Privacy · Last updated 17 August 2026

Privacy Policy

This Policy explains what StackMap collects, why, who we share it with, and your rights over it — in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

1. Scope of This Policy

This Policy applies to personal information collected through the StackMap website and application (the "Service"), operated by StackMap ("we," "us," "our"). It does not apply to third-party websites or services you access via links you save in StackMap — see §9.

2. Information We Collect

2.1 Account information. Email address, sign-in method (Google OAuth or email magic link), account identifiers, and subscription/plan status.

2.2 Workspace Data. The links, bookmark names, URLs, categories, stacks, layout preferences, theme settings, and import/export data you add to your StackMap workspace.

2.3 Security-related data. If you enable optional security features, we store a salted cryptographic hash of your PIN (never the PIN itself in plain text) and, if you enable two-factor authentication, TOTP enrolment data required to verify authenticator codes. We do not have access to your raw PIN or authenticator secret in usable form.

2.4 Usage data. Which apps/tiles you open and how often, for the purpose of surfacing your most-used tools (Recent Apps). This is stored against your account, not shared externally, and is not used to build an advertising profile.

2.5 Billing data. Subscription status and a Stripe customer reference identifier. We do not receive, process, or store your full card number, expiry, or CVC — that is handled entirely by Stripe. See §5.

2.6 Technical data. Standard technical and log data such as IP address, browser type, device type, and access timestamps, collected automatically by our hosting/security provider (Cloudflare) as part of operating and securing the Service.

2.7 Support communications. Any information you provide when you contact us for support, including the content of your message and any attachments.

3. How We Collect Information

We collect information directly from you when you create an account, use the Service, or contact support; automatically through your use of the Service (e.g. usage and technical data); and from third parties you choose to connect, such as Google (for sign-in) or Stripe (for payment status), limited to what those providers share with us to operate your account.

4. How and Why We Use Information

We use the information described above to: provide and operate the Service, including cloud sync of your workspace; authenticate you and maintain account security, including PIN lock and two-factor authentication; process payments and manage subscriptions; provide customer support; detect, prevent, and investigate fraud, abuse, or security incidents, including validating links through Link Shield (see §9A); maintain, troubleshoot, and improve the Service; and comply with our legal obligations. We do not sell your personal information, and we do not use your Workspace Data (the links and tools you save) to build advertising profiles or sell to advertisers.

5. Payment Information

Payments are processed by Stripe, Inc., a PCI-DSS-compliant third-party payment processor. StackMap never receives or stores your full card number, expiry date, or CVC. Stripe processes your payment information under its own privacy policy and terms, available at stripe.com. We retain only a customer reference identifier and subscription status necessary to manage your plan.

6. Service Providers and Disclosure

We share personal information with the following categories of trusted service providers, strictly as necessary to operate the Service, and under contractual obligations consistent with the Australian Privacy Principles where applicable:

We do not disclose your personal information to any other third party except: with your consent; to comply with a legal obligation, subpoena, or court order; to protect the rights, property, or safety of StackMap, our users, or the public; or in connection with a merger, acquisition, or sale of business assets, subject to §12.

7. Overseas Disclosure

Some of our service providers (including Supabase, Cloudflare, Stripe, and Google) may store or process personal information on servers located outside Australia, including in the United States and other jurisdictions where those providers operate. By using the Service, you acknowledge that your personal information may be transferred to and processed in these jurisdictions. Where required under Australian Privacy Principle 8, we take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs, including relying on providers' own compliance certifications and contractual data protection commitments; however, once information is handled by an overseas recipient, it may become subject to that jurisdiction's own laws, which may differ from Australian law.

8. Data Security

8.1 What we do. We take reasonable technical and organisational steps to protect personal information, including access controls on our database, encrypted transmission (HTTPS), salted hashing of PINs, TOTP-based two-factor authentication, and reliance on providers (Supabase, Cloudflare, Stripe) with their own independent security programs.

8.2 No guarantee. No method of transmission or storage is 100% secure. Despite our reasonable efforts, we cannot and do not guarantee the absolute security of your personal information, and we are not liable for unauthorised access, disclosure, alteration, or loss of data that occurs despite those reasonable efforts, except as required by law, including the Privacy Act 1988 (Cth) and the Notifiable Data Breaches scheme described in §8.3.

