Privacy Policy

Last updated: 2026-08-19

Data Controller: Michael Cosby · privacy@stowbook.app

1. What Stowbook is

Stowbook is a home inventory application for iOS and Android. This policy covers the Stowbook mobile application, the Stowbook website (stowbook.app), and any associated backend services operated by Michael Cosby.

2. Data we collect and why

2.1 Account data

If you sign up with an email address, we collect that address and a hash of your password. If you sign in with Google or Apple instead, we receive and store a permanent account identifier from that provider, your email address, and — for Apple, on first sign-in only — the name you choose to share. If you use a passkey, we store its public key. Legal basis: performance of a contract.

We use your email address to sign you in and to send you messages about your account and the service — for example, password resets, receipts, and notices about your data. We do not send marketing email.

Third-party processors for sign-in: Google LLC and Apple Inc., where you choose to use them. They tell us that you signed in successfully and pass us the details above; we do not receive your password from them. For Apple we also hold a token that lets us disconnect the sign-in at Apple when you delete your account.

Checking passwords against known breaches. When you set or change a password, we check whether it appears in public breach data using the Have I Been Pwned range API. Only the first five characters of a one-way hash of your password are sent — never the password itself, never your email address — and that prefix is shared by many thousands of different passwords, so the service cannot tell what your password is or who is asking.

2.2 Inventory data

Everything you add to Stowbook — items, containers, rooms, photos, custom fields, notes — is stored in your account. You put it there; it belongs to you. Legal basis: performance of a contract.

2.3 AI identification data

When you use the AI scanning feature, the photo you take is sent to our AI provider — currently Google (Vertex AI) — for identification. This happens in the region you chose: photos from European accounts are identified in the European Union, and photos from United States accounts in the United States. This applies only to photos you actively scan. The photo is then stored in your Stowbook account, in the same region, as part of the item you created. The text returned by the AI (item name and description) is stored both in your account and in a usage ledger.

The AI is asked for, and is technically constrained to return, only an item name, a short description, a category, a confidence score, and an optional outline of where the item sits in the photo. It is not asked for and cannot return a value, a price, a replacement cost, a condition, an age, or a serial number. The confidence score is coarsened before we store it against the item; the AI's raw reply is kept as part of the scan receipt.

We may change AI providers — including to one hosted on our own infrastructure. We will update this policy, and the list of processors below, before doing so.

Usage ledger: We maintain a log of AI credit usage for dispute resolution — so you can verify that two charges in quick succession were two distinct scans, not the same scan processed twice. A ledger entry holds the timestamp and the item name returned. After 90 days we automatically strip the item name, leaving only the date and the credit count. A more detailed receipt of each scan is kept for you until you delete your account. You may ask us to strip the content from any ledger entry or scan receipt at any time by contacting privacy@stowbook.app.

Legal basis: performance of a contract (AI identification is a paid feature); legitimate interests (dispute resolution record).

Third-party processor: Google LLC (Vertex AI). Google processes the image to return an identification result. We use Vertex AI as an ordinary commercial customer on Google's standard terms, under which Google does not use our customers' content to train its models; Google may retain inputs briefly for abuse detection. Google's handling is governed by its own terms — see cloud.google.com/terms/data-processing-addendum.

2.4 Payment data

If you purchase a subscription or AI credits, payment is handled by the store or processor you bought through — Apple (App Store), Google (Google Play), or Stripe for purchases made directly with us. We do not store your card details. We receive and store a record of the transaction (amount, date, subscription status). Legal basis: performance of a contract; legal obligation (financial records).

Third-party processors: Apple Inc. (see apple.com/legal/privacy), Google LLC (see policies.google.com/privacy), and Stripe, Inc. (see stripe.com/privacy). Where you buy through the App Store or Google Play, Apple or Google is the seller and handles your payment details under its own privacy policy; we receive from them a record of the purchase and its status, including automatic notifications when a subscription renews, lapses, or is refunded. We do not receive your payment details from them.

Financial records kept after account deletion: We keep a record of each purchase you make (a subscription payment or an AI credit pack) for up to 10 years, even after you delete your account. This is a legal requirement under applicable tax and financial record-keeping laws, and we also rely on these records to resolve payment disputes.

