Privacy & Terms

What we collect

• Account info. When you sign in with Google, we receive your name, email, and a provider-issued identifier from your OAuth profile.
• Documents you upload. The file contents (HTML, Markdown, PDF, DOCX, PPTX, XLSX, app bundles, and the ~30 text and code formats we render), the names you give them, version history, and any descriptions you provide.
• Session info. A per-device session record (your browser's user agent string, IP at login time) so you can revoke sessions individually.
• MCP client info. When you authorize an AI agent (Claude, ChatGPT, etc.) the agent's client name and the device that authorized it, so you can revoke individual integrations.
• Server logs. Standard request logs including IP addresses, used for security and debugging. Rotated regularly.
• Usage analytics. How you interact with DocStash (pages visited, features used, performance signals) so we can improve the product and debug issues. Once signed in, this data is associated with your account so we can support you and reproduce bugs. We never share it for advertising.

Why we collect it

• To provide the service. Authenticate you, store your documents, version them.
• To let you manage sessions and connected agents from settings.
• To debug and protect against abuse.

We do not sell your data, run advertising trackers, or send marketing emails.

Aggregated and de-identified data

We may use, publish, or share aggregated or de-identified information. This data cannot reasonably be used to identify you and does not include the contents of your documents, the names you give them, or any descriptions you write.

Cookies

We set one essential cookie, ds_session, which is httpOnly, Secure, and strictly necessary to keep you signed in. We also use a small number of analytics cookies (from our usage-analytics sub-processor) to understand how the product is used. We don't use advertising or third-party tracking cookies.

Third parties

DocStash runs on these sub-processors:

• Supabase handles authentication and file storage. See supabase.com/privacy.
• Google Cloud Run hosts the API and MCP services. See Google Cloud privacy notice.
• Vercel hosts our web surfaces (the marketing site, the product app, and the public viewer). See vercel.com/legal/privacy-policy.
• Google OAuth verifies your identity when you sign in. Google shares only the profile fields listed above.
• PostHog powers our usage analytics. See posthog.com/privacy.

AI tool integrations

When you connect an AI assistant (Claude, ChatGPT, Cursor, etc.) via MCP and ask it to read or write a document, the document content passes through that assistant's servers under its own privacy policy. We do not control how those providers process, store, or train on that content, please review the relevant provider's terms before sharing sensitive documents.

Public documents

Documents are private to you (or your org) by default. If you explicitly flip a document to "public", either from the web UI or via the share_document_publicly MCP tool, its URL becomes reachable on the open internet by anyone with the link. Public documents are not indexed or advertised by us, but they are not authenticated either. You can revoke public access at any time.

Retention & deletion

We keep your account and documents until you delete them. Deleted documents are soft-deleted into a trash bin you can restore from; we don't currently auto-purge trash, so documents stay recoverable until you ask us to permanently delete them. To delete your account entirely (or to permanently purge specific documents), email us at the address below and we'll remove your data within 30 days.

Your rights

If you're in a jurisdiction with a data-protection law (GDPR, CCPA, and similar) you have the right to access, correct, export, or delete your personal data. Email us and we'll handle it.

Using DocStash

By creating an account or using DocStash you agree to these terms. If you don't agree, please don't use the service. You must be old enough to form a binding contract in your jurisdiction.

Your account

You're responsible for keeping your sign-in credentials safe and for any activity that happens under your account, including activity by AI agents you authorize via MCP. Revoke tokens from settings if a device or agent is compromised.

Your content

You retain ownership of the documents you upload. You grant us a limited license to store, transmit, and display them solely as needed to provide the service. If you mark a document as public, you're authorizing us to serve it without authentication to anyone with the link.

Don't upload content that's illegal, infringes someone else's rights, contains malware, or that you don't have the right to share. We may remove content that violates these rules or applicable law.

Acceptable use

• Don't attempt to break, overload, or abuse the service.
• Don't use DocStash to host phishing, malware, or content that's illegal where you live or where we operate.
• Don't probe for vulnerabilities without first contacting us. Responsible reports are welcome.

Service availability

DocStash is provided "as is" and "as available", with no warranties of any kind. We don't guarantee uptime, data durability, or that the service will be free of bugs. We'll do our best, but you should keep your own backups of anything critical.

Limitation of liability

To the maximum extent allowed by law, DocStash and its operators are not liable for any indirect, incidental, or consequential damages arising out of your use of the service. Our total liability is limited to what you paid us in the preceding twelve months (which, for free accounts, is zero).

Termination

You can stop using the service and delete your account at any time. We may suspend or terminate accounts that violate these terms or that pose a security or legal risk.

Ownership of the software

The DocStash software, design, and trademarks are proprietary, all rights reserved. No license to copy, modify, redistribute, or reverse-engineer the software is granted by use of the service. Enterprise customers under a separate signed agreement may receive additional rights as set out in that agreement.

Changes

We may update these terms over time. Material changes will be reflected in the "Last updated" date at the top of this page; continued use after a change means you accept the updated terms.

Contact

Questions about these terms or our privacy practices? itskishankumar98@gmail.com.