Privacy policy

1. Controller and scope

This policy describes data processing for My Stuff, mystuff.global and support requests by users outside Russia. The controller is Natalja Libikova, Linnu tee 70, 13424 Tallinn, Estonia. Contact for data questions: support@mystuff.global.

2. Belongings, photos and permissions

In the free version, photos, names, descriptions, boxes and storage locations are stored locally on your device. Adding them does not itself send them to support. In the paid iOS version, selected app data synchronises through iCloud. The developer has no access to the contents of your iCloud.

Camera and photo access is used to add images and work with QR codes. Permissions are granted through the operating system and can be changed in device settings. Refusing access may limit the corresponding feature.

3. Apple Account, iCloud and purchases

Apple Account authentication and iCloud are also governed by Apple’s terms and privacy rules. Do not send your Apple password to the developer or support. The app checks purchase or subscription availability to provide Premium. Apple processes App Store payments; the website does not request bank card details.

4. Diagnostics, analytics, notifications and support

Firebase Crashlytics (Google) is used in the iOS and Android apps to diagnose errors. Crash reports may include device, operating system and app version information, error circumstances and installation identifiers.

Statistics use App Store Connect and Google Analytics for Firebase. Analytics is used in both iOS and Android and may process usage events, app instance identifiers, device information and approximate location. The app currently contains no advertising.

Firebase Cloud Messaging delivers push notifications and may process installation identifiers and registration tokens. Permission to display notifications is managed in device settings.

When you contact support, we receive your email address, message and attachments you choose to send. We use them to answer, resolve issues and protect legitimate interests. Do not send passwords or payment details.

5. Website and external services

The website saves your language choice in browser localStorage. You can remove it in browser settings. The current website has no own web analytics or advertising trackers. Video clips are hosted with the site; the embedded YouTube review loads after you click it.

YouTube and external stores process data under their own rules when you play content or follow links. Website servers and connectivity providers may process IP addresses and request details to deliver pages and maintain security.

6. Purposes, legal bases and recipients

Data supports selected features, synchronisation, Premium verification, support, error diagnosis, usage analysis and notification delivery. Depending on the processing and applicable law, bases include performing a contract, legal obligations, consent where required and legitimate interests such as answering support requests and maintaining security, subject to users’ rights. Apple diagnostic and statistical data also follow user sharing settings.

Apple, Google/Firebase and hosting and email providers process data as needed for their services. Legally required information may be disclosed to authorities. Apple and Google may process data internationally, including outside the EEA, under the terms and safeguards applicable to their services. Contact support for information about transfers relating to your data.

7. Retention and deletion

Local materials remain on the device until you delete them. Removing the app may leave backups and iCloud data; manage these separately using the app and Apple’s available controls. Support correspondence and server logs are retained as necessary for their purposes, protection of rights and legal requirements.

Firebase uses the standard retention rules of each service. Crashlytics retains crash reports and associated identifiers for 90 days before Google starts removing them from live and backup systems. This is not a single retention period for all Firebase products. Analytics user and event data retention follows the property settings and Google Analytics rules. Cloud Messaging installation identifiers remain until deletion is requested; Google then removes them from live and backup systems within 180 days.

8. Your rights and contact

Under applicable law, including GDPR where applicable, you may request access, correction, deletion, restriction or portability, object to processing and withdraw consent. Withdrawal does not affect earlier lawful processing. Legal retention duties or the fact that local data is not held by the provider may limit requests.

Send requests to support@mystuff.global. We may ask for information needed to verify them securely. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or another competent authority, including in your place of habitual residence, work or an alleged infringement where applicable. Updates appear with a revision date; significant changes are notified as required by law.