Privacy
Privacy Policy
Plain words about what StockShift stores, why, who else touches it, and how you get it back or have it removed. Last updated October 28, 2026.
What we collect
- Account details. Your name, email address and a password. Passwords are stored only as a salted hash by our authentication provider; we never see them.
- Your company’s working data. What your team enters: products and counts, suppliers, customers and their contact details and addresses, orders, shipments, bills of lading, invoices, notes, and the photos and documents attached to cards.
- Change history. Who changed what and when (the audit trail), earlier versions of your workspace (for restore), and a log of the emails StockShift sent on your behalf (recipient, time, kind). These exist so your records can be trusted and recovered.
- Problem reports. When someone uses Help → Report a problem, what they write and what their browser tab saw: the last changes it sent and what the server answered, the messages shown on screen, changes still waiting to be sent, errors in the page, the screen, the app's version and the browser. When the app itself hits an error it sends the same details without a message, a few times a day at most. The server also notes each change it refused (which kind of change, and the reason shown). These exist so we can answer when something goes wrong; they never include passwords, and in StockShift only Stackz can read them. The reports your own team sent come with your company’s complete archive; the errors the app sent by itself, which are about StockShift’s own code, and our notes of refused changes do not.
- Technical data. Standard server logs from our hosting providers (IP address, browser, time, request), used for security and to keep the service running. We do not run advertising trackers or analytics pixels.
How we use it
To run StockShift for your company: show your team its boards, keep inventory honest, create and email invoices when you ask, calculate sales tax from a delivery address, send team invitations and the summary emails you subscribe to, and support you when something goes wrong. We do not sell or rent your data, and we do not use your company’s data to train anything or to market to your customers.
Who else touches it (sub-processors)
- Supabase — database, sign-in and file storage. Data is encrypted in transit and at rest.
- Netlify — hosting for this site and the small server functions behind the app.
- Resend — delivery of invoice, invitation and summary emails. Only the recipient address, the subject and the message text reach Resend.
- TaxJar (only when Stackz turns on live tax rates) — a delivery address’s city, state and ZIP are sent to look up a sales-tax rate. No names, products or amounts are sent.
- Google Fonts — typefaces for these pages; your browser requests them from Google.
Your customers’ information
Customer names, addresses and email addresses that your team enters are your company’s records; we process them only on your instructions, for example to email an invoice when you tick the box. You are responsible for having the right to store those details and to email those people.
Stackz support access
A small number of Stackz staff hold a developer account that can open customer workspaces to set companies up, fix problems and investigate incidents. Every change made that way appears in your audit trail with the person’s name, like any other change.
On your device
The app keeps your sign-in session, its own files and a working copy of your workspace in your browser’s storage, so it opens fast and keeps working offline: once it has been used on a device with a connection, it also opens there without one, and changes made offline are sent when the connection returns. On a shared computer, sign out when you finish: that removes the working copy, unless some changes have not been sent yet. Then the copy stays on that computer with them, and they are sent when you next sign in there. The app’s own files stay too; they hold none of your company’s data. We use no advertising cookies.
Keeping and deleting data
We keep your company’s data for as long as your company uses StockShift. Earlier versions of a workspace are kept for restore (the last 500, and none older than 180 days), and nightly copies for 30 days, and one a month for a year; the log of emails sent is kept for 90 days; problem reports for 180 days and the notes of refused changes for 30 days. An admin can export all records as JSON at any time (Settings → Export); photos and documents can be downloaded from each card, and we hand over a complete archive on request (the records and stock history, every photo and document, the team, the log of who changed what, the summary emails and the problem reports your team sent). A photo or document that no order or truck holds any more (one removed from its card, or a cancelled order’s once Recently cancelled no longer keeps it) is deleted 30 days later, and only once no earlier version kept for restore still shows it. When a company leaves, Stackz removes it on request: nobody can see it from that moment, it can be put back for 30 days, and then its workspace, history, files, nightly copies and seats are deleted; copies in provider backups expire on the providers’ schedules. A person who leaves a company has their seat removed by the company’s admin; their account can be deleted on request to the address below.
Security
Each company’s data is isolated by database rules that every request passes through, not just by the screens. Roles decide who may change what, and the server checks them again. Details are on the Security page. If we learn of a breach affecting your data we will tell the company’s admins promptly and say what we know.
Changes and contact
If this policy changes in a way that matters, we will tell company admins by email before it takes effect. Questions and requests: hello@stackz.co, Stackz, Tulsa, Oklahoma.