Privacy Policy
Last updated: September 5, 2026
Restash ("we", "us") operates the Restash iOS app and getrestash.com. This policy explains what we collect, why, who we share it with, and your choices. Related: Terms of Service · Copyright & DMCA.
Your vault is yours. We do not sell your personal information or your saved content. We do not use your private vault to train public AI models.
Who is responsible
Restash is the controller of personal data described here. Contact: info@getrestash.com.
Information we collect
- Account — email, username, and authentication identifiers (Apple, Google, or email sign-in).
- Waitlist — name, email, and optional phone if you join the launch waitlist. Used only to contact you about Restash.
- Vault content — links, notes, images, files, folders, and metadata you save, plus AI outputs you generate. This is your content. See Terms.
- Usage and diagnostics — app interactions, feature use, and crash logs so we can run and fix the service.
- Purchases — subscription and credit status via Apple and RevenueCat. We do not store full payment card numbers.
- Sharing — usernames or emails of people you invite to a folder or resource, and the access you grant.
How we use it
- Provide the vault: save, organize, search, display, and (if you choose) share.
- Run AI features you request (Ask, Studio, tagging, embeddings, and similar).
- Authenticate you, secure the service, and prevent abuse.
- Process subscriptions and credit limits.
- Send transactional email (account, security, waitlist confirmation, optional digests you enable).
- Contact waitlist signups about launch and early access from info@getrestash.com.
- Improve reliability using diagnostics (with identifiers stripped where we can).
We process this data to perform our contract with you, to pursue legitimate interests in running a secure product, and where the law requires consent (for example some marketing or device permissions). You can withdraw consent by turning off a feature, deleting content, or deleting your account.
Your content and our limits
You own the content in your vault. We access it only to provide the service you asked for, to comply with law, or to address a valid copyright notice. Staff do not browse private vaults as a matter of course. If you delete content or your account, we delete or anonymize associated personal data within a reasonable period, unless we must retain a copy for legal, security, or accounting reasons.
AI processing
When you use Ask, Studio, ingest, or similar features, relevant vault text or media may be sent to our AI providers (including Google Gemini and other processors we use to run that feature) to generate a response, tags, or embeddings. That material is treated as your data, not as instructions to the model. We do not use your private vault content to train public models. Some voice features run on your device. Other voice features you use may be sent to an AI provider to transcribe.
If you message @restash on Instagram or mention it in a comment, we receive your Instagram-scoped user ID, the message or comment, and references to media you share. We use this only to save that material to your vault and to confirm the save. We do not sell it. Ask us to delete it at info@getrestash.com.
Sharing with other people
Your vault is private until you invite someone. Invitees can see content in that shared folder or resource. Revoking access stops new access through Restash; we cannot unsync copies they already made outside the app.
Processors and other parties
We use vendors to operate Restash. They process data on our instructions, not for their own marketing of your vault:
- Supabase — database and authentication, including waitlist storage
- Apple — Sign in with Apple, App Store billing
- Google — Sign in with Google; Gemini for AI features you use
- RevenueCat — subscription status
- Resend — transactional, waitlist, and optional digest email
- Meta / Instagram — messaging and comment webhooks for save-to-vault
- Sentry — crash and diagnostic reports
- Railway and Vercel — hosting
We disclose data if required by law, to protect Restash or others from harm, or as part of a merger or sale with notice where the law requires it.
Where data lives
We and our processors may store or process data in the European Union, the United States, and other countries. Where required, we use appropriate safeguards for international transfers (such as standard contractual clauses).
Retention, export, deletion
We keep account and vault data while your account is active. Waitlist entries stay until outreach is done or you ask us to remove them. You may request an export of your data or deletion of your account by emailing info@getrestash.com from your registered address. We will complete deletion or anonymization within a reasonable period (and within one month where GDPR applies, unless the request is complex). Some records (billing, security logs, legal holds) may be kept longer if the law requires.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. You may also lodge a complaint with your local data protection authority. To exercise rights, email info@getrestash.com. We will not discriminate against you for exercising privacy rights. We do not sell or share personal information as those terms are used in US state privacy laws such as the CCPA.
Children
Restash is not directed at children under 13. We do not knowingly collect personal data from them. If you believe we have, contact us and we will delete it.
Security
We use industry-standard measures including encryption in transit, access controls, and per-user database rules so one customer cannot read another's vault through the public app. No method of transmission or storage is perfectly secure.
Changes
We may update this policy. The "Last updated" date will change. If a change is material, we will provide a more prominent notice.
Contact
Privacy questions: info@getrestash.com
Copyright: dmca@getrestash.com