myStuf

Privacy Policy

Last updated October 9, 2026

This policy covers myStuf, the myStuf lite apps (homeStuf, carStuf, sizeStuf, snapStuf, medStuf, toolStuf, choreStuf and budgetStuf), yourStuf company versions, and myStuf Online at mystuf.app. They're provided by myStuf LLC, a Georgia company ("myStuf", "we"). In short: what you keep in myStuf is yours. We use it only to run the app for you, we protect it with encryption, we never sell it or show you ads, and you can delete it whenever you like.

What we collect

Your account

  • Your email address and the name you give us.
  • Your password, stored only as a one-way hash. Nobody, including us, can read it.
  • Your plan, and the devices and browsers currently signed in (a device name and when it was last used), so you can see and sign them out.

What you put in myStuf

Everything you add: collections, items, notes, custom fields, photos, documents, voice recordings, reminders and lists. Depending on what you use, that can include:

  • Health information: medical records, visits, conditions, allergies, medications, test results and glucose readings, for you or people you care for.
  • Financial information: budgets, amounts spent and where, and item values.
  • Information about other people: names, birthdays, contact details and relationships in People, and contacts you choose to import.
  • Important documents and the details on them.

How what you put in is protected, at every stage:

  • On your phone. The app's whole database is encrypted with AES-256 (SQLCipher), and so is every photo, document and voice recording it stores. The key is created on your phone, kept in the phone's secure hardware-backed key store, and never leaves the device. Photos are only decrypted in memory while you're looking at them. You can also lock the app with your fingerprint, face or phone PIN, hide it in the app switcher, and lock individual collections.
  • On the way. Everything travelling between the app, myStuf Online and our servers is encrypted with HTTPS (TLS). Browsers are told to always use a secure connection to mystuf.app.
  • On our servers. The contents of your records are encrypted at rest, field by field, with AES-256: every field you fill in (including Additional Info), descriptions, notes, medical history, visits, test results, budget notes and Ask chats. The encryption key is kept separate from the database, so a copy of the database on its own can't be read. Item and collection names stay readable so lists and search stay fast.
  • Photos and files in storage. They're kept in Cloudflare's storage, which encrypts everything at rest with AES-256, and they can only be opened by you and the people you've shared that collection with.
  • In backups. Our nightly backups are encrypted with AES-256 using their own separate key before they leave the server. Backups you make yourself, in the app or on the web, can be protected with your own password.
  • Your password is never stored, only a one-way hash of it.

You decide what goes in. We store it so it can sync across your devices, be backed up, and be shared with the people you choose. We don't look through it, and we don't use it for anything else.

When we would ever look at it. Our staff don't open what you keep in myStuf. We'd look at a specific item only if you ask us to while we're helping you with a problem, and only the part you point us to, or if the law requires it. Access to our servers is limited to the few people who run them, and to what they need to keep the service working.

Ask, the AI assistant

If you turn Ask on, we keep your questions and Ask's answers so you can see the conversation. If you report an answer, we keep a copy of that question and answer so we can review it.

Technical information

Our servers keep short-term logs (such as IP addresses and error details) to keep the service running and secure. The apps contain no advertising or analytics trackers.

Cookies and browser storage

mystuf.app uses no advertising or tracking cookies, and no analytics. myStuf Online keeps a few things in your own browser so it works: your sign-in, your settings (such as theme, sort order and tips) and, while a tab is open, your Ask chat. Signing out removes your sign-in. Because we don't track you, there's nothing to opt out of, and we treat a browser's Global Privacy Control or Do Not Track signal as already honored.

Payments

When you buy a paid plan, the payment is handled by Google Play or by our payment processor. We receive your plan and whether it's paid, never your full card or bank details.

Permissions on your phone

  • Camera: to take photos and scan barcodes, receipts and labels. Scanning happens on your phone.
  • Contacts: only when you choose to import people, and only the contacts you pick are saved.
  • Microphone: for voice recordings, and for speaking to Ask or dictating. Spoken words are turned into text by your phone's speech service.
  • Notifications and alarms: to remind you when something is due.

How we use your information

  • To provide myStuf: store, sync and back up your data, and show it to you and the people you share it with.
  • To send account emails: verification, password resets, share invitations and storage warnings.
  • To answer Ask questions, when you've turned Ask on.
  • To keep the service secure, fix problems and respond when you contact us.

We don't sell your data, we don't show ads, and we don't use what you keep in myStuf to train AI models.

Health information

Health information is used only to keep your records, show them to you and the people you share them with, and remind you of what's due. It's encrypted on your phone and on our servers. Ask uses it only if you allow it, and you can leave Medical Records, Medications and Glucose Readings out of Ask entirely. myStuf is a personal record keeper, not a medical device, and nothing in it is medical advice.

myStuf isn't a doctor, hospital, health plan or their business associate, so it isn't covered by HIPAA. We protect your health information as described here, and US laws written for consumer health apps, such as the FTC's Health Breach Notification Rule, apply to us. Our Consumer Health Data Notice gives the details that Washington, Nevada and other state health-data laws ask for.

Ask and Anthropic

  • Ask is off until you turn it on, and you can turn it off at any time in Settings.
  • When you ask something, the details Ask looks up to answer it are sent to Anthropic, which provides the Claude AI model. Anthropic processes them only to produce the answer and doesn't use them to train its models. Anthropic deletes them within 30 days, unless it must keep something longer to investigate misuse of its service or because the law requires it.
  • Ask never receives passwords, PINs, door or alarm codes, Social Security numbers, account or card numbers, or anything in a Passwords or locked collection. You can also leave out Medical Records, Medications, Glucose Readings, Vitals and Important Documents, and a budget stays out unless you allow it.
  • Ask conversations are deleted 7 days after their last message, or sooner if you delete them. A reported answer's copy is deleted after 90 days.

