Stack'd Development Studio

Stack'd · Privacy Policy

Nothing leaves your device, unless you link a bank.

Stack'd is a privacy-first personal finance tracker. Everything you record stays on your device by default: the app has no user accounts and no data collection. The one optional exception is Bank Connect, which fetches transactions from a bank you choose to link through a licensed provider and the Stack'd server. This policy explains how your data is, and is not, handled, in both cases.

Last updated: September 9, 2026 · Applies to Stack'd on Android, iOS and the web build · See also the Terms of Use

  1. The short version

    Without Bank Connect, Stack'd does not collect, transmit, sell or share any personal data: nothing leaves your device. If you turn Bank Connect on, the transactions of the bank accounts you link travel from your bank, through Enable Banking and the Stack'd server, to your device, and the server keeps a small technical record of the link and your subscription, nothing else. Clauses 3 and 4 spell this out.

  2. What is stored, and where

    Your accounts, transactions, budgets, loans, tags and settings are stored exclusively in your device's local storage. They are never sent to a server; apart from Bank Connect, the app works fully offline. Bank statement files you import are read entirely on this device. The file itself is not kept; only the transactions extracted from it are stored, in the same local storage as everything else. Transactions fetched through Bank Connect are stored the same way, on your device, only after you confirm the import. Your device also keeps an opaque token that identifies it to the Stack'd server, held in the device's secure storage on Android and iOS. If you buy Stack'd Pro, the unlock is recorded on this device only, with the transaction identifier the store issued for it.

  3. Bank Connect: what travels, what is kept

    When you link a bank, the Stack'd server receives from Enable Banking, and passes to your device, the booked transactions and balances of the accounts you selected. The server does not store them and does not log their contents. What the server keeps, until you disconnect: an opaque owner and device identifier; for each linked bank, an opaque connection reference, the bank's name, the last four digits of each account's IBAN, its currency and its name; and your subscription status with the identifier the store issued for it. No names, addresses or bank credentials are held. These records are deleted when you disconnect the bank or, after a subscription ends, 14 days later. The server runs in the European Union, on Cloudflare infrastructure restricted to EU jurisdiction. While you use Bank Connect the server also sees your device's IP address and browser identifier: it uses them to limit abuse and passes them to Enable Banking and your bank, which the payment-services rules require for online access; they are not kept in your link record.

  4. Recipients and legal basis

    Data is exchanged with: your bank, which authenticates you and shares the account data you consent to; Enable Banking Oy, Otakaari 5, 02150 Espoo, Finland, a registered account information service provider supervised by the Finnish FIN-FSA, which obtains the data from your bank under your consent and its own terms and privacy notice; Apple or Google, which process the subscription and the one-time Stack'd Pro payment under their own terms; and Cloudflare, Inc., which hosts the Stack'd server as a processor with EU data residency. Bank Connect data is processed to perform the service you request (GDPR Art. 6(1)(b)); nothing is sold, shared for advertising, or used for any other purpose.

  5. What the app does not do

    No user accounts or registration. No cloud sync, and no backup that we run or can read; your phone's own backup (Google or Apple, under your account) may include the app's data, and you can exclude Stack'd in your device's backup settings. No uploading of imported files. No analytics or usage tracking. No advertising or ad identifiers. No selling or sharing of data with anyone beyond the Bank Connect recipients above, and only when you turn that feature on. No cookies beyond the local storage the app needs to function.

  6. GDPR position

    Under the EU General Data Protection Regulation (Regulation (EU) 2016/679): for everything you record or import in Stack'd, the developer does not process your personal data. It stays on your device, under your sole control, and no controller–processor relationship arises. For Bank Connect, the developer (Stack'd Development Studio, contact below) is the controller of the technical records listed in clause 3, processed to perform the service you subscribe to (Art. 6(1)(b)), hosted in the EU and retained as described there; Enable Banking Oy acts under its own responsibility as a licensed provider for the connection to your bank. The transactions themselves only transit and are never retained by the developer.

  7. Your rights, built in

    The GDPR data-subject rights are satisfied directly in the app: access and portability (Art. 15 and 20): export everything as CSV from Others & Settings; rectification (Art. 16): edit any record at any time; erasure (Art. 17): delete individual records, erase everything with Factory Reset, or disconnect a bank to have the server-side records of that link deleted. For anything about the Bank Connect records the app cannot do itself, write to hi@stackdplatform.com; you also have the right to lodge a complaint with your data protection authority.

  8. Security

    Because your data lives on your device, it is exactly as secure as the device itself. We recommend protecting your device with a screen lock, keeping its system updated, and storing CSV backups in a safe place. Anyone with unrestricted access to your unlocked device can view your data. Imported and fetched bank data is as sensitive as the statements it came from, and CSV exports contain it too, so store backups accordingly. Bank Connect uses encrypted connections throughout and a device token that lets only this device read its own links.

  9. Children

    Stack'd is not directed at children. The app has no user accounts and no way to identify its users; the only records kept about you are the Bank Connect technical records described above, and that feature is meant for adults who hold the bank accounts they link.

  10. This website

    This website is a set of static pages. It sets no cookies, runs no analytics and embeds no third-party scripts. When you arrive from another site, it reads the language your browser asks for, to open the page in that language; nothing about it is stored. Our hosting provider may keep standard, short-lived server logs (such as IP address and requested page) for security and capacity purposes, as any web host does.

  11. Contact

    If you email feedback to hi@stackdplatform.com, your email address and message are used only to respond to you and are never added to any marketing list. Data-protection questions can be sent to the same address.

  12. Changes to this policy

    This policy was updated on the date above to describe Bank Connect, an optional feature; the app asks for your explicit confirmation before the feature makes its first connection, and again whenever this policy changes. Any future change to how data is handled will be announced the same way, before anything leaves your device.