FallingBit

← StashNEX

Privacy — StashNEX

Version 4, updated on 02/11/2026. In case of doubt, the Italian version prevails.

This policy concerns the "StashNEX" apps for Android and for Windows (the "App") and explains what personal data they process, why, for how long and what your rights are, under the European Regulation 2016/679 (GDPR) and the Italian Legislative Decree 196/2003 (Privacy Code).

In short: your inventory stays on your device (phone or computer) and, if you turn on sync, in your Google Drive. Containers, items, photos and labels never reach our servers. Our servers only hold your account data (email, plan, AI credits) and, for the time strictly necessary, what you send when you use the artificial intelligence features.

1. Who processes your data

The data controller is FallingBit di Felice D'Andrea, Via De Falco 4, 81100 Caserta (CE), Italia, VAT number 04381570615. For any privacy question you can write to privacy@fallingbit.it.

2. Data that stays on your device

  • Your inventory: containers, locations, items and their details, notes, categories, photos, label codes and settings (theme, language, sheet format). In the Android app they are saved in the App's storage on the phone; in the Windows app in the Documents\StashNEX folder on the computer. We do not receive, see or keep them.
  • Backups: when you use "Save backup", the App creates a file with your inventory and photos and you choose where to save it (for example your Google Drive, a computer or an external drive, or by email). That file is under your control.
  • Sync with Google Drive (optional): if you turn it on, the App saves a copy of the inventory and photos in your Google Drive, in a hidden folder reserved for the App, so that you have the same data on every device where you sign in with the same Google account. The data goes directly from the device to your Google Drive, without passing through our servers: we do not receive it and cannot see it. To do this the App asks Google for permission to use only its own folder (it does not see the other files in your Drive). Sync is turned on, turned off and deleted from the App's Settings; the space used counts towards your Google account storage.
  • Google sign-in on the computer: in the Windows app, the code that keeps you signed in to Google (and, with sync, to Google Drive) is saved on the computer, encrypted with Windows data protection so that only your Windows user can read it. It does not reach our servers.
  • Device backups: if Google's automatic backup is turned on for your phone, Android may copy the App's data to your Google storage; on the computer, if the Documents folder is synced with a service such as OneDrive, Documents\StashNEX is copied there too. This happens according to your device settings and the privacy policies of those services.

3. Data we process on our server

  • Account data: when you sign in with Google we receive from Google your account identifier, email address and profile name. Together with these we keep the language you chose, your plan (trial, Pro) and its expiry, the dates of your first sign-in and last use, and the date you accepted the Terms and this policy. We never receive your Google account password.
  • App sign-ins: for each device you sign in on we keep an access code (only in a form that cannot be read) and the device type, to recognise the App when it connects.
  • AI credits: your credit balance and the history of top-ups (trial, monthly top-up, Pro welcome, packs).
  • AI usage log: for each AI request we store the function, model, number of photos, amount of text processed (tokens), outcome and duration. We do not store your questions, your inventory or your photos.
  • Photo analyses already done: the AI's result for a photo (for example the list of recognised items) is kept for 30 days, so that if you request it again you don't use credits. The photo itself is not kept.
  • Purchases: the Pro subscription and credit packs are bought through Google Play in the Android app and through the Microsoft Store in the Windows app. Payment data is processed by Google or Microsoft; we receive confirmation of the purchase, the product bought, the purchase or order codes, and the expiry and status of the subscription. To link the purchase to your StashNEX account, the App gives the store an identifier of your account in a form that cannot be read.
  • Technical data: to protect the service from abuse we record sign-in attempts and AI requests with the IP address for 24 hours. The hosting provider keeps the normal technical server logs.

4. Required data

To use the App you need to sign in with a Google account: without signing in the trial, AI credits and subscription cannot be activated. The email is also used for support, to manage purchases and to warn you before any deletion of the account for inactivity. All inventory content is optional and you decide what to enter.

5. Why we process it and on what basis

  • To provide the service you requested by accepting the Terms: sign-in, trial, subscription, credits and AI features, and service emails (the notices before deletion for inactivity). Legal basis: performance of a contract (art. 6(1)(b) GDPR).
  • Security and abuse prevention, including request limits. Legal basis: legitimate interest (art. 6(1)(f) GDPR).
  • Answering your requests for support or about privacy. Legal basis: performance of a contract and legitimate interest.
  • Legal obligations, for example tax and accounting. Legal basis: legal obligation (art. 6(1)(c) GDPR).

We do not use your data for advertising, we do not sell it and we do not do profiling. The App contains no ads, usage analytics or third-party tracking tools.

6. Artificial intelligence and automated decisions

The AI features are provided through the Google Gemini service (paid Gemini API) and are only used when you request them. At that moment the App sends our server the photos and text needed (for example the photo to analyse or, to answer a question, a list of your inventory), and our server forwards them to Google to produce the answer. Photos are first reduced in size and stripped of location data. Our server does not keep the photos or the inventory it receives: it uses them only for that request.

With the paid service Google does not use this content to improve its products or train its models; it may keep it for a limited time only to detect abuse. Google acts as a data processor.

The AI suggests descriptions, categories and answers that you can accept, correct or ignore. The App does not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR).

