This policy explains how Stowfit handles personal data. The operator and controller is Berg Paul Razvan PFA, at Bulevardul Bucurestii Noi 136, Ap 5, Parter, 012366 Sector 1, Bucuresti, Romania. Contact: prberg@proton.me.
Contents
Data, purposes, and legal bases
Bag photos, measurements and local checks
Purpose
We process the bag photo you take or select to provide the requested photo estimate. Before upload, the app makes a compressed JPEG no larger than 1568 pixels on either axis and 2 MB and removes source metadata. The AI receives that image, not your selected airline, fare or weight. The app computes comparisons locally using the airline catalog. Manual dimensions, optional measured weights, photo estimates, corrections, policy snapshots and saved checks stay in local history unless you choose to share them. Without a photo, online photo estimation is unavailable; manual comparisons and the labeled sample work offline.
Legal basis
Performance of our contract with you, including the free features you request (GDPR Article 6(1)(b)). We do not request sensitive personal information for these functions.
Installation, purchase and usage information
Purpose
We use a random installation identifier, signed Apple purchase information, network address and quota counters to verify paid access, restore purchases, administer allowances and prevent abuse. The quota database receives keyed hashes of installation, original purchase transaction and address values, not raw purchase proofs, photos or raw addresses. Online requests require these checks; there is no Stowfit account or cloud-history signup.
Legal basis
Performance of contract for allowance administration, purchase verification and restoration (Article 6(1)(b)); our legitimate interest in preventing quota evasion, fraud and service abuse and protecting fair access (Article 6(1)(f)).
Support and feedback
Purpose
If you send feedback, we receive your message, optional reply email, app platform and delivery metadata. The app attaches app version/build, bundle identifier, device model, operating system version, locale, screen dimensions and scale. These attachments exclude your device name, installation identifier, photos, check contents and purchase proofs. Fixed technical error reports contain a failure code and limited operational metadata. Providers receive the network information needed to deliver requests and email. Support is optional and free. Opening an email draft does not send it; server acceptance of a message does not prove inbox delivery.
Legal basis
Performance of contract for support needed to provide your service or subscription (Article 6(1)(b)); our legitimate interests in responding to general inquiries, preventing spam and administering reliable support delivery for other correspondence and delivery records (Article 6(1)(f)).
Reliability diagnostics and service network metadata
Purpose
Release builds automatically send crashes and selected errors to GlitchTip. Reports contain event time, crash type, stack traces or symbol addresses, app version/build, fixed failure codes and limited component/operation metadata. Server reports may include an allowlisted API route and release label. GlitchTip receives the sender network address and its project setting masks stored IP addresses; the transport address may be device-network or hosting-service egress. Payloads exclude photos, prompts, model responses, check contents, installation identifiers, purchase proofs, request bodies/headers, user profiles, screenshots, recordings and breadcrumbs. Tracing, replay and advertising analytics are disabled, and there is no in-app diagnostics opt-out. Hosting services also process network and security metadata when you use the API or these static pages.
Legal basis
Our legitimate interest in diagnosing failures, maintaining reliability and protecting service security (Article 6(1)(f)). Collection is limited to those purposes and is not used to advertise to you or profile you. You may object through the privacy contact.
Storage on your device
The app keeps the latest 30 checks on your device, including normalized photos where present, estimate uncertainty, manual corrections, measurement provenance and airline-policy snapshots. This protected history is excluded from backups and has no age-based expiry; clearing it or replacement by newer checks removes the matching photos. Original high-resolution images are not saved by Stowfit. The labeled offline sample may be saved as a sample check. A cached airline catalog supports offline use. Preferences stay on the device. The random installation identifier is stored in device-only Keychain and may survive uninstalling and reinstalling. Purchase proofs are refreshed from Apple and held in memory. Pending crash reports may be cached until delivery or SDK eviction. An unsent feedback draft, optional reply email, request UUID and captured app/device metadata are saved in protected, backup-excluded local storage until accepted for delivery or explicitly discarded; edits replace the draft. Reports are prepared on demand in memory as a PDF and a first-page image. The system sharing framework creates a temporary export copy; Stowfit keeps no permanent report archive. Copies you send to other apps are controlled by you and those recipients.
