key. We log usage only as far as operation and security require.

8. Payment processing via Paddle

Paid subscriptions are handled by Paddle. Paddle acts as the seller (Merchant of Record), issues the invoice and is an independent controller for the payment process. The provider is Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom; for customers in the European Economic Area the contracting party is Paddle Payments Limited, The Academy, 42 Pearse Street, Dublin 2, D02 HV59, Ireland.

When you choose a paid subscription, we transmit your e-mail address and the chosen product to Paddle so that a payment can be created there. The payment details themselves - card number, account data, billing address and whatever tax information your country requires - are entered directly with Paddle. That data never reaches us and is not stored by us. From Paddle we receive back whether a payment succeeded, the status of your subscription, when the paid period ends, and the customer and subscription identifiers Paddle assigns. We store those in order to run your subscription.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and, for retaining billing records, Art. 6(1)(c) GDPR together with commercial and tax retention periods. Paddle also processes data outside the European Economic Area and bases such transfers on standard contractual clauses and further appropriate safeguards. Paddle's privacy policy is at paddle.com/legal/privacy.

9. E-mail delivery via Resend

Sign-in links, waiting-list confirmations and account notices - such as running low on storage - are sent through Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Your e-mail address and the content of the message are transmitted for that purpose. A data processing agreement is in place. Resend is self-certified under the EU-US Data Privacy Framework, so the transfer to the USA rests on the European Commission's adequacy decision under Art. 45 GDPR; in addition, the data processing agreement incorporates the European Commission's standard contractual clauses (module 2) under Art. 46 GDPR. Resend uses sub-processors of its own. We send no advertising, use no tracking pixels and measure neither opens nor clicks. The legal basis is Art. 6(1)(b) GDPR, or Art. 6(1)(a) GDPR for the waiting list.

10. Recipients of your data

We pass data on only where the service requires it or the law obliges us. The parties involved are:

• netcup GmbH, Karlsruhe - server operation, processor, located in Germany.
• Plus Five Five, Inc. (Resend), USA - e-mail delivery, processor.
• Paddle (Ireland, United Kingdom) - payment processing, independent controller.
• GitHub, Inc., USA - only for GitHub sign-in and for fetching application updates.

We do not sell data and do not share it for advertising purposes.

11. Retention and deletion

We keep personal data only as long as the purpose requires or the law prescribes. In detail:

• Server log files: 30 days at most.
• Account and synchronised content: until the account is deleted. You can start a deletion yourself in the account area.
• After a subscription ends or a deletion is started: 30 days at most, after which the data is permanently removed.
• Waiting list: confirmed entries until you unsubscribe, unconfirmed sign-ups 30 days.
• Invoicing and accounting records: for the commercial and tax retention periods, usually 10 years.

12. Legal bases

We process personal data on the basis of Art. 6(1)(a) GDPR where you have consented, Art. 6(1)(b) GDPR where processing is necessary to perform a contract or take pre-contractual steps, Art. 6(1)(c) GDPR where a legal obligation applies - such as tax retention duties - and Art. 6(1)(f) GDPR where processing is necessary for legitimate interests that are not overridden by your own.

Our legitimate interests are: secure and stable operation of the service, defence against attacks and misuse, and providing up-to-date software.

13. Whether you have to provide data

Using the desktop app requires no personal data at all. An account requires an e-mail address; a paid subscription additionally requires the payment and billing details Paddle asks for. Without these the respective contract cannot be concluded or performed. There is no obligation to provide data beyond that.

14. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

15. Data security

Connections to this website and to the API are encrypted with TLS throughout. Passwords are stored only as hashes, sessions use time-limited tokens that can be revoked, and access to the server is restricted to what is necessary. Even so, absolute security of transmission over the internet cannot be guaranteed by anyone.

16. Your rights

You have the following rights in relation to us:

• Access (Art. 15 GDPR) to whether and which data we process about you, including a copy.
• Rectification (Art. 16 GDPR) of inaccurate or incomplete data.
• Erasure (Art. 17 GDPR), unless a retention obligation prevents it. You can delete your account yourself in the account area, without writing to us.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR) in a common, machine-readable format. The account area lets you download an archive of all your contexts, stashes and attachments at any time. For an encrypted account that archive holds your content in encrypted form - we have no other version of it - together with a description of the format and how to decrypt it, so with your recovery code it is enough on its own. The account area can also decrypt your records in your browser, and the desktop app, which holds your key, exports everything including the files and can read an archive back in.
• Objection (Art. 21 GDPR) to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3) GDPR) with effect for the future.

An e-mail to stashpad@wiedemann.rocks is enough for any of these. Export and deletion do not need one: you start both yourself in the account area, without waiting for a reply from us.

Right to lodge a complaint

Independently of this, you may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, your place of work or the alleged infringement. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstrasse 20, 70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

17. Changes to this policy

We update this policy when the service or the legal situation changes. The version published on this page, with the date given above, is the one that applies.

Note: This English version is for convenience only. The German version is the legally binding document.