Each of these records contains the transaction amount, the currency, the date, the type of purchase, a transaction ID from the payment provider, which provider processed it, which region your account was in, and an anonymous account identifier. It does not contain your name, your email address, or any of your inventory content. Once your account is deleted we remove our own link between that record and you, so we cannot connect it back to you from our own systems. The payment provider keeps its own record of the same transaction under its own privacy policy, and we hold the transaction ID that identifies it there.

2.5 Server logs

We record application logs when our servers handle a request. These can include your account identifier, the operation attempted, timestamps, and error details. They are not linked to your account for any other purpose, are retained for 365 days, and are not individually accessible or deletable.

We separately keep short-lived abuse rate-limit counters for up to one hour, on sign-up, sign-in, password reset, passkey, social sign-in, and the diagnostics the sign-in screen sends before you are signed in. These count against a hashed (not raw) version of your IP address and against the email address being used. We do not record your user agent. Legal basis: legitimate interests (security and operation of the service).

2.6 Infrastructure

Stowbook runs on Amazon Web Services, except for AI identification, which runs on Google Cloud (see section 2.3). When you sign up, you choose whether your data is stored in the United States (us-east-2) or the European Union (eu-central-1). AWS acts as a data processor under a data processing agreement.

What staying in your region means. Your inventory, your photos, and your account data are stored only in the region you chose, and we do not copy them to servers in another region. Photos you scan with the AI feature are identified in that same region too (section 2.3). One thing does leave it, and we would rather say so plainly than imply otherwise:

• Operational alerts and error diagnostics — the notifications that tell us something has broken — are processed in the United States. These carry account identifiers and technical detail. Where a sign-in-related diagnostic would otherwise include your email address, it is partially masked (for example, j****h@example.com) rather than shown in full. They do not carry your inventory content.

2.7 Diagnostics

The app creates a random identifier for each installation — not tied to your device's hardware, and reset if you reinstall — so that diagnostic logs from one installation can be read together. In a released build we collect diagnostics from the sign-in screen before you are signed in, kept for 3 days; and diagnostic logs when you explicitly send them — by tapping "Report to developer" on an error screen, or "Send diagnostic logs" in Settings — kept for 7 days. These go to our own logging system and to no one else. Legal basis: legitimate interests (diagnosing faults).

3. What we do not do

• We do not sell your data.
• We do not serve ads.
• We do not use third-party analytics, tracking, or crash-reporting services on this website or in the app. There is no advertising or analytics SDK in either.
• We do not share your data with any party not listed in this policy.

4. Your rights

If you are in the European Economic Area or United Kingdom, you have the following rights under GDPR / UK GDPR:

• Access: You can request a copy of the data we hold about you.
• Portability: You can export your full inventory at any time, free of charge, from within the app.
• Rectification: You can correct inaccurate data directly in the app, or contact us.
• Erasure: You can delete any item, photo, or your entire account from within the app. Deleting your account permanently deletes your inventory data, photos (including previous versions of them), scan receipts, sharing history, and account data. Beyond the financial records and server logs described below, three things outlive it: anonymous markers recording that the data is gone, kept for 90 days so your other devices stop looking for it; copies inside our operational backups, for up to 35 days; and, only if an email we sent you ever bounced, a one-way hash of your email address in our mail-suppression record, so that we do not try to mail it again. The full bounce record, which contains the address itself, is deleted after 30 days. Anonymous financial transaction records (purchase amounts, transaction IDs, and an anonymous account identifier — no name, email, or inventory content) are kept for up to 10 years to meet applicable tax and financial record-keeping laws and to resolve payment disputes; after your account is deleted these records can no longer be linked back to you by Stowbook. See section 2.4. Server logs cannot be individually deleted but are purged on the standard retention schedule.
• Restriction / Objection: You can ask us to restrict processing or object to processing based on legitimate interests. Contact privacy@stowbook.app.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact privacy@stowbook.app. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. In the EU, find your authority at edpb.europa.eu. In the UK, contact the ICO at ico.org.uk.

5. Data retention

6. Children

Stowbook is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, contact privacy@stowbook.app and we will delete it.

7. Changes to this policy

We may update this policy. If we make material changes, we will notify you by email or by a notice in the app before the change takes effect. The "last updated" date at the top reflects the most recent revision.

8. Contact

Michael Cosby
privacy@stowbook.app