Privacy policy

1. Who is responsible

Stowlist is provided by Medha Arcot (“we”, “us”). This policy applies to the Stowlist app and this website. For privacy questions, email tinyquotesapp@gmail.com with “Stowlist privacy” in the subject.

2. Information on your device

The app stores the information you enter, such as item names, chosen photos, place names, notes, checklist names and entries, checklist progress, and app preferences. It uses this information to show your item library, search results and reusable checklists. A place name is a label you enter; Stowlist does not use GPS or track the physical position of your belongings.

When you choose a photo, a copy is stored in Stowlist’s local app storage. The app does not upload photos to our cloud backup. You control which photos you select. You do not need to give us your name, email address, address book, precise location, or advertising identifier to use the app.

Your device and Apple account settings may include app data in operating-system backups. We do not manage those backups. Deleting local app data does not necessarily erase copies kept by the operating system, your photo library, or other destinations you have chosen.

3. Portable export and import

You can choose to export a portable copy of your data, including saved photos, and import a compatible Stowlist export. The app prepares that file locally. A file you save or share may contain private item names, place names, notes and photos. Protect it accordingly. If you save it in iCloud Drive or share it through another app or service, that service receives it under its own terms and privacy policy; this is separate from Stowlist’s Firebase backup.

4. Optional manual cloud backup

Cloud backup is optional. When you choose a cloud action, Stowlist uses Firebase Authentication to create an anonymous app-specific identity and Cloud Firestore to store your text, checklist and location-label metadata, preferences and backup information. Photos are excluded from this cloud copy. An anonymous identifier still identifies the backup record; it does not mean that all associated information is anonymous.

Backup and restore happen when you request them. There is no email/password sign-in and no promised cross-device recovery. Cloud access depends on the current device identity. Losing that identity after a reinstall, reset or deletion can make an old backup inaccessible. Keep a portable export for information you need to recover elsewhere. A newer backup replaces the previous cloud copy.

Google processes the backed-up content and technical information needed to provide and secure Firebase, such as IP addresses and user-agent information. Firebase SDKs may also send operational diagnostics for service analysis, improvements, health and reliability. Firebase Authentication declares operational diagnostic analytics that are not linked to your identity. Stowlist does not include the Firebase Analytics product and does not use item, checklist or advertising behavior analytics. Read Firebase’s privacy and security information, Firebase’s diagnostics explanation and Google’s privacy policy.

5. Purchases

Stowlist Plus is planned as an optional one-time purchase for cosmetic themes. Purchasing is not currently advertised as available. If enabled in the released app, Apple processes payment and RevenueCat validates purchase status and restores access. Those services may process an app user identifier, product and transaction information, receipts, purchase history and related technical information. RevenueCat uses purchase information for purchase validation and its service analytics. We do not receive your payment-card details.

Purchase processing is separate from your item and checklist contents. We do not send your photos, place labels, notes or checklist text to RevenueCat. Price and availability must be shown by Apple before you confirm a purchase. This policy will be aligned with the final purchasing configuration before activation. See RevenueCat’s privacy policy and Apple’s privacy policy.

6. Support and this website

If you email us, we receive your email address, message and any attachments you send. We use them to answer your request and maintain relevant support records. Email is handled through Gmail. Please avoid sending sensitive item details, personal photos, passwords or payment information unless needed for your request.

GitHub Pages hosts this website and may process ordinary request information, including IP address and browser details, to serve and protect it. See GitHub’s privacy statement. We have not added analytics scripts, advertising, tracking pixels, remotely loaded fonts or cookies to this website. The checklist demonstration runs in your browser memory and is not saved or sent to us. External links and email services have their own practices.

7. Purposes and sharing

We use information to deliver the features you choose, protect the service, answer support requests and meet applicable legal obligations. We do not sell personal information or share it for advertising. Google, Apple, RevenueCat and GitHub have the service roles described above. We may disclose information when legally required or to protect rights and safety, subject to applicable law. Stowlist does not publish your item library or checklists to other users.

8. Retention and deletion

Local information remains until you remove it or delete app data. After an item photo is removed or replaced and the change is saved, the app cleans up unused stored photo copies. If local cleanup fails, unused copies may remain until a later cleanup or successful all-data deletion. An optional cloud copy remains until you replace or delete it; no automatic expiry is promised. Changing or removing a local item does not change a previously saved cloud copy until you back up again or delete that cloud copy.

In Settings, Delete cloud copy and guest account deletes the cloud backup and Stowlist anonymous identity while keeping local data. Delete all Stowlist data deletes the accessible cloud copy and guest identity first, then erases the local library and checklists. If cloud deletion fails, local data is preserved so you can retry. Use these controls while the original identity remains accessible. Read the deletion guide. Uninstalling alone is not a cloud deletion request. Deletion controls do not erase operating-system backups, your original photo-library images, exported files, or copies you shared elsewhere.

Providers may retain limited records for their documented backup, security, legal or transaction needs and follow their own deletion lifecycle. Deleting app data does not cancel or erase an Apple transaction. We keep support correspondence for as long as reasonably needed to address the request and retain necessary support records; you may ask us to delete it, subject to legal requirements.

9. Choices and rights

You can use core features without backup, choose which photos to add, export your data, use the app’s deletion controls, and contact us about access, correction, deletion or other rights available where you live. We may need information to verify a request. An email address alone may not identify an anonymous cloud record. If the device identity is lost, we may not be able to locate or recover that record. We respond as required by applicable law; you may also contact your local data-protection authority.

10. Security and international processing

Stowlist uses the device’s app storage and Firebase authentication and access controls for its cloud record. No storage or network service can guarantee absolute security. Cloud backup is not end-to-end encrypted. Providers may process information in countries other than your own under their applicable safeguards. Keep exports somewhere you trust and avoid storing information whose loss or disclosure would put you at risk.

11. Children and changes

Stowlist is a general utility and does not design data collection to identify children. Contact us if you believe a child has provided information that should be removed so we can address the request according to applicable law.

We may update this policy as the app and its services change. The effective date identifies this version. We will reflect material changes in the app or on this website as appropriate.