SayStash has no account, no sign-in and no server. What you speak becomes text on your phone, and that is where it stays.
The short version, before the detail below.
This policy is published by SilverCodeLabs, the developer of SayStash. It covers two separate things, and they behave differently:
com.silvercodelabs.saystash, and the version of SayStash that runs in a web browser. Sections 2 to 8 describe the app.Where this policy says "we", it means SilverCodeLabs. Where it says "your device", it means the phone, tablet or computer you are running SayStash on.
Nothing.
SayStash has no account system, no sign-in, no cloud sync and no analytics. It sends nothing to us and it contains no advertising or tracking libraries. We cannot see your entries, we do not know how often you open the app, and we hold no record that you use it at all.
Everything you create in SayStash is written to storage on your own device and read back from there. The only part of using SayStash that involves anyone outside your device is speech recognition, which is explained next.
SayStash uses your microphone only while you are actively recording an entry — from the moment you tap the record button until you stop. It does not listen in the background, it has no wake word, and it does not activate on its own.
SayStash does not do speech recognition itself. It passes the audio to the speech recognition service already built into your device and receives text back.
On Android, that is the system speech recognizer. On most Android devices this service is provided by Google, and it may send the audio to Google's servers to be processed. If you use SayStash in a web browser, the equivalent work is done by your browser's own speech service, which may likewise send audio to that browser vendor.
That processing happens outside SayStash, under the speech service's own privacy policy rather than this one. We cannot inspect what it does with the audio, cannot limit how long it keeps it, and cannot delete it on your behalf. If you would rather no audio left your device at all, type your entries instead — every feature in SayStash works by typing.
SayStash does not record, save or transmit audio of its own. No audio file is written to your device, none is kept after the entry is created, and none is ever sent to us — we operate no server that could receive it. Only the resulting text is kept, and it is kept on your device.
Earlier descriptions of SayStash suggested speech could be processed entirely on-device. That was inaccurate and has been corrected. The speech plugin the app uses does not offer an on-device-only mode, so the app makes no such claim, and the Settings screen states plainly that audio may be sent to Google.
Your notes, reminders and events are stored in SayStash's own private storage area on your device, in two places at once: the app's local web storage, mirrored to Android's app preferences so your entries survive a WebView cache clear or a device clean-up tool.
Both locations are private to SayStash. Other apps cannot read them. Because there is no sync, your entries exist only on the device you created them on — if you install SayStash on a second device, it starts empty.
We keep nothing, so we have no retention period to describe. Your entries last exactly as long as you keep them.
Reminders and event alerts are scheduled as local notifications by Android itself. They are created and delivered on your device and never pass through a server, so nothing about a reminder is visible to us or to anyone else in transit. There are no push notifications in SayStash.
For alerts to arrive at the minute you asked for, Android needs permission to schedule exact alarms. Without it, the system may delay an alert to save battery. You can grant or withdraw this in Settings, and you can withdraw notification permission entirely at any time — SayStash keeps working, it just stops alerting you.
SayStash has no third-party SDKs. Three things can involve software outside the app, and two of them only when you choose:
The app also loads its typeface from Google Fonts, which means Google's font servers see the request. If you would rather that did not happen, the app functions normally offline with your device's default font.
SayStash asks for the minimum it needs, and asks only when a feature needs it.
All three can be withdrawn at any time in Android's Settings → Apps → SayStash → Permissions. Withdrawing a permission never deletes your entries.
SayStash is not directed at children and is not designed for them. It collects no personal information from anyone, children included, so there is nothing we could knowingly collect from a child. If you are a parent and have a question about your child's use of the app, please get in touch using the details in section 11.
The website is separate from the app and behaves like an ordinary website.
If you volunteer to test SayStash, the form asks for your email address. We use it for one purpose: to invite you to the tester group so that Google Play can recognise you as a tester. It is not added to a mailing list, not used for marketing and not shared with anyone. Ask us to remove it and we will delete it. Once the testing programme ends, the addresses are deleted.
Our hosting provider keeps standard access logs — IP address, browser type, page requested and time. These are generated automatically by the web server, are used only for security and diagnosing faults, and are not linked to anything you do in the app.
The website carries no advertising and no cross-site tracking.
If SayStash changes in a way that affects this policy, we will update this page and change the date at the top before the new version reaches you. Material changes — anything that alters what leaves your device — will be called out on the website and in the app's release notes rather than quietly edited in.
Questions about this policy, or about anything in it you think is wrong, are welcome — being told we have described something inaccurately is useful to us.