Stacked

Privacy policy

Last updated: 12 October 2026
Version 2026-10b

This policy has two parts: the Stacked app and the website and wishlist.

Who we are

Stacked is run by Lucas Williams, an individual in the UK. Lucas is the data controller under UK GDPR. Contact: 50400.studios@gmail.com.

The Stacked app

What we store on our servers

When you use a Stacked account, these are stored on our servers (run by Supabase):

  • Your name and email address.
  • Your password, stored scrambled by Supabase. We can't see it.
  • When you confirmed you're 18 or over and agreed to the terms.
  • What you enter: income, expenses, categories, subscriptions, savings, Cards & loans, IOUs (including names you type for other people), work expenses and invoices (including client details you type), My business tags, notes, challenges, payday nudges, inbox messages and your settings.
  • Two-step sign-in, if you turn it on: the authenticator key is kept by Supabase's login service. We never see your codes.
  • Your devices: for each phone you sign in on, a random device id, the phone's name and model, Android version, app version and when it was last used. This lets you see where you're signed in and sign out everywhere else.
  • Sign-in security records kept by Supabase's login service (for example sign-in times and IP address) to protect your account.

What stays on your phone

  • Receipt and IOU photos and PDF receipts.
  • Receipt scanning. The text is read on your phone; the images aren't sent anywhere.
  • Notifications and home screen widgets.
  • App lock. Your fingerprint or face is checked by Android and never reaches Stacked. Your PIN is kept on your phone, scrambled.
  • The block screenshots setting. Nothing is sent.

The only time photos and PDF receipts leave your phone is when you use Move to a new phone: they're uploaded so your new phone can download them, and deleted after 7 days.

Why we use it

  • To provide the app you signed up for. Our lawful basis is contract.
  • To keep accounts secure, including your devices list, the bot check and sign-in security records. Our lawful basis is legitimate interests.

We don't use your data for ads and we never sell it. The app has no analytics or tracking.

Who helps us

These companies process data for us, under contracts that keep it safe:

  • Supabase: the database and login (servers in London).
  • Resend: Supabase's login service sends account emails through Resend, like confirming your email, resetting your password, or telling you your password or email changed.
  • Cloudflare: hosts this website, and runs the bot check (Turnstile) when you sign up or sign in, which looks at your device and connection to tell people from bots. See Cloudflare's Turnstile privacy addendum.

Some of these companies may handle data outside the UK, for example for support. When they do, they use approved safeguards such as the UK International Data Transfer Addendum.

How long we keep it

Until you delete your account. Delete all my data in the app removes it from our servers straight away. We don't keep backups of it.

Your rights

  • Get a copy: use Export all my data in the app, or email us.
  • Correct anything that's wrong.
  • Delete your data: see Delete your account.
  • Object to how we use it.
  • Complain to the Information Commissioner's Office (ICO) at ico.org.uk. We'd like the chance to fix things first, so please contact us too.

We'll reply within one month.

Age

Stacked is for people 18 or over.

Changes

We'll tell you in the app before any material change to this policy.

The website and wishlist

What we collect

  • Your email address.
  • Which phone you have (Android, iPhone or both).
  • The features you ticked, if any.
  • Where you came from, if the link you used said so (for example a short code like "reddit").
  • When you signed up and when you confirmed.
  • A scrambled code made from your connection (a one-way hash of your IP address). We can't turn it back into your IP address. It's only used to stop spam signups.

Why we use it

To email you when Stacked launches on your phone and with the odd important update (like a change to this policy), and to learn which features people want most. Our lawful basis is your consent, which you give by joining and confirming your email. The scrambled connection code is used under our legitimate interest in keeping the list free of spam.

Who helps us

These companies process data for us, under contracts that keep it safe:

  • Supabase: stores the waitlist (servers in London).
  • Resend: sends our emails.
  • Cloudflare: hosts this website, runs the spam check (Turnstile) and gives us visit counts (Web Analytics, which doesn't use cookies or track you across sites).

Some of these companies may handle data outside the UK. When they do, they use approved safeguards such as the UK International Data Transfer Addendum.

We never sell your data or share it for advertising.

How long we keep it

Until 12 months after Stacked launches, or until you remove yourself, whichever comes first. Then it's deleted.

Your rights

  • Access: ask us for a copy of what we hold about you.
  • Deletion: use the "Remove me" link in any of our emails, or email us.
  • Correction and withdrawing consent at any time.
  • Complain to the ICO at ico.org.uk.

Cookies

This website uses no cookies and no advertising or tracking scripts.

We count visits ourselves without cookies: the page, what happened (a view, starting the signup form or tapping an app store link) and a visitor code for the day that can't be linked to you afterwards. See the 50400 Studios privacy policy for how it works.

Changes

If this policy changes, we'll update the date at the top. Big changes will be emailed to people on the list.