Privacy Policy

When you choose “Connect Gmail”, Google asks you to give Stash read-only access to your Gmail account (the gmail.readonly permission). Stash uses it only while you run a scan:

• It searches your mailbox for emails that look like gift cards, eGift deliveries, gift card balances and redemption receipts. Other emails are never opened.
• From each matching email it reads the sender, date, subject and message text, and finds the store, amount, card number, PIN, expiry date and any “view your gift card” link.

Stash never sends email, deletes email, changes labels, reads attachments or looks at your contacts.

Only to show you your gift cards: the store, amount, code, PIN, expiry date and whether a card looks already used.

We do not use Gmail data for advertising, sell it, use it to build a profile of you, or use it to train AI models. No person at Stash reads your email. The only exceptions are if you ask us to look at a problem with your account and give us permission, if it is needed for security (such as investigating abuse), or if the law requires it.

Stash relies on a small number of service providers. Each only gets what it needs to do its job:

• Anthropic (AI provider). The sender, date, subject and text of each matching gift-card email (up to about 12,000 characters) are sent to Anthropic’s API so its AI model can pull out the card details. We use Anthropic’s commercial API, whose terms don’t allow this data to be used to train its models.
• Google. Handles your sign-in and provides read-only access to your Gmail.
• Vercel (hosting). Runs the website and the scan. Like any web host, it handles technical request data such as your IP address. Our server logs record counts and errors, not your card numbers, amounts or email contents.

We don’t sell or share your data with anyone else.

On our servers: nothing from your inbox. Each scan reads the matching emails, extracts the card details, sends the results to your browser and keeps nothing.

In your browser, on your device: your wallet is saved in your browser’s local storage so it’s there next time and so Stash can count down to expiry dates. This includes:

• Cards found in Gmail: store, amount, card number, PIN, expiry date, any balance found, and a reference to the original email so you can open it in Gmail.
• Plastic cards you scan: the details you confirm, and a small photo of the card’s front.
• Your own notes about cards: what you marked as used, purchases you logged, and cards you marked “not mine”.

This data never leaves your device unless you send it somewhere, and anyone who can use your browser can see it. On a shared computer, use “Clear all gift cards” when you’re done.

Cookies: Stash uses two strictly necessary cookies and no tracking or advertising cookies.g_state protects the Google sign-in and expires after 10 minutes.g_token holds the temporary Google access token for your scan. It expires within about an hour, or immediately when you disconnect.

Plastic card scanning uses your camera only while the scanner is open. The barcode is read on your device, and the photo is not sent to us.

• Disconnect Gmail: use “Disconnect Gmail” in your wallet. Stash revokes its access at Google straight away. You can also remove Stash at myaccount.google.com/permissions.
• Delete your cards: use “Clear all gift cards” at the bottom of your wallet, or clear this site’s data in your browser settings. Because we keep nothing on our servers, this removes everything.
• Questions or requests: email lucamoreno12@gmail.com. We’ll answer within 30 days.

Stash doesn’t track you across other websites and doesn’t use tracking or advertising cookies, so it works the same whether or not your browser sends a “Do Not Track” signal. We don’t sell or share personal information.

If you live in California, you can ask what information we have about you or ask us to delete it by emailing lucamoreno12@gmail.com. Because your cards are stored only in your own browser, “Clear all gift cards” deletes them immediately.

All traffic to Stash is encrypted (HTTPS). Gmail access is read-only and limited to what a scan needs. The Google access token is kept in a secure cookie that the page’s own scripts can’t read. The site sends strict security headers, including a Content Security Policy, to block injected scripts.

Stash is not meant for children under 13, and we don’t knowingly collect their information.

Stash’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If we change how Stash handles your data, we’ll update this page and the date at the top. If a change affects your Gmail data, we’ll ask for your permission again before it applies.