Privacy policy

The short version

• You can organize entirely in your browser without creating an account
• Signing in sends account information and workspace data to the hosted service for backup and sharing
• Stowplan does not sell personal information, show advertising, or use advertising or analytics trackers
• You can export your workspace, remove browser copies, leave shared workspaces, delete online workspaces you own, and delete your server account
• The service uses functional storage and security cookies, including Cloudflare bot-protection cookies

Information Stowplan handles

Workspace information

Workspace information includes the names and codes you give rooms, cabinets, drawers, boxes, and other spaces; item names, quantities, descriptions, categories, tags, conditions, dimensions, and placement preferences; move plans; Activity and undo history; membership and invitation records; and synchronization records. This content can include personal information if you choose to enter it.

Without an account, workspace information stays in this browser's IndexedDB storage unless you export it or intentionally send it elsewhere.

After you sign in, Stowplan attempts to create or update an online copy of the open workspace and to upload waiting changes from other local workspaces. A workspace remains browser-only until a backup succeeds.

Account and sign-in information

If you use Google sign-in, Google provides a stable account identifier, email address, and display name after you approve the sign-in. Stowplan requests only the openid, email, and profile scopes. Stowplan does not retain Google's access token, refresh token, or ID token after sign-in completes.

The service stores account and security records such as internal identifiers, linked sign-in identities, role and account status, the accepted Terms version and acceptance time, session-token hashes, session and sign-in times, browser or device descriptions, shortened network prefixes, invitation records, quota records, and security or administrative audit events. The raw Stowplan session value stays in a secure, HTTP-only browser cookie.

Hosting and security information

When you visit the hosted service, your browser sends request information such as its network address, requested path, time, browser headers, and security signals to OpenAI and Cloudflare so they can deliver and protect the site. In Stowplan's application database, session and security records use a shortened network prefix and limited browser description rather than a full stored network address, but provider logs may contain additional request data.

Information from other people

A workspace owner may invite you. After you accept, workspace owners can see the display name and email address associated with your Stowplan account and can manage your membership. Viewers and editors cannot open the ordinary member list. Other users may also enter information about people in workspace content. Anyone entering another person's information is responsible for having an appropriate reason to do so and providing any notice the law requires.

Why this information is used

Stowplan uses information to provide local organizing, online backup, synchronization, collaboration, invitations, account and session controls, exports, recovery, administration, security, abuse prevention, service limits, troubleshooting, and legal compliance. It is not used for advertising, marketing profiles, or automated decisions that have legal or similarly significant effects.

Where data-protection law requires a legal basis, the basis depends on the activity: providing features you request; the legitimate interests of operating, securing, and improving a small hosted service; compliance with legal obligations; or consent when consent is specifically requested. You can avoid optional account processing by using Stowplan without signing in.

Information received from Google is used only to authenticate and administer your Stowplan account. Stowplan's use and transfer of that information follows the Google API Services User Data Policy, including its Limited Use requirements.

Browser storage and cookies

Stowplan uses browser storage and cookies needed to provide features you request, remember your choices, and protect the service. It does not use non-essential advertising or analytics cookies. The Google sign-in form asks separately before allowing the session cookie to remain after the browser session.

Cloudflare Turnstile also examines browser and network signals when you start Google sign-in so it can distinguish people from abusive automation. Read Cloudflare's Turnstile Privacy Addendum and cookie documentation for details.

Because Stowplan does not track activity across unrelated services for advertising, browser "Do Not Track" and Global Privacy Control signals do not change its behavior.

Who can receive or access information

• Workspace viewers, editors, and owners can read online workspace content, subject to their workspace role
• Workspace owners can see member names and email addresses and can manage membership
• Database-authorized Stowplan administrators can inspect, export, administer, or delete online workspaces without being workspace members, and can explicitly add themselves as an owner
• People authorized by Strange Lasers to access infrastructure may access information when needed to operate, secure, recover, or support the service
• OpenAI hosts the Sites service and processes hosted information on the operator's behalf, using its listed subprocessors
• Cloudflare provides delivery, security, bot protection, and hosted database infrastructure
• Google provides optional sign-in and receives the information involved in that sign-in
• Information may be disclosed when required by law, to protect people or the service, or as part of a service transfer with appropriate notice and safeguards

Stowplan does not sell or rent personal information. It does not share personal information for cross-context behavioral advertising. OpenAI's processing of hosted data is described in the ChatGPT Sites Data Processing Addendum and its subprocessor list.

