Stash

Privacy Policy

Last updated: 2026-09-08

1. What we collect

  • Account: email and Clerk user id (login identity).
  • Brain assets: your voice/profile (my-human), instructions, strategy text you author; CSV imports of past posts.
  • Files & photos: assets you upload to Cloudflare R2 (Pro only).
  • Prompts & conversations: messages you send in Ideate and ⌘K.
  • AI outputs: generated drafts and ritual results.
  • X integration: when you connect X, your OAuth tokens (stored encrypted) and the posts/DMs read for insights and reuse.
  • Payment & usage records: Waffo order/webhook events, credit balance, credit transactions, AI/X-API cost logs.
  • Logs: request and error logs for security and debugging.

2. Why we collect it

  • Login & auth: Clerk manages your session.
  • Generation: prompts and Brain assets feed the AI so drafts match your voice.
  • Storage: drafts, assets, and history so your work persists across sessions.
  • Billing: credits and Waffo payment records meter and prove entitlement.
  • Risk & moderation: prompts/outputs may be screened per our AUP.
  • Support & compliance: email contact and audit logs.

3. Third parties

  • Clerk — authentication (email, user id).
  • Supabase — Postgres database (all content you create).
  • Cloudflare — R2 asset storage, Workers for scheduled rituals, Workers AI Whisper for voice-to-text.
  • Waffo.com Limited — Merchant of Record for payments and refunds; receives your billing email and payment details.
  • AI providers — glm-5.2 (via tokenhub proxy) and deepseek for text; qwen3.7-flash (Alibaba Bailian) for image understanding; prompts and Brain context are sent to generate drafts.
  • X (Twitter) — when you connect, reads your posts/interactions and publishes approved drafts on your behalf.

We do not sell your data. AI providers may retain inputs per their own policies for safety; we send only what is needed to generate your drafts.

4. Data retention

  • Account & content: kept until you request deletion.
  • Payment records: retained by Waffo and in our ledger for accounting/tax needs.
  • Cost & usage logs: kept for billing reconciliation; deletable on request.

5. Your rights

You can access, correct, export, or delete your data. Email support@voicestash.com with your account email. California residents have CCPA rights; EU/UK residents have GDPR rights — we honor both.

6. Cookies & analytics

We use only essential cookies for Clerk authentication. No third-party analytics or advertising trackers.

7. Security

Database access uses service-role with application-layer ownership checks (no public row-level security). X tokens are stored encrypted. We do not store full payment card data — Waffo handles that as MoR.

8. Contact

Privacy questions: support@voicestash.com.