Privacy Policy

Media Stash is operated by QRAXISS LIMITED, a company registered in England and Wales (company number 17394500), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. In this policy “we”, “us” and “our” mean QRAXISS LIMITED, which is the controller of the personal data described here. Contact: support@mediastash.app.

Local & private is the default. Your library, settings, and provider keys stay on your device. We run no server for it, we receive nothing, and there is no account, no analytics, and no tracking.

Account mode is optional. You sign in with an enabled Google, Apple, Microsoft, GitHub, or Discord account to use Media Stash-managed metadata, have a public profile, follow people, receive notifications, back up your library and sync it on one device, and share collections by read-only link. A yearly membership adds sync across multiple devices, collection editors and snapshots, and a hosted calendar subscription URL. Profile pages require a signed-in account to view; collection links can be opened by anyone who has the link. Only account mode sends data to our servers, and only the data described below.

You choose in the setup wizard and can change it any time in Settings. Switching to offline mode never deletes the library on your device.

Your library is stored in your browser (IndexedDB). Backups you export are files you keep; provider keys are never part of a normal backup.

To look up titles, the app calls the metadata providers you configure directly from your device, using your own keys. Today that means TMDB, TVDB, IGDB (through Twitch), and Open Library, and the artwork servers they point to. Those services receive your search terms and your IP address and handle them under their own privacy policies. Media Stash does not proxy or see these requests.

In this mode you are the one dealing with those providers. Review and follow each provider's terms and privacy policy for the keys you use; see the Terms of Service.

If you create an account, we store:

• Sign-in details. Which provider you used (Google, Apple, Microsoft, GitHub, or Discord), the unique ID that provider assigns you, your display name, your email address when the provider shares it and has verified it, and a profile picture URL when available. We never receive your provider password.
• Devices. A random ID for each device you sign in on, its name and platform, and when it was created and last used, so you can see and revoke devices.
• Membership, trials, codes, and gifts. Whether you have a membership or trial, its dates, and where the time came from (trial, code, gift, or purchase). We keep a record of each trial and of each membership code or gift you redeem: which code, which account, and when. If you buy a gift, we store who bought it, whether it was claimed, and the recipient you addressed it to, as a handle or an email address.
• Trial abuse protection. To limit how many trials can be started from one network, we keep a SHA-256 hash of the IP address you sign in from (a one-way hash instead of the address itself) for 180 days, not linked to your account. To keep it to one trial per person, we also keep a one-way hash of your verified email address in a normalized form (lowercase, ignoring “+” tags, and ignoring dots for Gmail addresses) and compare it with earlier trials. Like the hash of your sign-in identity, it is kept after the account is deleted and is not linked to any account.
• Payments Stripe, our payment processor, collects your card and billing details at checkout; we never receive your full card number. We receive and store the Stripe customer and subscription references, the plan, amounts and currency, payment status, and renewal date.
• Your public profile (account mode, once you choose a handle): the handle, a display name you confirm, an optional short bio, your choice of avatar, your visibility level and which parts of the profile you show, who you follow and who follows you, the in-app notifications you receive, and any report you send about another profile. See Your public profile, handle and following.
• Social links (optional, once you have a handle). Up to eight links to your accounts on the platforms we list, such as X, Instagram, or YouTube. We store each link as normalized and the platform it belongs to, and show them on your profile unless you hide that part.
• Profile snapshot (once you have a handle). Whenever your numbers change, your app publishes the counts behind At a glance and the titles and descriptions of your unlocked milestones. We keep only the latest snapshot, and it replaces the one before. The snapshot carries only how many titles your stash holds; the stash list on your profile (below) comes from your synced library.
• Synced library data (when sync is on): favorites and the star ratings you gave them with the text of your personal reviews and whether each is public, watch and reading progress, collections and their items, and followed creators. Review text is stored on our servers for a signed-in account, private reviews included, so it reaches your other devices; we never show a private review to anyone else. Your provider keys and app settings are not synced.
• Release reminders and Web Push. For signed-in accounts with release reminders enabled, we calculate upcoming releases and next unwatched episodes from synced favorites and progress. The reminder setting is shared across the account. For each device that opts in to browser notifications, we store its push endpoint, browser-supplied encryption keys, time zone, and account/device association to deliver account notifications and release reminders. Browser permission and the push subscription belong to that device.
• Shared collections (only if you share one): the collection's name, description, icon, and its titles (provider, media type, ID, title, poster, release date), who you add and their role, and the link settings. See Shared collections and public links.
• Metadata requests. When you use Media Stash-managed metadata, your searches and title lookups are sent to our server, which asks the metadata providers on your behalf using our own keys and caches the results. The providers see our server, not you.
• Feedback you send. Your message, its category, an optional contact you type, and basic context (app version, platform, language, current screen). If you are signed in, the report is linked to your account.