8.3 Data breach notification. If we become aware of a data breach involving your personal information that is likely to result in serious harm, we will comply with our obligations under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth), including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

9. Third-Party Links and Content

StackMap lets you save and launch links to third-party websites and applications. We do not control, and this Policy does not apply to, the privacy practices of those third-party destinations. Visiting a site via a link saved in StackMap is subject to that site's own privacy policy, not ours.

9A. Link Shield — How Link Checking Works

When Link Shield validates a URL you are saving or opening, it evaluates the link's structure (scheme, domain pattern, and known-risky indicators) to flag or block certain categories of risk. This check is performed to protect your account and is not used to build a profile of your browsing, is not shared with advertisers, and is not sold to third parties. Link Shield is a filtering aid only and does not guarantee that any link is safe — see our Terms of Service §17A for the full disclaimer on Link Shield's limitations.

10. Cookies and Similar Technologies

We and our service providers (including Cloudflare and Supabase) may use cookies or similar local storage technologies necessary to keep you signed in, remember your preferences (such as theme and layout), and maintain security. We do not currently use third-party advertising or cross-site tracking cookies. If this changes, we will update this Policy and, where required by law, seek your consent.

11. Data Retention

We retain account and Workspace Data for as long as your account is active, or as needed to provide the Service, comply with legal obligations, resolve disputes, prevent fraud or abuse, or enforce our agreements. If you delete your account, we will delete or de-identify your personal information within a reasonable period, except where retention is required by law (e.g. financial records) or necessary for legitimate business purposes such as fraud prevention, subject to §8.3.

12. Business Transfers

If StackMap is involved in a merger, acquisition, reorganisation, or sale of some or all of its assets, personal information may be transferred as part of that transaction. We will notify affected users of any such change in ownership or control of personal information, and any successor will be bound by this Policy (or a materially similar policy) with respect to previously collected information, to the extent required by law.

13. Your Rights

Subject to applicable exceptions under the Privacy Act 1988 (Cth), you have the right to: request access to the personal information we hold about you; request correction of inaccurate or out-of-date information; request deletion of your personal information, subject to legal, technical, or security limits described in §11; and make a complaint about how we handle your personal information (see §14). To exercise these rights, contact contact@stackmap.net. We may need to verify your identity before actioning a request, and may decline a request to the extent permitted by law (for example, where it would unreasonably impact the privacy of others, or where information must be retained for legal or security reasons).

14. Complaints and the OAIC

If you believe we have mishandled your personal information, please contact us first at contact@stackmap.net so we can investigate and respond, generally within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

15. Automated Decision-Making

Link Shield's risk flagging (see §9A) is an automated process, but it does not make any decision that produces a legal or similarly significant effect on you — it only provides an informational flag or block that you or we can act on. We do not otherwise use your personal information for automated decision-making that produces legal or similarly significant effects on you without human oversight.

16. Children's Privacy

StackMap is not directed to, and is not intended for use by, children under 16 (see Terms of Service §2). We do not knowingly collect personal information from children under this age. If we become aware that we have collected personal information from a child under 16 without appropriate consent, we will take reasonable steps to delete it. If you believe a child has provided us with personal information, contact contact@stackmap.net.

17. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. Material changes will be notified by email or in-app notice at least 14 days before taking effect wherever practical, and the "last updated" date at the top of this page will always reflect the current version. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy, without limiting any right you have to object or withdraw consent where required by law.

18. International Users

StackMap is operated from Australia and this Policy is designed to comply with the Australian Privacy Principles. If you access the Service from outside Australia, you understand that your information will be transferred to, stored, and processed in Australia and in the jurisdictions of our service providers described in §7, which may have data protection laws different from those of your home jurisdiction.

19. Business Details

StackMap is operated from 121 King William Street, Adelaide SA 5000, Australia. This Privacy Policy is intended to comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

20. Contact

For privacy questions, access/correction/deletion requests, or complaints, contact: contact@stackmap.net

121 King William Street, Adelaide SA 5000, Australia.