Legal
Privacy Policy
Effective November 9, 2026. StackHangar is built so we can't read your secrets. This page explains what we can see, what we collect to run the service, and what you can do about it.
Who we are
StackHangar is operated by Password Dev LLC, a California limited liability company ("we", "us"). We are responsible for the personal information described here. Questions go to hello@stackhangar.com.
This policy covers the website at stackhangar.com and the app at app.stackhangar.com (together, "StackHangar").
What we can't see
Your vault is encrypted and decrypted only on your device, with a key unlocked by your passkeys. We store only the encrypted result. That means we never receive, in readable form:
- your API keys, passwords, tokens and other secret values;
- item names, notes and URLs you save;
- your project names.
To send reminders, our servers keep only an opaque ID and a date for each alert. Alert emails say how many items need attention and when, never which ones.
Because we can't read this data, we can't recover it, search it or hand it to anyone in readable form.
What we collect
Account information
- Email address. Used to sign you in with email codes and to send alerts and account messages.
- Studio list. If you leave your email on the Studio page, we keep that address and when you left it, to tell you when Studio opens. It isn't linked to an account. We keep it until Studio opens or you ask us to remove it.
- GitHub identity, if you choose to sign in with GitHub: the account identifier and verified email addresses GitHub shares with us.
- Passkeys. For each passkey: its public key, credential ID, a usage counter, supported transports, a label you can edit, and when it was created and last used. Passkeys never give us your biometrics or device secrets.
Data you store
- Encrypted vault data: your items, projects, accounts, history and playbook runs, all encrypted on your device before we receive them, plus the encrypted copies of your vault key (one per passkey and one for your recovery key).
- Alert schedules: an opaque ID and a date per alert, and a record of which days we sent you an alert email.
- Unlock sessions: a random device key tied to your signed-in session, kept only while the session is unlocked and for at most 12 hours. On its own it opens nothing.
Agents
- For each AI agent you connect: the name you give it, a hash of its token (never the token itself), which projects it can reach, when it was last used, and the requests and approvals it makes. Agents only ever receive reference IDs, never your secrets.
Activity log
- A record of sign-ins and security events on your account (for example adding a passkey or approving an agent), so you can review them in Settings. Entries hold event types and references, never names or values.
Billing
- If you subscribe, payments are handled by Stripe. We keep your Stripe customer ID and your plan status. We never see or store your card number.
AI explanations
- When you ask for an explanation of a finding or a playbook step, only fixed-list fields leave your device: the finding type, the provider, the item type, the environment, roughly how soon it's due, and the step. Never names, values, notes, URLs, IDs or dates.
- These requests are sent to Anthropic to generate the answer. Answers are cached for 30 days by a hash of the request, shared across users and stored without your user ID. We count your requests to enforce your monthly allowance.
Technical data
- Rate limiting. To stop abuse of sign-in, email codes and the Studio list form, we count requests per IP address and per email address. These counters store only a hash of the IP address or email, never the raw value.
- Hosting logs. Our host, Vercel, processes request data such as IP address, user agent and the page requested to serve the site and protect it from attacks.
Cookies and browser storage
The marketing site (stackhangar.com) sets no cookies and runs no analytics or third-party scripts.
The app uses only what it needs to work:
- Cookies that keep you signed in.
- IndexedDB to hold your vault key, wrapped so it can't be opened without the device key on our server, so you stay unlocked across reloads.
- Local and session storage for preferences such as theme, idle-lock time and a remembered email address, and to finish a GitHub sign-in.
We don't use advertising or tracking cookies.
How we use information
- To provide StackHangar: sign you in, store your encrypted vault, send alerts, run agent approvals and playbooks.
- To bill you for paid plans.
- To keep the service and your account secure, and to prevent abuse.
- To answer your messages and send important notices about your account or these policies.
- To meet legal obligations.
We don't sell your personal information or share it for cross-context behavioral advertising. We don't show ads. We don't use your data to train AI models, and the data we send to Anthropic for explanations contains no personal information.
Service providers
We use these companies to run StackHangar. They process data on our behalf and only for these purposes.
| Provider | What for |
|---|---|
| Supabase | Database and authentication. Stores your account and encrypted vault data. |
| Vercel | Hosting for the website and app. |
| Stripe | Payments, subscriptions and tax for paid plans. |
| Resend | Sending sign-in codes and alert emails. |
| Anthropic | Generating AI explanations from fixed-list fields. |
| GitHub | Sign-in, only if you choose to sign in with GitHub. |
When a playbook pushes a key to Vercel, GitHub or Netlify, your browser sends it directly to that provider using your own token. It doesn't pass through our servers, and that provider handles it under its own terms.
We may also disclose information if the law requires it, to protect our rights or users' safety, or as part of a merger or sale of the business. In every case, your vault stays encrypted and we have no way to read it.
Where data is stored
Our database is hosted in the United States. Our service providers may process data in the United States and other countries. If you use StackHangar from outside the US, your information will be transferred to and processed in the US.
How long we keep it
- Deleted items stay in Recently deleted for 30 days, then are purged automatically.
- Activity log entries are kept for one year.
- AI explanation answers are cached for 30 days, without your user ID.
- Your account. When you delete your account in Settings, we cancel any subscription, delete your Stripe customer record and delete your account along with everything tied to it: vault data, passkeys, alerts, agents and activity log.
- Billing records may be kept by Stripe as tax and accounting laws require.
- Backups and logs. Copies in our providers' backups and logs are removed on their own schedules. Anything from your vault in a backup is still encrypted.
Your rights
You can do most of this yourself in the app:
- See your data. Unlock your vault to view everything in it. Your account details and activity log are in Settings.
- Correct it. Edit any item, or change your email in Settings.
- Delete it. Delete items, or delete your whole account in Settings.
For anything else, such as a copy of the account data we hold, email hello@stackhangar.com from your account's email address. We may need to confirm it's you. We'll reply within the time the law requires, and within 45 days at most.
California residents
Under the California Consumer Privacy Act, as amended, you have the right to know what personal information we collect, use and disclose; to access it; to correct it; and to delete it. We don't sell or share personal information, and we don't use sensitive personal information beyond what's needed to provide the service. We won't treat you differently for using these rights. You can use an authorized agent to make a request; we may ask them to prove they're acting for you.
EEA, UK and Swiss users
We process your information to perform our contract with you (running your account), for our legitimate interests (keeping the service secure and preventing abuse), to meet legal obligations, and, for the Studio list, with your consent, which you can withdraw at any time by emailing us. You have the right to access, correct, delete, restrict or object to processing, and to receive your data in a portable format. You can also complain to your local data protection authority.
Security
StackHangar is designed so a breach of our servers doesn't expose your secrets. Read how on our Security page, including the limits of that design.
Children
StackHangar is for adults running products and businesses. It isn't directed to children, and we don't knowingly collect information from anyone under 16. Our Terms require users to be 18 or older.
Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll tell you by email or in the app before it takes effect.
Contact
Password Dev LLC, doing business as StackHangar. Email hello@stackhangar.com.