StashSMSPrivacy Policy
Last updated:
This policy explains what the StashSMS Android app and this website do with your information. "We", "us" and "our" mean 9punk.dev (9punk LLC), the maker of StashSMS.
The short version
- Your messages, contacts, PIN and settings stay on your device. We do not run any server that receives your messages.
- There are no accounts and no sign-in.
- There are no ads, no analytics and no crash-reporting tools in the app.
- The app's only network traffic of its own is GIF search through KLIPY, and only when you open the GIF picker.
- Stash hides conversations inside StashSMS only. It does not delete or encrypt them, and other apps and backups can still show them.
1.Who we are and what this policy covers
StashSMS is an Android app for SMS and MMS messaging, made by 9punk.dev (9punk LLC). This policy covers the StashSMS Android app and this website, stashsms-website.web.app.
StashSMS works as your phone's default SMS app. Android only lets the default SMS app send and store text messages, so the app has to hold that role to work.
This policy is linked from the StashSMS listing on Google Play and from the app's settings.
2.What the app accesses and why
StashSMS asks only for the Android permissions below. Everything it reads stays on your device, apart from the cases listed in the last column.
| Permission | What it's used for | Does it leave the device? |
|---|---|---|
SMS: send, receive, readSEND_SMS, RECEIVE_SMS, READ_SMS | Core texting as your default SMS app: showing your conversations, receiving new texts and sending the texts you write. | Only the texts you send, which travel through your carrier to the people you text. Never to us. |
MMSRECEIVE_MMS | Receiving and sending picture and group messages. | Only through your carrier's MMS service, to and from the people you text. Never to us. |
Contacts: readREAD_CONTACTS | Showing contact names and photos instead of bare phone numbers. | No. |
Contacts: writeWRITE_CONTACTS | Saves or edits a contact when you choose to do so from a conversation. Not used otherwise. | No. |
Phone stateREAD_PHONE_STATE | Identifying your SIM and carrier settings, which Android needs to send and receive SMS and MMS. | No. |
Make callsCALL_PHONE | Places a call to a contact from inside a conversation when you tap the call button. Never used without a tap. | The call goes through your carrier as a normal phone call. Nothing is sent to us. |
NotificationsPOST_NOTIFICATIONS | Showing new-message notifications. Stashed conversations raise none while Stash Mode is on. | No. |
Run at startupRECEIVE_BOOT_COMPLETED | After a reboot, re-schedules any pending scheduled messages and resumes MMS downloads and retries. | No data leaves the device. |
InternetINTERNET | GIF search and GIF loading through KLIPY. Nothing else. | Yes, to KLIPY, only when you use the GIF picker. See Third-party services. |
Photos and filesNo permission | Android photo and document pickers; no storage permission; only the item you pick is attached. | Only when you send it, through your carrier, to the people you text. If you choose to save a received image, it goes to your phone's Pictures folder, where other apps can see it. |
Scheduled messages use Android's inexact alarms, so the app does not need the exact-alarm permission. The app does not request any Call Log, location, camera, microphone or storage permission.
SMS permissions and Google Play policy
StashSMS requests SMS permissions under the default SMS handler exception of Google Play's Permissions policy for SMS and Call Log. It requests no Call Log permissions. SMS and MMS data is used only to provide the core function of a default SMS app. It is never transmitted to us, never sold, never shared and never used for advertising.
3.The Stash feature and PIN
When you stash a conversation, StashSMS marks it as stashed. With Stash Mode on, that conversation leaves the StashSMS inbox, raises no notifications, and can only be opened in StashSMS's Stashed inbox after you enter your PIN.
Your PIN is stored only on your device. It is never sent to us, so we cannot see it, reset it or recover it. When you set up the PIN, the app offers you a recovery code. If you forget the PIN and have that code, you can choose a new PIN. Resetting Stash without the PIN permanently deletes the stashed messages from your phone. Without the PIN or the recovery code, the Stashed inbox cannot be opened, and we cannot open it for you.