We also process technical data to keep the service running and safe: your IP address is used to rate-limit requests and abuse, and we keep only a salted hash of it for that purpose, not the address itself. Our hosting provider, Cloudflare, may log request metadata such as IP address and URL under its own terms. Our own logs contain technical details such as a request ID and error text, never your tokens or library content.

On your device, your sign-in session is kept in the secure storage the platform provides where available. Stored refresh tokens on our side are hashed.

In account mode you choose a handle. The handle is public: it is how other people find you and open your profile. Local & private mode never asks for one and has no profile.

You decide who can see your profile. There are two levels:

• Public (the default). Other Media Stash users can find you by handle or display name (unless you hide it) in search, follow you, and see the parts of your profile you leave switched on.
• Private. Your profile cannot be found, viewed, or followed. Opening your handle only shows that the profile is private, together with the handle.

Moving to Private removes all of your followers, and your follower and following counts and the Follow button disappear. We ask you to confirm before that happens.

You can hide At a glance, Ratings, Stash, or Collections in profile settings. Each collection can also be hidden separately, independently of whether you share it. Your bio and social links appear when saved; clear your bio or remove links to take them off your profile. At a glance shows your current streak and how many movies and episodes you have watched, series you have completed, books you have read, games you have played, titles your stash holds, and collections you have. Your stash is shown on your public profile by default: the titles in it, newest first, and whether you plan, are in the middle of, or finished each one. If your account existed before public stashes, your stash stays hidden until you choose to show it. Archived titles are never shown, and neither are episodes, pages, dates, or other progress details. You can hide the whole stash at any time, and a private profile shows none of it. Your followed creators, watch history, episode progress, activity log, detailed statistics, and personal notes are never shown on a profile, except as activity you turn on yourself (below), and neither is your email address.

Activity. Your profile can also show activity to the people who follow you and to anyone who opens your profile: titles you add to your stash, star ratings, titles you finish, and collections you share (by name; when a collection is open to anyone with its link as a viewer, the name links to it, and a restricted or editor link is never shown). Every kind of activity is off until you turn it on in Settings → Profile, one kind at a time, and turning one on shares only what you do afterwards. Turning it off, hiding your Ratings, or making your profile private removes what was shared at once. Deleting a title, rating, or share removes its activity, and deleting your account removes all of it. A private profile shares no activity.

Ratings and reviews. Star ratings are part of your synced library and appear on your profile while Ratings is shown. You can hide them in profile settings. Review text is public only for reviews you make public: a new review is public unless you choose Only me, and a review written before public reviews existed stays private until you choose. A public review shows with your rating on your profile and on that title's Ratings tab while your profile is public and Ratings is shown. For a signed-in account, the text of every review you write, private ones included, is synced with your library and stored on our servers; we publish only the reviews you made public, and making a review private again, or deleting it, unpublishes it. A private review is never shown to anyone else. Without an account, review text stays on your device. Ratings and reviews are never part of a shared collection.

Ratings on titles. While your profile is public and Ratings is shown, your star rating counts toward a title's community rating, an average shown once at least five people rated it; the average never names anyone. Signed-in people with a handle can react to a public review with one of a few emoji; reactions show as counts, not names. Anyone can report a review to us, and we can take it down. Deleting your account deletes your public reviews and your reactions.

• Avatar. By default your sign-in provider's profile photo becomes your public avatar once you have chosen a handle, so anyone who can see your avatar can see that photo. You can switch to your initials, or remove the photo, at any time in Settings → Profile.
• Display name. It is filled in from your sign-in provider, you confirm or change it before it becomes public, and you can hide it so only your handle shows.
• Following. Following is one-way and needs no approval. We store who follows whom, and show the lists to others only while your counts are not hidden.
• Notifications. We keep an in-app inbox for events such as someone following you, changes to a shared collection, or a handle change made by us. We do not send these by email today.
• Changing your handle. You can change it once every 30 days. Your old handle is held for 90 days so nobody else can take it, and its profile address forwards to the new one during that time.
• Reports. You can report a profile, a shared collection, or a review. We use the report only to review it and act on it, for example by changing a handle, hiding a profile, or taking a review down. We do not tell the person you reported who reported them.

