Skip to main content

Privacy Policy

Last updated: April 26, 2026

Information We Collect

When you use Stax, we may collect the following types of information:

  • Account Information: Name, email address, password, and profile details you provide when creating an account
  • Financial Information: Bank account balances and transaction data (accessed via Plaid), payment information (processed via Stripe)
  • Travel Goals: Destinations, savings targets, travel dates, and trip preferences
  • Usage Data: How you interact with our app, including features used, pages visited, and actions taken
  • Device Information: Device type, operating system, and app version
  • Communications: Messages you send us and feedback you provide
  • Profile content: Your @username, optional bio (max 80 characters), avatar image, home city, and visited countries you choose to add to your Country Stack
  • Profile reports: When you report another user's profile, we collect the report reason, optional details you provide, and (if you are signed in) your user ID. Anonymous reports include only the report content.

How We Use Your Information

We use your information to:

  • Provide, maintain, and improve our services
  • Track your savings progress and help you reach your goals
  • Process contributions from family and friends
  • Send you updates about your stacks, contributions, and milestones
  • Provide AI-powered trip cost estimates
  • Process cashback rewards from affiliate bookings
  • Communicate about new features and service updates
  • Ensure security and prevent fraud
  • Comply with legal obligations

Third-Party Services

Stax integrates with trusted third-party services to provide our features:

  • Plaid: We use Plaid to securely connect to your bank accounts and retrieve balance and transaction information. We never see or store your bank login credentials. Plaid's use of your data is governed by their privacy policy. Please review Plaid's End User Privacy Policy for more information.
  • Stripe: We use Stripe to process payments for contributions to stacks and to facilitate payouts to stack owners. Payment card information is handled directly by Stripe and is not stored on our servers. Please review Stripe's Privacy Policy for more information.
  • Affiliate Partners: When you book travel through our affiliate partners (such as Booking.com or Viator), your booking information may be shared with those partners to process your reservation and calculate cashback rewards.
  • Anthropic: We use Anthropic's AI technology to power trip cost estimates and travel planning features. When you create a stack or request a cost estimate, trip details such as destination, dates, and travel preferences may be processed by Anthropic's API. No bank account data, financial credentials, or transaction history is shared with Anthropic. Please review Anthropic's Privacy Policy for more information.

Data Security

We take the security of your data seriously and implement industry-standard measures to protect it:

  • All data is encrypted in transit using TLS/SSL
  • Sensitive data is encrypted at rest
  • We never store your bank login credentials
  • Access to user data is restricted to authorized personnel only
  • Regular security audits and monitoring

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Data Retention

We retain your personal data only as long as necessary to provide our services and fulfill the purposes described in this policy.

  • Account information: Retained for the duration of your active account. Upon account deletion, your data is soft-deleted immediately and permanently removed after 30 days.
  • Bank connection data (Plaid access tokens): Retained until you disconnect your bank account or delete your account, at which point tokens are revoked via Plaid's API and purged from our database.
  • Transaction history: Retained for the duration of your active account and deleted when your account is permanently removed.
  • Financial records related to Stripe payments: Retained for 7 years as required by applicable tax and financial regulations.
  • Server logs: Automatically rotated and purged after 90 days.
  • Database backups: Automatically expired after 30 days via lifecycle policy.

Public Profiles

Profile pages at stax.cash/@username are public by default — anyone with the link can view your name, avatar, bio, badges, Country Stack, public Stacks, and aggregate Stack Backers totals. We do not provide search, browsing, or directory features at launch — pages are reachable only via direct URL share.

You can control your profile's visibility from Settings → Privacy:

  • Make profile private — only people who hold a valid invitation link to a Stack you own (sent via the in-app share / invite flow) can see your profile. Anonymous visitors and invitees of other users cannot.
  • Hide my city — your home city won't appear on your public profile
  • Hide my contributions — the "Stack Backers" aggregate totals won't appear on your public profile

We strip image metadata (including any embedded GPS coordinates) from avatars on upload. Profile pages include a noindex meta tag, instructing search engines not to crawl them at this time.

Inspired metric and attribution

When you add a destination to your wanderlist or create a Stack from another user's Stax Passport, we record the source profile's user ID alongside the resulting entry as inspired_by_user_id. This powers the source user's aggregate Inspired count on their public profile and the "Inspired by @username" line on your own entries (visible only to you).

  • Default ON. At the moment of action we show a "Credit @username for inspiring this" checkbox. It is pre-checked. Uncheck it before you confirm and no inspired_by_user_id is recorded.
  • Aggregate display. The source user sees a count and per-destination totals. They never see your name, handle, or any identifying data tied to the inspired entry.
  • Inspired-by line. On your own wanderlist and Stack detail surfaces, an "Inspired by @username" line shows the source user. This is private to you. Other visitors to your profile do not see it.
  • Retention. Attribution data persists for the lifetime of the entry. Deleting a wanderlist entry or Stack also deletes its attribution. We do not separately store attribution events.

Source users with a private profile still capture attribution data internally. Display of their Inspired count follows the same privacy controls as the rest of their profile.

User Content and Reporting

Stax allows users to add a bio (maximum 80 characters), an avatar image, a username, and visited countries to their profile. We prohibit objectionable, abusive, illegal, or impersonating content.

You can report another profile using the Report this profile button on any stax.cash/@username page (and via the iOS app Settings). We aim to review reports within 24 hours and will remove or restrict content that violates our content policy when we determine such action is appropriate. Reporters may be authenticated or anonymous; we record the report reason, optional details, and (if signed in) the reporter's ID.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request that we correct inaccurate or incomplete data
  • Deletion: Request that we delete your personal data (you can delete your account at any time through the app)
  • Portability: Request a copy of your data in a portable format
  • Opt-out: Unsubscribe from marketing communications at any time
  • Disconnect: Disconnect your linked bank accounts at any time through the app

To exercise any of these rights, please contact us using the information below.

Children's Privacy

Stax is not intended for users under the age of 18. We do not knowingly collect personal information from anyone under 18 years of age. If we become aware that we have collected personal data from a user under 18, we will take steps to delete that information promptly. If you believe we may have inadvertently collected information from a minor, please contact us at privacy@stax.cash.

California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you.
  • Right to Delete: You may request that we delete your personal information, subject to certain exceptions.
  • Right to Opt-Out: You may opt out of the sale of your personal information. Stax does not sell your personal information to third parties.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise any of these rights, please contact us at privacy@stax.cash. We will respond to verifiable requests within 45 days.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: privacy@stax.cash