Retention and deletion

• Browser copies remain until you remove them or clear this site's browser data
• Online workspace content remains while the workspace exists; an owner or administrator can delete the online workspace immediately through Stowplan
• Account profiles and linked identity information remain while an account is active or disabled; account deletion or banning redacts those records, subject to the retained non-secret records described below
• A normal app session expires after 30 days even when its browser cookie ends sooner, and its server record becomes eligible for cleanup 30 days later; OAuth sign-in lifecycle records become eligible 24 hours after their 10-minute expiry, and invitation records become eligible 30 days after expiry
• Security and administrative audit events have no automatic expiry and may be retained indefinitely; Terms acceptance versions and times, non-secret deletion receipts, and keyed abuse-prevention digests may also remain as long as needed to preserve service integrity, prevent abuse, resolve disputes, or meet legal obligations
• Hosting logs, security records, and provider backups follow provider retention rules and may persist after an in-app deletion until they age out of protected systems

If you leave a shared workspace or an owner removes you, your server membership and online access end, but the workspace and content you added remain available to remaining members. Any copy already stored on your device is retained read-only and is no longer backed up until you export or remove it.

Deleting a server account removes sign-in identities, revokes sessions and unused invitations, removes workspace memberships, and redacts retained security records. It does not delete shared workspace content that remains available to other members. It also does not erase workspace copies or queued work stored on your devices; remove those copies separately on each device. Deleting an online workspace removes its live contents, memberships, and invitations, while retaining a non-secret deletion record and relevant audit facts.

Your choices and privacy rights

Stowplan provides controls to export workspace data, edit workspace content, remove a browser copy, revoke sessions, leave a shared workspace, delete an online workspace you own, delete your server account, and remove Google consent separately. Use Settings for exports and recovery, Workspace access to leave, Workspaces and backup status to remove a device copy, and Account and sessions to revoke sessions or delete your server account. The account and data guide explains the effect of each action.

Portable JSON exports contain workspace content and available history. Full recovery bundles also contain waiting or refused device changes and their error details. Downloaded files are copies under the holder's control and are not deleted or revoked when you leave a workspace, lose membership, or delete an account or online workspace.

Depending on where you live, you may also have rights to request access, correction, deletion, restriction, objection, or a portable copy of personal information, and to withdraw consent where processing relies on consent. You may lodge a complaint with your local data-protection regulator. To make a request or ask for reconsideration of a response, email [email protected]. The operator may need to verify your identity and may retain information when the law permits or requires it.

Security and international processing

Stowplan uses measures such as HTTPS, secure and HTTP-only session cookies, hashed session values, workspace-scoped authorization, shortened network prefixes, audited administrative actions, bounded resource allocation, and export and recovery controls. No service can guarantee absolute security, so keep your own exports and avoid entering information you do not need Stowplan to hold.

The hosting providers and their subprocessors may process information in the United States and other countries. Those countries may have different privacy laws from your home country. Provider contracts and legally required transfer safeguards apply where available, but this Sites deployment does not promise that data remains in a particular country.

Children and sensitive information

The official hosted service is a general household organization tool and is not directed to children under 13 or the minimum digital-consent age where they live. If you believe a child provided personal information improperly, contact the operator so it can be reviewed and removed.

Do not use the official hosted service for payment-card data or protected health information subject to HIPAA. Avoid storing passwords, government identifiers, precise financial information, or other sensitive personal information in item names, descriptions, or shared workspaces.

Changes and contact

This policy will be updated when the service's data practices materially change. The effective date at the top will change, and additional notice will be provided when required.

For privacy questions or requests, contact Strange Lasers at [email protected]. Do not send passwords, session values, invitation links, or workspace exports by email.