Privacy Policy
Last updated 2026-11-02 · privacy@baublestash.com
What BaubleStash is
BaubleStash is a private ornament inventory and optional sharing service operated by Blackboard Studios. It is designed to keep personal collection records separate from the public catalog.
Information we handle
- Account information: email address, display name, password hash, session records, and subscription status. Passwords are stored as one-way hashes. Browser authentication uses an HttpOnly session cookie; long-lived bearer tokens are not placed in browser storage.
- Collection information: private ornament designs, release details, manufacturer item numbers, owned physical copies, condition, notes, storage boxes, labels, and catalog contribution records.
- Photographs: device-local Free photographs remain on the supported mobile device. Plus private cloud photographs are stored in private media storage and served only after authorization checks. Catalog photographs become public only after explicit contribution selection and Librarian approval.
- Sharing: invitation email address, selected permission, and the resulting collection access. A recipient sees only the shared default collection and authorized cloud photographs.
- Billing status: plan, provider, product, renewal/expiry status, and verified subscription references. Web payments, tax calculation and receipts are handled by Stripe; BaubleStash does not receive or store card numbers. Apple/Google purchases are handled by the respective store.
- Operational records: audit events for sensitive actions, limited failure logs, and security metadata. Raw scan payloads and private photo contents are not written to ordinary application logs.
- Social sign-in: if you choose Apple, Google or Facebook, we receive a provider account identifier and the name and verified email you agree to share. We do not request posts, friends, contacts or other permissions.
- Service providers: Stripe (Web payments and tax), Apple/Google/Facebook (only when you choose social sign-in), Amazon Web Services (private object storage, email delivery and operational notifications), and the hosting provider for the application and database. Each is used only to operate BaubleStash.
How information is used
We use the information to provide the account and stash, synchronize permitted changes, authorize sharing and moderation, process store-verified subscription status, recover accounts, prevent abuse, and keep the service reliable.
What is never automatic
Private ornaments and photographs are not automatically published to the shared catalog. A catalog contribution requires an explicit contributor action and Librarian approval. Approved catalog images are separate public catalog records, not copies of the contributor’s private stash.
Retention and deletion
Download My Data provides inventory and available private cloud photo files. Free photos stored only on a phone require a local export. True Plus lapse retains private cloud photos for 90 days; eligible private cloud images are scheduled for deletion after that window. Hosted activation still requires storage, notification and recovery verification. Renewal cancels deletion that has not started; it cannot recreate deleted bytes. Voluntary account deletion starts access revocation immediately and queues private data cleanup separately. Approved public contributions remain licensed catalog records with personal image attribution removed. The current retention draft specifies backup expiry within 30 days, minimal deletion audit for 12 months and necessary financial records for 7 years; these schedules require confirmation before hosted enforcement; documented legal disputes may extend only the relevant records. Minimal contribution license evidence remains while licensed catalog content is published. Production backup aging and legal review still require verification.
Sharing and service providers
Shared data is available only to the invited account and remains subject to server-side authorization. Infrastructure providers may process data for hosting, storage, email delivery, and app-store billing. Production provider contracts, regions, and subprocessors will be disclosed before public launch.
Security
BaubleStash uses server-side authorization, hashed session tokens, CSRF protections for browser mutations, private-by-default media responses, upload validation, metadata stripping, and bounded image processing. No system can promise absolute security.
Your choices
You can update supported collection details, revoke sharing access, withdraw an unaccepted invitation, and ask for account help at support@baublestash.com. You can export your data and request permanent deletion on the Account deletion page.
Contact
Privacy questions: privacy@baublestash.com. Security reports: security@baublestash.com. Catalog rights/takedown: takedown@baublestash.com.