Stuff

Privacy Policy

Last updated November 5, 2026

The short version: your passwords, notes and AI chats stay on your devices. There's no account, no analytics and no ads, and we don't sell data. The main thing that touches our server is Messages, and it's end-to-end encrypted, so we can't read it.

Stuff is made by ETRC Solutions LLC ("we"). This policy covers the Stuff apps and this website.

What stays on your device

  • Your vault: logins, notes and images, encrypted with a key that comes from your master password. We never receive that password, and we can't recover it.
  • AI chats: stored encrypted on your device. The AI runs on your device, so chats aren't sent to us or to an AI company.
  • What a character learns: how you like to talk, drawn from what you type, stored encrypted on your device. You can view, pause or reset it.
  • Voice: speech is turned into text on your device. The audio is held in memory and never saved. Reading replies aloud uses your system's voice, and on Android that may be a voice app from another company.

The AI never receives your saved logins. If you type a password into a note and turn on "Use my notes", that note's text can reach the on-device AI. It still doesn't leave your device.

What we don't collect

The apps have no analytics, no tracking, no advertising and no crash reporting. You don't give us a name, email or phone number to use Stuff. If you choose to send us a problem report, it contains no vault data, and you decide whether to send it.

Messages and our relay

Messages is optional. When you use it, your device encrypts each message before it leaves, and our relay at relay.stuffbox.app passes it on. We can't read messages or see the name you chat under.

What the relay holds

  • Encrypted messages: deleted once your device confirms it has them, and after 14 days at most.
  • Encrypted conversation updates: kept for 14 days.
  • Invites: kept for up to 7 days.
  • Inbox records: a random inbox ID, hashed access tokens, public keys, and the days it was created and last checked. An inbox is removed after 90 days without use.

Online status and typing indicators are held in memory only. Deleted data can take some time to clear fully from the server's disk. The relay has no backups.

IP addresses

The relay sees your IP address while you're connected, and uses it briefly in memory to limit abuse. We don't write it to a database, and we keep no access logs.

Where it runs

The relay runs on DigitalOcean servers in the United States.

Things that connect to other companies

Stuff connects to these services. We don't send them your vault.

  • Security feed: the app downloads public lists of breaches and known security problems from Have I Been Pwned and CISA, usually when you open it. It downloads the whole list and matches it on your device, so nothing about your vault is sent, but those services can see your IP address.
  • AI model downloads: when you choose to download a model, it comes from Hugging Face.
  • Web access in chats: off by default and set per chat. When it's on, pages you ask for are fetched from those websites. If you add your own Brave Search key, your searches go to Brave. Your notes aren't used in web chats.
  • Account verification: if you choose to confirm a sign-in with Google, Microsoft or GitHub, you sign in with them directly. Stuff keeps your account identifier in your vault, and no access tokens.
  • Android: scanning a QR code and some sign-in features use Google Play services, which Google runs under its own policies.

Device sync and backups

Devices you pair sync directly over your own network, and we're not involved. Backups are encrypted files that you save and control.

App permissions

  • Camera: scanning a pairing QR code.
  • Microphone: voice input, only when you use it.
  • Biometrics: quick unlock on Android. Your fingerprint or face data stays with your phone's system.
  • Network and Wi-Fi: sync, Messages and the services listed above.
  • List of installed apps (Android): showing the right app name during autofill. It stays on your device.

Reports you send us

A report is an email you choose to send, so we'll have your email address and whatever it contains, including any messages you pasted in. We use it to look into the report, and keep it only as long as we need to or as the law requires.

This website

This site has no cookies, analytics or third-party scripts. It's hosted by Vercel, which handles requests and may briefly log technical details such as your IP address under its own privacy policy.

Deleting your data

  • On your device: uninstalling Stuff doesn't always remove your vault. Delete the vault from within the app or remove its data folder.
  • In Messages: you can delete conversations in the app. Anything left on the relay expires on the schedule above.

Because there are no accounts, we can't look you up. Your rights to access or delete data still apply to what we hold, so write to us and we'll help as far as we can.

Children

Stuff is intended for people aged 16 and over, and isn't directed at children under 13. If you believe a child has sent us personal information, tell us and we'll delete it.

Requests from authorities

We respond to valid legal requests. We can only provide what we hold, as listed above, and we can't decrypt messages.

Changes

If this policy changes, we'll update it here and change the date at the top.

Contact

ETRC Solutions LLC · safety@stuffbox.app