Last updated: 11 October 2026
StackTail is provided by ChainCore Industries OÜ, a company registered in Estonia (registry code 17368514, Kruusa tn 3a, 10911 Tallinn, Estonia) ("we", "us", "our"). We are the controller of the personal data described in this policy.
This policy covers the StackTail apps for iPhone and Android and the StackTail web app at app.stack-tail.com (together "StackTail"). It explains what personal data we collect, why, how long we keep it, who helps us process it, and the rights you have under the EU General Data Protection Regulation (GDPR), the UK GDPR and other applicable privacy laws.
Contact for anything in this policy: contact@chaincoreindustries.com, subject line "Privacy Request — StackTail".
When you create an account we store:
Each phone or browser you sign in on gets a session. For each session we store whether it is a phone app or the web app, the device or browser description your app or browser sends (its "user agent"), when it started and was last renewed, when it expires, and when and why it ended.
In the web app, your session lives on our web server. Your browser only holds a cookie called __Host-st_sid containing a random identifier; the sign-in tokens themselves are encrypted on our server and never reach the web page.
Cookies and browser storage. The web app sets exactly one cookie, __Host-st_sid. It keeps you signed in, is set when you sign in, is removed when you sign out, and ends by itself after 15 minutes without use. It is strictly necessary for the service you asked for, so we do not ask for consent for it, and there is nothing to accept or decline.
If you link a browser to your organizer, that browser also stores the key it received from your phone in its own storage (IndexedDB), so it can open your encrypted backup. It never leaves the browser and is removed when you unlink it.
We set no other cookies: none for analytics, advertising or tracking, and none from other companies.
We store how many AI scan and barcode lookup credits you have left and when your monthly free credits are next added. For each purchase we store the transaction identifiers from Apple or Google, the product, the credits granted and the date. Apple and Google also tell us when a subscription renews, is cancelled or is refunded. Apple or Google processes the payment; we never receive your card or bank details.
When you buy in the Android app, the app gives Google Play an identifier worked out from your account number, which does not reveal the number. It lets us make sure a purchase is only credited to the account that made it.
If you use cloud backups, your phone encrypts your organizer (setups, rooms, storage units, items with their names, quantities, notes, tags, groups and expiry dates, and your photos) with AES-256-GCM before uploading it. Each account has a key of its own. We never receive it.
Where the key is kept:
We store the encrypted files together with technical information needed to manage them: their size and checksum, when they were saved, a version number, which app saved them (iPhone, Android or web), a key fingerprint (it identifies which key was used, but cannot be used to decrypt anything) and, for photos, identifiers and sizes derived in a way that reveals nothing about the photo.
Because we don't have your key, we cannot read your backups, and we cannot restore them for you if you lose access to your key: that is, if none of your devices holds it any more and you don't have your recovery code.
While the app is open with automatic syncing on, it asks our server about once a minute whether another of your devices has saved a newer version. Only the version number is exchanged for that.
If your Pro subscription ends, we keep your encrypted backups for 90 days so you can continue if you subscribe again, then delete them (see section 9).
To open your organizer in a web browser you link that browser by scanning a code with your phone:
For each linked browser we store the name the browser gives itself (for example "Safari on Mac"), the key fingerprint, when it was linked and last used, when the link expires, and when it was removed. These records are deleted 30 days after the browser is removed or its link expires. While a link is being set up we also store the short-lived link request.
A phone that doesn't have your key yet can get it the same way: it shows a code, a phone that has the key scans it and approves, and the key travels encrypted so that only the asking phone can open it. For this we store only the short-lived request.
You can see and remove linked browsers at any time in the app or in the web organizer's settings. The web organizer locks itself after 15 minutes without use (unless you have unsaved changes), and you can lock it at any time. Locking removes the decrypted data from the browser.
We send only emails about your account: email confirmation, password reset, password changed, sign-out notices, account deletion, and notices when a browser or another phone was given your key or such a request was declined. We do not send marketing emails.
Our servers keep technical logs to keep StackTail secure and working: IP address, time, the address requested, the result and the device or browser description. To protect against abuse we also count recent attempts per IP address or per (hashed) account name for a limited time, for example failed sign-ins. The web app also records reports of blocked content from browsers (the page and what was blocked), which helps us detect attacks.
When you use AI photo scanning, the photo you choose is sent to our server and passed to Anthropic for item identification. When you look up a barcode, the barcode number is passed to EAN-Search. We do not store the photos or the barcode numbers.
To read barcodes with the camera, the Android app uses a component from Google (ML Kit). The camera pictures are analysed on your phone and are not sent anywhere. The component itself sends Google technical data for diagnostics and usage statistics: device information (such as manufacturer, model and system version), the app's name and version, an identifier for the app installation, and performance and error figures. We cannot switch this off, we do not receive this data, and Google's privacy policy applies to it.
The iPhone app reads barcodes with Apple's built-in framework, which sends no such data.
To provide StackTail to you (performance of a contract, GDPR Art. 6(1)(b)): creating and running your account, signing you in, credits and purchases, storing and returning your encrypted backups, the web organizer and browser linking, and the emails needed for these (email confirmation, password reset, account deletion).
For our legitimate interests (GDPR Art. 6(1)(f)): keeping StackTail and your account secure, which includes server logs, limits against abuse and security notices such as "password changed" or "a browser was linked"; finding and fixing faults; and defending legal claims. You can object to this processing (see section 10).
To comply with the law (GDPR Art. 6(1)(c)): where we have to keep or hand over information by law.
We do not use your data for advertising or profiling, and we make no automated decisions that have legal or similarly significant effects on you.
We use these providers. Each processes data only on our instructions and under a data processing agreement:
Two companies provide their own services to you directly, under their own terms and privacy policies:
Your account data and encrypted backups are stored in the EU (Frankfurt, Germany). Some providers are based in the USA (Anthropic, Postmark, DigitalOcean as a company, and Apple and Google for their own services). Where personal data is transferred outside the EU/EEA, the transfer is protected by the European Commission's Standard Contractual Clauses (GDPR Art. 46(2)(c)) or, where the provider is certified, the EU-US Data Privacy Framework.
No system is completely secure. If a personal data breach occurs, we notify the supervisory authority within 72 hours where required (GDPR Art. 33) and inform you without undue delay if the breach is likely to put your rights and freedoms at high risk (GDPR Art. 34).
You have the right to:
You can also remove linked browsers yourself at any time, and sign out on all your devices at once: in the web app's menu, or in the app under Profile → Sign Out on All Devices. Resetting your password does the same.
To exercise your rights, email contact@chaincoreindustries.com with the subject "Privacy Request — StackTail". We reply within one month. You can also complain to a data protection supervisory authority: our lead authority is the Estonian Data Protection Inspectorate (www.aki.ee), or you can contact the authority where you live (list of EU authorities).
StackTail is not meant for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.
We may update this policy when StackTail or the law changes. The date at the top shows the latest version. If we make important changes, we will tell you in the app or by email before they take effect.
ChainCore Industries OÜ, Kruusa tn 3a, 10911 Tallinn, Estonia
Email: contact@chaincoreindustries.com
Subject: "Privacy Request — StackTail"