Privacy Policy

1. Who We Are

StashIQ is a mobile application published by Knot Software ("we," "us," or "our"), a company based in Georgia, United States. StashIQ helps plastic scale model collectors browse a product catalog, track their collections, identify kits via barcode scanning, and find retailer pricing.

This Privacy Policy applies to the StashIQ mobile application on iOS and Android (the "App") and any related services. By using the App, you agree to the practices described in this policy.

2. Information We Collect

Information You Provide

• Account information — email address, display name, and password (passwords are managed by Amazon Cognito and are never stored in plaintext by us)
• Collection data — kits you add to your Stash, Wish List, or Built list, including quantity, condition, purchase price, purchase date, and personal notes you enter
• Barcode submissions — when you confirm a product match or submit a new kit, we store the barcode, product details, and any box photo you upload
• Profile information — display name and whether you set your collection to public or private

Information Collected Automatically

• Usage data — screens visited, features used, search queries, and in-app events (collected via Datadog)
• Device information — device model, operating system version, app version, and language settings
• Crash and error reports — technical logs when the app encounters an error (collected via Datadog)
• Ad identifiers — on iOS, your IDFA (Identifier for Advertisers) may be accessed after you grant App Tracking Transparency permission; on Android, the Advertising ID may be used. You may opt out at any time in your device settings

Camera and Photos

The App requests camera access to scan barcodes and photograph kit boxes for submissions. Photo library access is requested only if you choose to import a kit list image. We do not access your camera or photos without your explicit action. Box photos you submit are stored on our servers and reviewed by our team.

Payment Information

All subscription payments are processed through Apple (App Store) or Google (Google Play). We do not receive or store your credit card number or payment details. We receive only a confirmation of your subscription status and tier from the payment platform.

3. How We Use Your Information

• Provide, maintain, and improve the App and its features
• Manage your account and authenticate your identity
• Process and manage your subscription
• Display advertising to free-tier users and measure ad performance (with your consent where required)
• Review user-submitted product data and grow the catalog
• Detect and prevent fraud, abuse, and technical errors
• Comply with legal obligations
• Send you transactional notifications (e.g., email verification, password reset) — we do not send marketing email

4. Third-Party Services

StashIQ uses the following third-party services. Each has its own privacy policy governing how it handles data.

• Amazon Cognito — authentication and user account management
• RevenueCat — subscription management and purchase validation
• Google AdMob — advertising delivery for free-tier users
• Google UMP (User Messaging Platform) — ad consent management (GDPR/CCPA)
• Firebase Cloud Messaging — push notifications
• Anthropic Claude API — AI-assisted barcode identification
• UPCitemdb — barcode lookup service
• Datadog — application performance monitoring and error logging
• Amazon Web Services (AWS) — cloud hosting and image storage

We do not share your personal information with third parties for their independent marketing purposes.

5. Advertising

Free-tier users see ads delivered by Google AdMob. Paid subscribers (Collector, Trader, and Professional tiers) see no advertising of any kind.

On iOS, we request App Tracking Transparency (ATT) permission before accessing your advertising identifier. On Android, the advertising identifier is used in accordance with Google Play policies. You may opt out of personalized advertising at any time in your device settings (iOS: Settings → Privacy → Tracking; Android: Settings → Google → Ads).

In regions subject to GDPR (EU/EEA/UK) or CCPA (California), you will be presented with a consent dialog before any advertising SDK initializes. If you decline targeting consent, you will still see ads in non-personalized mode.

6. Public Collections

If you set your collection to Public, your display name and collection contents are visible to anyone with the link, including unauthenticated visitors. You can change your collection to Private at any time from your account settings, which immediately removes it from public access.

7. Data Retention

We retain your account and collection data for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain it by law (e.g., financial records related to subscription transactions). Anonymized, aggregated data may be retained indefinitely.

8. Your Rights

All Users

• Access — you can view your collection data at any time within the App
• Correction — you can update your display name and collection data within the App
• Deletion — you can request account deletion from the Account screen; we will process the request within 30 days

California Residents (CCPA)

You have the right to know what personal information we collect and how it is used, to request deletion of your personal information, and to opt out of the sale of personal information (we do not sell personal information). To exercise these rights, contact us at privacy@knotsoftware.com.

EEA, UK, and Swiss Residents (GDPR)

You have the right to access, rectify, erase, restrict, or object to processing of your personal data, and the right to data portability. The legal basis for processing your data is performance of our contract with you (account and subscription management), legitimate interests (security, fraud prevention, product improvement), and consent (advertising tracking, push notifications). To exercise your rights or lodge a complaint, contact us at privacy@knotsoftware.com.

9. Children's Privacy

StashIQ is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected information from a child under 13, we will delete it promptly. If you believe a child under 13 has created an account, please contact us at privacy@knotsoftware.com.

10. Data Security

We use industry-standard security measures to protect your information, including TLS encryption for all data in transit, encrypted storage for authentication tokens on your device (iOS Keychain / Android Keystore), and access controls on our servers. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. For material changes, we will notify you within the App. Your continued use of StashIQ after changes become effective constitutes your acceptance of the updated policy.