Sharing a collection is optional and needs an account. Nothing is shared until you choose to. A shared collection is shared data: it is stored on our servers, and the people you share it with, or anyone who has its link, can see it.

• What is shared. Only the collection's name, description, and icon, and for each title its provider, media type, ID, title, poster, and release date, plus your public display name and avatar where your profile settings allow it. Your watch progress, ratings, notes, reviews, and status are never shared.
• People you add. You add people by handle. To help you pick the right person, the sharing screen confirms only the handle for a private profile; it does not show that person's name or photo. People on a shared collection can see each other's handle and role. A public profile may also show its display name and photo according to its settings. A person can leave or decline at any time.
• Anyone with the link. A link page is public to anyone who has the link, with no account needed to look at it. Treat the link like a password: do not post it anywhere you would not want the collection to be seen. You can make a link expire or revoke it at any time. Revoking stops new visitors; people who already opened or copied the collection keep what they have. A private profile or a hidden profile collection does not disable a separate collection link.
• Snapshots. A snapshot is a frozen copy of a collection at its own public link. Later changes to your collection never change it. You can revoke the link, but a snapshot cannot be edited.
• The link page itself sets no cookies and uses no analytics, ads, or tracking. It is not indexed by search engines and asks browsers to send no referrer. The page loads poster images straight from the artwork servers our metadata providers use, so those servers see the visitor's IP address. Like every request to our servers, opening it is rate-limited using a salted hash of the IP address, and Cloudflare may log request metadata under its own terms.
• Deleting your account. Your participation in other people's collections and the shares you own stop being visible at once. A collection you owned is not lost for the people using it: the first editor to have joined becomes its owner, and if there is no editor, people who still have access keep a read-only copy and the share becomes a snapshot with no owner name or avatar. Snapshots you published yourself are deleted, and a share nobody can reach any more is removed within 30 days.
• Reports and removal. You can report a shared collection. We may take one down if it breaks our acceptable use rules; a taken-down link stops working.

Making a copy of a shared collection creates an ordinary collection on the visitor's device, with no account needed, and nothing is sent back to us.

With Google we request only the basic OpenID scopes (openid, email, profile) to identify your account, show your name and picture, and keep your verified email as a contact detail. We do not read your Gmail messages, contacts, Drive, or any other Google data. With Apple we request your name and email. Microsoft sign-in requests openid, profile, and email; Microsoft may omit an email or provide one that is not verified, and we store it only when verified. GitHub sign-in requests read:user and user:email for your basic profile and email addresses. Discord requests identify and email. For both, we store an email only when the provider marks it verified. Provider access tokens used to read a profile are discarded after sign-in.

Media Stash's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your email is never used to find or merge accounts: accounts are matched only by the provider's unique ID.

You can revoke Media Stash's access from the connected-app settings at the provider. That stops new sign-ins; to remove your data from our servers, delete your account as described below.

We use account data only to:

• sign you in and keep your session secure;
• sync your library and serve managed metadata for signed-in accounts when enabled;
• calculate release reminders from synced favorites and progress, and deliver them to opted-in devices;
• show your public profile to the people you allow, and let people find and follow you;
• show the collections you share to the people and links you choose;
• manage trials, membership, codes, gifts, and payments, and stop repeated trials;
• prevent abuse and keep the service reliable;
• read and respond to the feedback and support requests you send us.

We do not sell your data, show ads, build advertising profiles, or use third-party analytics or tracking in the app or on shared-collection pages.

Only the service providers needed to run the service, each acting on our behalf:

• Cloudflare hosts our API and database.
• Google, Apple, Microsoft, GitHub, and Discord authenticate you when you sign in.
• Metadata providers (TMDB, TVDB, IGDB, Open Library) receive the title search terms and IDs needed to answer managed-metadata requests or calculate release reminders, without your account details.
• Browser push services route encrypted Web Push notifications and receive the delivery metadata needed to reach your subscribed devices. They cannot read notification contents.
• Stripe processes membership and gift payments. It receives the card and billing details you enter at checkout and the account reference we need to match the payment to your account.