The list of stashed contacts, your PIN and your app settings are excluded from Android's cloud backup and device-to-device transfer. The messages themselves are not, as explained below.
4.Third-party services
KLIPY (GIFs)
GIF search is optional. The app contacts KLIPY only when you open the GIF picker. At that point it sends KLIPY:
- the text you type into the GIF search, and the GIFs you open or load;
- your device's language and country setting, so results match your region;
- your IP address, which every internet request reveals.
We do not send KLIPY any account, device or user identifier, and the app uses a generic user agent rather than your phone's model. No message content, contact or phone number is ever sent. KLIPY handles this data under its own privacy policy.
We use no other third-party services in the app: no advertising networks, analytics, crash reporting or tracking.
5.Data we collect on this website
This website is a static site hosted on Google's Firebase Hosting. We don't use cookies, analytics or tracking on it. Like any web host, Firebase Hosting automatically logs basic request data, such as your IP address, browser user agent and the pages requested, for security and operations. Google keeps these logs under its own retention schedule and the Google Privacy Policy.
The site loads fonts from Google Fonts, which means your browser requests them from Google's servers.
6.Data sharing and selling
We do not sell or share your personal information, and we do not use it for advertising. Because your messages and contacts never reach us, we have nothing of yours to hand over. We would disclose information we hold only if the law required us to, and in practice we hold none from the app.
7.Data retention and deletion
- App data (your PIN, the list of stashed contacts and your settings) lives only on your device. Uninstalling StashSMS deletes it.
- Your messages live in your phone's shared SMS/MMS storage, not in StashSMS. Uninstalling StashSMS does not delete them, and they will appear in whichever messaging app you use next. To delete messages, delete them in a messaging app.
- To bring a conversation back, open it in the Stashed inbox and choose Unstash.
- To reset a forgotten PIN, choose "Forgot PIN?" and enter your recovery code. Resetting Stash without the PIN permanently deletes the stashed messages from your phone. Copies may remain in backups, other apps, with your carrier and on other devices.
StashSMS has no accounts and keeps no data on any server, so there is no server-side data to delete. This is how StashSMS meets Google Play's account and data deletion requirements.
8.Security
App data is kept in StashSMS's private storage, which Android's app sandbox keeps from other apps. The app's own network traffic goes to KLIPY over HTTPS only. Your messages themselves are not encrypted by StashSMS; they are stored in the same shared SMS/MMS database every Android messaging app uses. No method of storage or transmission is 100% secure, and we can't guarantee absolute security.
9.Children
StashSMS is not directed at children under 13, and we do not knowingly collect personal information from children. The app sends nothing to us in any case. If you believe a child has given us personal information, contact us and we will delete it.
10.Your rights
European Economic Area, UK and Switzerland (GDPR)
You have the right to access, correct, erase and port your personal data, and to object to or restrict its processing. Where we process personal data at all, we rely on performance of a contract (providing the app you chose to use) and our legitimate interests (running a secure website). Because we hold no server-side data from the app, most of these rights are exercised directly on your device: you can view, edit, export or delete your own messages and settings at any time. You can also complain to your local data protection authority.
California (CCPA/CPRA)
We do not sell or share personal information, as those terms are defined in California law, and we offer no financial incentives tied to personal information. You have the right to know, delete and correct personal information, and we will not discriminate against you for using these rights.
Other regions
If the law where you live gives you other privacy rights, contact us and we will honor them.
11.International users
The app runs locally on your phone, and your messages stay there. This website is hosted on Google infrastructure, which may be located in the United States or other countries. KLIPY may process GIF requests in other countries under its own policy.
12.Changes to this policy
When we update this policy, we will change the "Last updated" date at the top of this page. For material changes, we will also note the change in the app or on this site.
13.Contact
Questions or requests about privacy:
contact@9punk.dev
9punk.dev (9punk LLC)