StashApp Privacy Policy
Last updated: 21 September 2026
StashApp is a personal budgeting app for Android. It helps you split your income into pockets and see what's safe to spend. This policy explains what we collect, why, and what we don't do with it.
StashApp never holds or moves your money. Your money stays in your M-Pesa wallet or your bank account, where it always was. StashApp is a record of what you've decided to do with it — it isn't connected to any bank or payment provider, it cannot make a payment on your behalf, and it doesn't know your real balance. Everything it shows you is worked out from figures you entered yourself.
We've written it to describe what the app actually does today, not what it might do one day. If that changes, this page changes with it.
Who we are. StashApp is operated by Sharon Mbae, based in Kenya. Questions about this policy or your data: info@sharonmbae.vortanafresh.co.ke.
What we collect
Information you give us
| What | Why | Where it's stored |
|---|---|---|
| Phone number | It's how you sign in, and where verification codes go | Our servers |
| Name | Shown in the app so it feels like yours | Our servers |
| PIN | Unlocks your account | Only ever as a hashed value — see below |
| Profile photo (optional) | Shown on your profile | Our servers, private storage |
| Income amount | Calculates your Safe-to-Spend balance | Our servers |
| Pockets — names, targets, due dates | The budgets you set up | Our servers |
| Transactions — amounts, dates, descriptions | Your spending record | Our servers |
Information created automatically
- Account identifier — a random ID linking your data to your account
- Timestamps — when records were created or changed
- Currency preference — currently Kenyan Shilling for everyone
- Subscription status — if you subscribe to Premium, whether it's active and when it renews
What we do not collect
- Your PIN. It's converted to a bcrypt hash before storage. We can't read it, recover it, or tell you what it is. If you forget it, you reset it.
- Your fingerprint or face. If you turn on biometric sign-in, your device does the check and tells the app yes or no. Biometric data never reaches the app or our servers.
- Your contacts, location, camera, or microphone.
- Your other text messages. See below.
- Analytics or usage tracking. There is no analytics SDK in StashApp. We don't record which screens you open, how long you spend in them, or whether you've opened the app at all.
- Crash reports. Not collected today. If we add crash reporting, this page will say so before it ships.
- Advertising identifiers or device fingerprints. There is no advertising in StashApp. We don't collect your device model, advertising ID, or anything else that could identify your phone, and we don't track you across other apps or websites.
M-Pesa and bank messages
There are two ways to add M-Pesa and bank transactions, and you choose which:
- Share or paste a message. Share a confirmation message to StashApp from your Messages app, or paste it in. StashApp sees only that one message.
- Sync automatically (optional, Android only). If you turn this on, StashApp asks for Android's permission to read text messages, after explaining what it will do. It then reads only transaction messages from M-Pesa and the banks StashApp supports (the app lists which): it asks your phone for messages from those senders specifically, so your other messages, including anything from a phone number, are never opened. New messages are picked up when you open the app and wait for you to check them.
Either way, the message is read on your phone. Nothing is added to your budget until you check it and choose a pocket. Only what you save becomes a transaction: the amount, the date, who it was with, and the transaction code (used to spot duplicates). The message text itself is never uploaded to our servers or shared with anyone.
You can turn automatic sync off at any time in Settings → Message sync, and remove the permission completely in your phone's settings. Transactions you've already saved stay until you delete them or your account.
Notifications
The bell in the app shows things worth knowing — a pocket due soon, income you logged, a target you've reached. These are worked out on your phone from data already in the app.
If you allow notifications, StashApp also reminds you on the day a pocket is due. These reminders are scheduled on your phone too: we don't send push notifications, there's no device token, and nothing about what you do in the app is sent anywhere to produce them. You can turn them off in your phone's settings.
Why we process your data
Under Kenya's Data Protection Act 2019 (and the GDPR, if you're in Europe), we process your data on these bases:
- To provide the service you asked for — you can't have a budgeting app without storing your budget. Covers your account, pockets, transactions and income.
- Security — hashing PINs and locking accounts after repeated wrong attempts protects you from someone else getting in.
- Your consent — for optional things like a profile photo or biometric sign-in. You can withdraw it by removing the photo or turning the setting off.
- Legal obligation — where we're required to keep records.
We do not process your data for advertising or profiling, and we do not sell it. Not to anyone, for any price.
Who else touches your data
We use these providers to run the service. They process data on our instructions and may not use it for their own purposes.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, accounts, file storage | Ireland (EU) |
| Nena Solutions | Sending your sign-in verification codes by SMS | Kenya |
| Expo | Building and updating the app | United States |
| RevenueCat + Google Play | Premium subscriptions, if you subscribe | United States |
Verification codes. When you sign up, reset your PIN, or sign in on a new device, we text a one-time code to your phone through Nena Solutions. Nena receives only your phone number and that message — never your name, your PIN, or anything about your budget.
Apart from Nena Solutions, these providers are outside Kenya, so your data is also stored and processed abroad — your account and budget data sits in Ireland. We rely on each provider's standard contractual protections for those transfers, as the Data Protection Act 2019 requires.
Google Play handles subscription payments. We never see your card details — we only learn whether a subscription is active.
How it's protected
- Traffic between the app and our servers is encrypted (HTTPS/TLS).
- Your sign-in session is stored in your device's secure hardware store — the Android Keystore — not in ordinary app files.
- Every record is scoped to your account by database-level rules, so one account cannot read another's data.
- PINs are bcrypt-hashed. Five wrong attempts locks the account for 15 minutes.
- Profile photos are in private storage, reachable only through a short-lived link issued to you.
No system is perfectly secure, and we won't pretend otherwise. If a breach affects your data, we'll notify you and the Office of the Data Protection Commissioner as the law requires.
How long we keep it
Your data stays while your account exists.
Delete your account — Settings → Delete Account — and your profile, pockets, transactions, income and photo are permanently deleted from our servers. This is immediate and cannot be undone. We keep no shadow copy.
Our database provider keeps rolling backups for a short period, so deleted data may persist in those for up to 7 days before they cycle out.
Your rights
Under the Data Protection Act 2019 you can:
- See what we hold about you
- Correct anything wrong — most of it is editable in the app
- Delete your account and data, from Settings
- Object to or restrict how we use it
- Take your data elsewhere in a portable format
- Withdraw consent for anything optional
- Complain to the Office of the Data Protection Commissioner (odpc.go.ke) if you think we've mishandled it
Email info@sharonmbae.vortanafresh.co.ke and we'll respond within 30 days.
Children
StashApp isn't for under-18s and we don't knowingly collect their data. If you believe a child has an account, contact us and we'll remove it.
Changes
If we change this policy we'll update the date above and, for anything significant, tell you in the app before it takes effect.
Contact
Sharon Mbae — Kenya Email: info@sharonmbae.vortanafresh.co.ke
Data Protection Commissioner: odpc.go.ke
See also our Terms of Service, which cover the rules for using StashApp.