Your handle, and the parts of your profile you leave switched on, are visible to other Media Stash users as described in Your public profile, handle and following; that is your choice, not something we share with a service provider.

We may disclose data if the law requires it.

We keep account data while your account exists. You can delete your account in Settings → Account. Deleting does not erase it on the spot: the account is frozen for 30 days. It is hidden and unreachable at once, including your public profile and avatar, and every session on every device ends. Your library on your device is not touched. If you sign in again within the 30 days you can cancel the deletion and the account returns as it was. If you do not, the account is permanently deleted when the 30 days end, and the account and its synced data, including your profile, your follows, notifications, release reminder settings and targets, push subscriptions, and feedback you sent while signed in, are removed from our database.

An administrator can also freeze an account, for example to stop abuse. It follows the same 30 days, but if the administrator locked it you cannot cancel the deletion yourself; you can contact us at support@mediastash.app if you think it was a mistake.

• Your email address and the date of deletion are kept for 12 months after the permanent deletion, and then removed. We keep them only as a record that we carried out your erasure request, so we can answer a dispute or a regulator. They are not used for anything else, are not used to contact you, and are not linked to any other data about you.
• Your handle is held for 90 days after the permanent deletion, so nobody can take it straight away and pass as you, and is then released. While the account is frozen the handle is not available to anyone else either. The hold stores only the handle and the date it ends, nothing that identifies you. The same 90-day hold applies to the old handle after you change it.
• If you used a free trial, we keep a one-way hash of your sign-in identity so the same identity cannot claim another trial. It cannot be turned back into your identity or email.
• Hashes of sign-in IP addresses used for trial abuse protection are deleted after 180 days.
• The email address a gift was addressed to is deleted 12 months after the gift is claimed or cancelled, or sooner when the account that claimed it is deleted. While a gift is unclaimed we keep the address, because it is what lets the recipient redeem it. If the buyer deletes their account, the address goes at once for gifts already claimed or cancelled, and 12 months after purchase for a gift still unclaimed.
• Payment records are kept as long as tax and accounting law requires, even after the permanent deletion.
• Short-lived technical records are removed automatically: sign-in attempts after a day, expired session tokens after about a week, rate-limit counters after about two days, sync de-duplication records after 180 days, and cached metadata when it expires.
• Backups held by our hosting provider age out on its schedule after the permanent deletion. Signing in again after the permanent deletion creates a new, empty account.

If a trial or membership ends, you stay signed in with a free account. Paid features are suspended, never deleted, and managed metadata continues when available. Nothing on your device is deleted. Switching to offline mode is your choice.

You can use Media Stash with no account, export your library as a backup at any time, switch from account mode to offline mode, choose who can see your profile or make it private, hide any part of it, and delete your account yourself.

Depending on where you live (for example under the GDPR, UK GDPR, or California law), you may also have the right to access, correct, delete, restrict, or port your data, to object to processing, and to complain to your data protection authority. Email support@mediastash.app and we will respond within a reasonable time, normally within 30 days. We may need to confirm it is really you.

Where the GDPR applies, we process account data to provide the service you asked for (contract), to secure it and prevent abuse (legitimate interests), and, for optional things like the contact detail you type into feedback, with your consent.

Traffic to our servers uses HTTPS. Sign-in uses the OAuth device-style flow with PKCE and a confirmation code, access tokens are short-lived, refresh tokens rotate and are stored hashed, and revoking a device or deleting an account takes effect immediately. No system is perfectly secure, so we cannot guarantee absolute security. If you find a vulnerability, please tell us at support@mediastash.app.

Our hosting provider runs a global network, so your data may be processed in countries other than your own. Where required, we rely on appropriate safeguards offered by our providers, such as standard contractual clauses.

Media Stash is not directed to children under 13 (or the minimum age of digital consent where you live, if higher), and we do not knowingly create accounts for them. If you believe a child has created an account, contact us and we will delete it.

When we make a meaningful change we will update the date above and, for changes that materially affect your data, notify you before they take effect. Questions or requests: support@mediastash.app.

Using the service is also subject to our Terms of Service.