Last updated: March 5, 2026
Stache, a product of SAS Labs, which is a brand of SAS Ventures, a trade name of SAS Integrators LLC ("we", "our", "us"), respects your privacy. This policy describes what data we collect, how we use it, and your rights regarding that data. Stache is currently available to users in the United States only.
Stache does not sell, rent, or trade your personal financial data. Financial information collected through the service is used solely to provide the features and functionality of the application.
When you sign in with Google, we receive your name, email address, and profile photo. We do not receive or store your Google password.
We use Stripe to process subscription payments. When you subscribe, Stripe collects payment-related information including your name, billing address, email address, and payment method details. Stripe may also collect device, network, and fraud prevention data as described in Stripe's Privacy Policy. For Stripe payment processing, Stache acts as the data controller for the personal data you choose to provide, and Stripe acts as a data processor on our behalf. Stache does not store full payment card numbers.
Transactions, accounts, categories, receipts, statements, and other financial data you enter into Stache. This data is stored securely and is only accessible to you or anyone you choose to share it with.
When you link a financial account through Plaid, Stache collects only the minimum financial data necessary to provide budgeting, reconciliation, and financial reporting features (such as account names, balances, transaction history, and account identifiers). Stache does not receive or store your financial institution login credentials. Authentication is handled entirely by Plaid. This data is accessed only with your explicit consent and is used solely to provide financial tracking features within Stache. Plaid processes data in accordance with its own Privacy Policy. If you disconnect a linked financial account, Stache deletes the Plaid connection credentials and stops retrieving new financial data. Financial records already imported into your account remain available as part of your personal financial history. For more information, see the Account Deletion section in the Terms of Service and the Data Retention section below.
Uploaded receipts and statements are stored in secure cloud storage. Receipt images may be processed by AI (Anthropic Claude or Apple Intelligence) for text extraction. Your data is never used to train AI models. See Section 4 below for details on AI processing.
You are solely responsible for the content you upload. We discourage uploading highly sensitive data unrelated to financial record-keeping. We are not responsible for any regulatory obligations related to sensitive data you choose to store in the service.
We do not sell, rent, or share your personal or financial data with third parties for marketing purposes. We do not use your data for advertising or profiling.
When you upload receipts or financial documents, or add transactions through a voice shortcut (e.g., Siri), Stache may use artificial intelligence to extract structured information such as merchant name, date, and transaction amount. Depending on your device, AI processing may occur on-device or through a cloud service.
Your data is never used to train AI models.Anthropic's commercial API terms explicitly prohibit using customer data for model training. Apple's on-device processing does not transmit data externally.
Your data is stored in Supabase (hosted PostgreSQL) with:
While we implement industry-standard security measures, no system is 100% secure. We encourage you to maintain your own backups. For additional information about Stache's security practices, please see our Security Overview.
We use the following third-party services that may process your data:
Stache uses only essential cookies for authentication session management. We do not use tracking cookies, analytics cookies, or advertising cookies. Because we only use strictly necessary cookies required for the service to function, no cookie consent banner is required. Stripe may set technical cookies or similar identifiers necessary for secure payment processing and fraud prevention. These are not used for advertising or analytics.
You have the right to:
To exercise these rights, use the in-app Settings page or contact us.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
Categories of personal information collected: Identifiers (name, email), financial information (transactions, account data you enter), internet activity (authentication sessions). We collect this information directly from you. We do not collect information from third-party data brokers.
We retain your data for as long as your account remains active. When you request account deletion, your account enters a 30-day grace period during which you may cancel the deletion and restore your account. After the grace period expires, personal data, financial records, and uploaded files are removed from active systems. Data is removed from backup systems within 30 days thereafter. We do not retain backup copies of deleted accounts beyond 60 days. Payment transaction records may be retained as required for tax, accounting, or regulatory compliance. When you disconnect a linked financial account through Plaid, Stache removes the connection credentials and stops retrieving new financial data. Financial records that were already imported into your account remain part of your personal financial history until you delete them or delete your account.
In the event of a data breach affecting personal information, we will notify affected users in accordance with applicable law. Notification will be provided via the email address associated with your account and, where appropriate, through in-app notice.
Stache is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children.
We may update this privacy policy from time to time. We will notify users of material changes through the application. Continued use after changes constitutes acceptance.
For questions about this privacy policy, your data, or to exercise your privacy rights, contact us at support@stache.finance.