Privacy Policy

Last updated: 9 September 2026

Stache ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect, where it is stored, who else processes it, and the rights you have over it.

What data we collect

Account and identity:

• Your name, either typed by you or supplied once by Apple or Google when you use social sign-in
• Your email address, from the account you sign up with

Financial information you enter:

• Expenses you log — amount, merchant, category, date, and an optional note
• Categories you create and the budget you set for each
• Your monthly budget, optional monthly income, and preferred display currency

Account and usage state:

• Whether your subscription is active
• Counts of how many receipt scans, AI insights, and statements you have used, so free-tier limits can be enforced
• Anonymous product analytics events (see Analytics below)

What stays on your device

Some data never reaches our servers at all:

• Receipt images. Photos of receipts are stored only on your device. They are sent to Google's Gemini API at the moment you scan one, so the details can be read, and are not saved on our servers afterwards. We do not operate any image storage.
• Your profile photo. If you set one, it stays on your device and is never uploaded.
• Monthly statements. Statement PDFs are generated on your device and shared using your phone's own share sheet. We never receive a copy.

How we store it

The data listed above under account, financial and usage information is stored using Supabase, a cloud infrastructure provider, in data centres located in the EU (Frankfurt, Germany). Data is encrypted in transit and at rest, and access is restricted to your own account by database-level security rules.

Third parties we share data with

Google Gemini API — when you scan a receipt, the image is sent to Google's Gemini API to extract the shop, total, date and category. When you request an AI insight, a summary of your spending is sent: your total spent, your budget, and per-category totals in rands. Individual transactions, merchant names and notes are not included in insight requests. Stache uses the free tier of the Gemini API, which means that, under Google's standard terms for unpaid API services, Google may use data submitted to the API to improve its products and services.

PostHog — we use PostHog for product analytics, to understand which features are used and where people get stuck. PostHog processes this data on servers in the United States. The only identifier attached to an event is your Stache account ID: no name, email address, merchant, note text or monetary amount is ever included. Events record actions and categories only, such as that an expense was added and which category it used, that a paywall was shown, or that a purchase completed. Session recording is disabled, and automatic capture of taps and screen views is disabled.

RevenueCat — we use RevenueCat to manage Stache Premium subscriptions. RevenueCat receives your purchase and subscription status, identified only by your Stache account ID. We do not send your name or email address to RevenueCat. Your payment card details are handled entirely by Apple and are never shared with RevenueCat or with us.

Apple — Apple processes all payments for Stache Premium. If you use Sign in with Apple, Apple provides your name and email address, and you may choose to hide your real address behind Apple's private relay service, in which case we never see it.

Google Sign-In — if you sign in with Google, Google provides your name and email address to create your account.

Subscription data

Payment processing for Stache Premium is handled entirely by Apple. We do not receive, process, or store your payment card details or any other payment information. We store only whether your subscription is currently active.

Your rights

You can delete your account and all associated data at any time directly from within the app (Profile → Delete Account). You may also contact us to exercise any other rights you have over your personal information, including access, correction, or objection to processing.

Data retention

We retain your data for as long as your account is active. When you delete your account, your profile, expenses, categories and usage records are deleted from our database immediately and permanently, your login is removed so the account can no longer be used, and the receipts and profile photo held on your device are cleared. Deletion cannot be undone and there is no recovery window, so export a statement first if you want to keep a record.

Analytics events already sent to PostHog are not tied to your account after deletion, because they are linked only to an account ID that no longer resolves to a person.

POPIA compliance

Stache is committed to complying with the Protection of Personal Information Act (POPIA) of South Africa. For the purposes of POPIA, Stache is the "responsible party" for your personal information. We process personal information lawfully, only for the purposes described in this policy, and take reasonable technical and organisational measures to keep it secure. You can access, correct, or delete your information at any time. Complaints can be directed to South Africa's Information Regulator.

Because Gemini and PostHog process data outside South Africa, your personal information is transferred abroad as described above. We rely on these providers' own contractual and technical safeguards for those transfers.

Contact us

If you have any questions about this Privacy Policy or how your data is handled, contact us at hello@stache.co.za.