Privacy Policy

STACK helps you understand, prioritize and act on your work by connecting the apps you already use. This policy explains what STACK collects, why, who it is shared with, and the control you have. We only access an app after you sign in to it and approve access yourself.

What we collect

• Account details: your name, email address and sign-in method.
• Data from apps you connect: only what you authorize. For example, from Google: email subject lines, senders and short previews, calendar event details, and Drive file names and links. From other apps: notifications, tasks, issues, meetings, deals or files, as described on each app's connection screen. STACK does not import passwords, and requests read-only access by default.
• Content you create in STACK: tasks, projects, conversations with STACK AI, and the actions you approve.
• Security records: when an app is connected or disconnected and when a sync fails. These never contain your tokens or message content.
• Calls: who joined a STACK call and when. Audio and video travel directly between participants' browsers; STACK does not record or store them.

How we use it

We use this data only to provide STACK's features to you: showing what needs your attention, answering your questions, preparing actions for your approval, and keeping your connected apps in sync. We do not sell your data. We do not use it for advertising, and we do not use it to build profiles for third parties.

Google user data

STACK's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google data only to provide and improve the user-facing features described above.
• We do not transfer Google data to others except to provide those features, to comply with the law, or as part of a merger or sale with notice to you.
• We do not use Google data for advertising, and we do not allow humans to read it unless you ask us to, it is needed for security or abuse investigation, or the law requires it.
• We do not use Google data to develop, improve or train generalized AI or machine-learning models.

AI processing

When you ask STACK AI a question, the relevant parts of your synced work (for example a few message previews or task titles) are sent to an AI model provider to produce the answer. We use Anthropic (Claude) and, when Claude is unavailable, Google (the paid Gemini API) or Groq. This data is sent only to answer your request. We use only these providers' paid API services, whose terms say they don't use it to train their models. Each person has a daily limit on AI answers.

How we protect it

• Access tokens, API keys and any other credentials for your connected apps are encrypted at rest (AES-256-GCM) and are never sent back to your browser.
• Most connections use the app's official sign-in (OAuth), so STACK never sees your password. Some apps only offer an API key or token you create yourself in that app and paste into STACK. One app (ServiceNow) only supports a username and password; for it we recommend a dedicated read-only account.
• Anything that would send, change or delete something in another app needs your explicit approval first.
• You only see information you are already allowed to see in the underlying app.

Your choices

• Disconnect an app at any time from Integrations. STACK then revokes its access where the app allows it, deletes the stored credentials, and deletes the content it imported from that app.
• Delete synced data from one app without disconnecting it, from that app's panel in Integrations. STACK deletes its copies; nothing is deleted in the app itself, and only new activity is imported afterwards.
• Revoke access yourself in the app's own settings, for example your Google Account's third-party access page.
• Delete your account and data yourself, any time, from Settings. STACK revokes its access to every connected app where the app allows it, then permanently deletes your account, your workspace and everything imported into it.

Sharing and service providers

We share data only with the service providers that run STACK for us, under terms that limit them to providing those services, or when the law requires it. They are:

• Vercel - hosts the website and app.
• Neon - our database, where your account, imported data and encrypted credentials are stored.
• Anthropic, Google (Gemini API) and Groq - AI answers, as described above.
• Resend - delivers sign-in emails, when you sign in by email.
• Stripe - payments, if paid plans are offered. STACK never sees or stores your card number.
• Sentry - error reports, if enabled. Reports describe what broke in the app and are configured not to include your IP address, cookies or message content.
• The apps you choose to connect, which STACK reads from (and acts in only after you approve).

Shared workspaces: if you join or invite others to a workspace, its members can see each other's name, email address and role, plus the tasks, projects and calls in that workspace. Data from your connected apps (email, messages, files, meetings, tasks) and your AI chats stay private to you and are never shown to teammates. Workspace owners and admins can see which apps you have connected, the account and permissions you granted, and whether each connection is working - never the content - and can disconnect an app of yours (for example when you leave the organization), which deletes what STACK imported from it. If you leave or are removed from a workspace, your connections and imported data in it are deleted; tasks you created stay with the team.

How long we keep data

• Data imported from an app is recent working context, not an archive: STACK keeps email from the last 90 days and at most 1,000 messages, 1,000 files and 1,000 tasks per connected app, deleting older copies automatically (never anything in the app itself). Everything imported from an app is deleted when you disconnect it, delete its synced data, leave the workspace, or delete your account.
• Your tasks, projects and AI chats are kept until you delete them or your account.
• Sign-in sessions end after 30 days without use. Short-lived security records, such as rate-limit counters, are cleared within a day.
• Our database provider keeps short-term backups for disaster recovery, so deleted data can remain in those backups for a limited time before it ages out.

Cookies

STACK uses only the cookies it needs to work: one that keeps you signed in, one that remembers which workspace you were last in, and a short-lived one that protects an app connection while you sign in to it. There are no advertising or tracking cookies.

Your rights

You can see and delete your data in the product at any time, as described above. To get a copy of your data, or for any other privacy request, contact us at the address below and we will respond within 30 days.

Children

STACK is a work tool for people aged 16 and over. It isn't directed at children, and we don't knowingly collect their data. If you believe a child has an account, contact us and we will delete it.

Changes and contact

If we change this policy in a meaningful way, we will update the date above and, where appropriate, tell you in the product.

Questions or requests: use the contact option on our website.