Who we share it with

  • People you choose. A collection you share can be seen, or edited if you allow it, by the people you invite, including its photos and files. You can stop sharing at any time. When you do, the collection disappears from their app and myStuf Online the next time they sync. We can't take back copies they've already made, such as a screenshot or an export, so share only with people you trust.
  • Your company, for yourStuf. If you use a company's yourStuf, its admins can see and manage the company's collections and your use of company storage.
  • Legacy Memory Maker, when you send a memory to it. Legacy Memory Maker is another app from myStuf, LLC. After you connect your Legacy account in Connected Apps, choosing Send to Legacy Memory Maker on one of your memories sends a copy of that memory to your Legacy archive: its title, story, date, place and map pin, tags, the person in Who (name, and email if their contact has one) and the photos, recordings and files you leave ticked. Protected files are never sent. Nothing is sent until you choose to send a memory, and Legacy sends nothing back. You can disconnect at any time in Connected Apps; copies already sent stay in Legacy, where Legacy's privacy policy applies.
  • Service providers that run parts of myStuf for us, under contracts that limit them to doing so:
    • Render: hosts our servers and database.
    • Cloudflare: stores photos, files and encrypted backups.
    • Anthropic: answers Ask questions, only when you use Ask.
    • Resend: sends our account emails.
  • Lookups you start. Some features send just the thing being looked up, never your account or your other data: a book's ISBN to Google Books or Open Library, a VIN to the U.S. NHTSA, a medication name to the U.S. FDA's openFDA, and an address you're typing to the Photon (OpenStreetMap) address search.
  • The law. If we're legally required to, or to protect someone's safety. We'll ask for a valid legal order (such as a subpoena or warrant), give only what it requires, and tell you before we hand anything over unless the law or a court forbids us, or there's an emergency.
  • If myStuf changes hands. If myStuf LLC is sold or merged, your information would move with the service, and this policy would keep applying to it. We'd tell you first, and you could delete your account.

We don't sell or "share" your personal information as US state privacy laws define those words, and we never have.

Where your data is kept

myStuf is run from the United States. Our servers and database are in the United States. Photos, files and backups are kept in Cloudflare's storage, which may hold copies in its data centers in other countries, always encrypted. If you use myStuf from outside the United States, your information is transferred to and kept in the United States.

How we protect it

  • All connections use HTTPS.
  • On your phone, the app's database, photos, files and recordings are encrypted (AES-256) with a key that never leaves the device. You can lock the app with your fingerprint, face or phone PIN.
  • On our servers, the contents of your records and your Ask chats are encrypted at rest (AES-256) with a key kept separate from the database. Photos and files are kept in encrypted storage.
  • Nightly backups are encrypted with their own separate key.

More detail: how we protect your data.

If something goes wrong. No system is perfectly secure. If someone gets into your information without permission, we'll tell you by email as soon as we can, and within 60 days at most, along with what happened, what was involved and what you can do. Where the law requires, we'll also tell the FTC and state authorities.

How long we keep it, and deleting it

  • We keep your data while you have an account.
  • Something you delete is removed from your devices and myStuf Online straight away, and permanently erased from our servers within 30 days.
  • You can delete your account, and everything in it, in the app (your account icon, then Delete Account) or on the web (Account, then Delete my account). It's removed from use immediately, and erased from our servers, storage and backups within 30 days. See Delete your account, including what to do if you can't sign in.
  • You can export everything at any time with Backup & Restore.

Your choices and rights

You can see, change, export and delete your information yourself in the app or on the web. You can turn Ask off, leave whole kinds of records out of it, stop sharing anything you've shared, and sign out other devices. If you'd like help with any of this, or want to know what we hold about you, email us.

Your rights under US state laws. Depending on where you live (for example California, Colorado, Connecticut, Texas, Virginia or Washington), you have the right to:

  • know what personal information we have about you, and get a copy of it;
  • correct it;
  • delete it;
  • opt out of its sale, targeted advertising and profiling (we do none of these);
  • limit how sensitive information, such as health information, is used (we already use it only to provide myStuf to you).

To make a request, email us from the address on your account, or have someone you've authorized do it for you. We'll confirm it's you, answer within 45 days, and won't treat you differently for asking. If we turn down your request, you can appeal by replying to our answer with "Appeal" in the subject. We'll answer the appeal within 45 days, and if you still disagree you can contact your state's Attorney General.

Information about other people

You can keep records about other people, such as family members' birthdays, a parent's medications or a friend's address. Please only add what you have a right to keep, and only share it with people they'd be comfortable seeing it. If someone asks us to remove information about them that's in your account, we'll pass the request on to you, because what's in your account is yours to manage.

Children

myStuf is for adults and teens 13 and older. It isn't directed at children under 13, and we don't knowingly collect their information. Parents may keep records about their children, such as chores or school information, in their own account.

Changes to this policy

If we change this policy in a meaningful way, we'll update the date at the top and let account holders know by email or in the app before the change applies.

Contact

Questions or requests about your privacy: mystufapp@gmail.com.

myStuf, LLC, Gwinnett County, Georgia, USA.