7. Who manages data for us and other services the App uses

  • Aruba S.p.A. (Italy): hosting of the App's server and its database, sending of service emails. It acts as a data processor.
  • Google, for Sign in with Google: it verifies your identity as an independent controller, under Google's privacy policy.
  • Google (Google Drive), only if you turn on sync: it keeps the copy of your inventory in your Google account, under the terms and privacy policy you accepted with Google. The relationship is between you and Google: we do not receive that data.
  • Google (Google Play), for purchases in the Android app, as an independent controller of payment data.
  • Microsoft (Microsoft Store), for purchases in the Windows app, as an independent controller of payment data, under Microsoft's privacy statement. Our server verifies purchases with the Microsoft Store services.
  • Google (Gemini API), for the AI features, as explained in section 6.
  • Reading QR labels: in the Android app with Google's reader (ML Kit, through Google Play Services), in the Windows app with the webcam and a library that works on the computer. In both cases the images stay on the device and do not reach us. Google Play Services may collect technical operating data under Google's privacy policy.
  • Server backups: a daily copy of the server database (account data only, no inventories) is kept in Italy, in password-encrypted archives, on a computer of the data controller and, as an identical copy, on an Aruba storage space (Aruba Drive).

The data is not disclosed to anyone else, except at the request of the judicial or other competent authorities.

Transfers outside the European Union

Google and Microsoft may process sign-in, AI and purchase data outside the European Economic Area, in particular in the United States. These transfers rely on the tools provided by Chapter V of the GDPR: the adequacy decision on the EU-US Data Privacy Framework, in which Google and Microsoft participate, or the standard contractual clauses approved by the European Commission. Our server and its database are in Italy.

8. How long we keep it

  • The inventory on your device stays until you delete it. On the phone it is also deleted when you uninstall the App; on the computer the Documents\StashNEX folder stays even after uninstalling, so you don't lose your data by mistake: if you want to remove it, delete it yourself.
  • The copy in your Google Drive (if you turned on sync) stays until you delete it: from the App, with "Delete the data from Google Drive" in Settings, or from the Google Drive settings, "Manage apps" section, by deleting StashNEX's hidden app data. Turning sync off or uninstalling the App does not delete it.
  • Account data on the server stays as long as the account exists. You can delete it whenever you want (see section 10): the data is deleted immediately.
  • Accounts not used for 12 months are deleted automatically from the server, with their plan and AI credits. Before that you receive two email notices, 30 days and 7 days in advance: just open the App with an internet connection to cancel the deletion. Accounts with an active Pro subscription are not deleted; when the subscription expires, the 12 months are counted from the expiry date or from the last use, whichever is more recent. Lifetime accounts are never deleted. The inventory on your devices is not affected.
  • Photo analyses already done are deleted after 30 days.
  • Sign-in attempts and AI requests recorded for security are deleted after 24 hours.
  • Server backups, which are only used in case of failure, are deleted automatically within 30 days, both from the data controller's computer and from Aruba Drive.
  • Emails you send us are kept for as long as needed to handle your request and, if necessary, to protect our rights.
  • Tax data relating to purchases, if any, is kept for the period required by law.

9. Your rights

Under articles 15 to 22 of the GDPR you can ask at any time to:

  • access your personal data;
  • correct or delete it;
  • restrict its processing;
  • receive it in a structured, machine-readable format (portability);
  • object to processing based on legitimate interest.

For the data on your devices you can do everything yourself: edit or delete content in the App and save a full copy with "Save backup" (the file also contains tables to open with Excel). For the data on the server write to privacy@fallingbit.it: we reply within one month of receiving the request, which may be extended by two further months if the request is particularly complex. For data processed by Google or Microsoft as independent controllers you can also contact them directly.

If you believe your data is not being processed correctly you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the supervisory authority of the country where you live or where you believe the infringement took place (list of authorities).

10. Deleting your account

  • From the App: Settings, Account section, "Delete account". Your account, plan, AI credits and sign-ins are deleted from the server immediately; right after, you can choose whether to also delete containers, items, photos and labels from the device and, if sync is on, from your Google Drive.
  • Without the App: write to privacy@fallingbit.it from the email address of your Google account, asking us to delete your StashNEX account. We delete it within 30 days and confirm it to you.
  • Uninstalling the App does not delete the account on the server or any copy in your Google Drive. On the phone it deletes the App's data; on the computer the Documents\StashNEX folder stays (see section 8).
  • The Pro subscription is cancelled from the store where it was bought: from the Play Store if bought with Google Play, from your Microsoft account if bought with the Microsoft Store. Deleting the account does not cancel an active subscription by itself.

11. Security

We protect data with appropriate technical measures: the connection between the App and the server is always encrypted (HTTPS), sign-in happens through Google with no password to store, access codes are stored in a form that cannot be read, requests are rate-limited to prevent abuse and backups are encrypted with a password. The data on your devices is protected by the screen lock, the Windows sign-in and the other device protections, which are under your control. No system is completely free of risk, however: in case of a data breach we notify the Garante and, if there is a high risk to you, you too, as required by articles 33 and 34 of the GDPR.

12. Device permissions

The App uses the internet connection (for sign-in, credits, AI, purchases and, if turned on, sync with Google Drive) and the camera or webcam, only when you take a photo or scan a label. Photos chosen from the gallery or from the computer's folders are copied into the App's storage only when you add them. The App does not use your location, contacts or microphone.

13. Minors

The App is only for people aged 16 and over. This is the general minimum age set by the GDPR (art. 8) to consent on one's own to data processing in online services, and it applies in every country of the European Union, including those, like Italy, that set a lower one. We do not knowingly collect data of children under 16: if you are a parent or guardian and think your child has created an account, write to privacy@fallingbit.it and we will delete it.

14. Changes

We may update this policy, for example if the App's features or the law change. The updated version is always published on this page with the new date. If we change it in an important way we will tell you in the App and, if needed, ask you to confirm that you have read it. Previous versions are available on request.

15. Contacts

For privacy questions or to exercise your rights: privacy@fallingbit.it. For help using the App: supporto@fallingbit.it.