Cloud storage and accounts
We operate no Stowfit app account, cloud history or photo-sync service, and do not intentionally persist submitted photos or inference responses in the Worker. Cloudflare hosts the API and static pages on its distributed network. Vercel AI Gateway routes the normalized photo to Google for structured bag estimation. The code requests EU provider inference and rejects a response unless its final served attempt confirms that region. This does not pin Gateway ingress or the network path to the EU. Upstash quota/support storage uses the existing apps-support database in AWS EU-WEST-1, with separate Stowfit namespaces. GlitchTip diagnostic storage uses its independent EU instance in Frankfurt, Germany (DigitalOcean FRA1). Support email is delivered through Cloudflare to our Google Gmail inbox; our public privacy/legal contact uses Proton. Providers can separately retain operational, security and access records.
Recipients and service providers
Providers include Cloudflare (API/static hosting and feedback email delivery), Vercel AI Gateway and Google (photo inference), Upstash (keyed quota and support-delivery records), GlitchTip operated by Burke Software and Consulting LLC (crash/error diagnostics), and Google/Proton (support and contact email). Each receives data needed for that function. Apple separately handles Apple Account and payment information under its privacy terms; we receive entitlement and transaction information, not payment-card details. We use no advertising SDK, ad targeting or app-usage analytics, and do not sell personal information. Provider terms: https://www.cloudflare.com/cloudflare-customer-dpa/; https://vercel.com/legal/privacy-notice; https://vercel.com/legal/dpa; https://cloud.google.com/terms/cloud-privacy-notice; https://upstash.com/static/trust/dpa.pdf; https://glitchtip.com/legal/data-processing-agreement/; https://policies.google.com/privacy; https://proton.me/legal/privacy; https://www.apple.com/legal/privacy/.
International transfers
Our operator is in Romania. The selected Upstash database and GlitchTip event storage are in the EU, and the inference policy requests EU provider processing/storage. The overall service is not EU-only: Cloudflare and Gateway networking, provider subprocessors, email services and authorized operation/support access can involve the United States and other countries. GlitchTip EU data is not replicated to its US instance, but Cloudflare edge processing and access by its US operator can occur outside the EU. Provider data-processing agreements provide applicable safeguards for restricted transfers, including European Commission Standard Contractual Clauses and UK addenda where relevant; adequacy decisions apply where available. Contact us for details or copies of safeguards relevant to your data, subject to necessary redactions protecting others.
Retention
Local history retains the newest 30 checks and associated normalized photos until you clear them or newer checks replace them. Unsent feedback and its reply email, request UUID and captured metadata remain in protected local draft storage until accepted or discarded; editing replaces that draft. Generated reports are held in memory and sharing uses a framework-managed temporary copy, not a permanent Stowfit report archive. Preferences and the device-only Keychain identifier have no automatic age expiry; Keychain can survive reinstall. Free installation-quota hashes and counters have no automatic expiry because they enforce a lifetime installation allowance, and remain while needed for that allowance and service operation, subject to applicable deletion rights. Paid quota buckets expire one minute after 00:00 UTC on the first day of the next month. Daily photo-abuse address buckets expire at 00:00 UTC two days after the bucket day starts. Support hour/day counters expire after two hours/two days, and feedback fingerprints and acceptance receipts after 25 hours. Redis holds hashes/counters/receipts, not message text or reply addresses.
Our safe Worker request/error logs are kept for up to seven days in Workers Logs. They contain allowlisted method/route/status, release and fixed diagnostic metadata, not photos, proofs, raw addresses, installation identifiers or request contents. Other provider security/network records follow their operational and legal retention criteria. GlitchTip Free retains events for 30 days; deleted data may remain in encrypted backups for up to 35 further days. Pending device reports remain until delivery or SDK eviction.
Vercel states that Gateway prompts and outputs are deleted when a request completes. Upstream AI services can retain data for security, abuse prevention, caching or legal duties under their applicable route and agreement. The app does not enforce an end-to-end zero-retention guarantee. Gateway routing-attempt details are retained for 30 days; usage/billing/security metadata can be retained separately. Support correspondence is kept while resolving a matter and afterward only as needed for related follow-up, disputes or required business records. Provider backups, where maintained, expire under their deletion cycles and are restricted from ordinary use after eligible deletion. Legal-obligation or actual-claim records are retained only as needed for that obligation or claim.
Deletion
Clear saved checks in the app deletes local history and its matching saved photos. Discard an unsent feedback draft separately to remove its local message, reply email and captured metadata. There is no Stowfit account to delete. To request deletion of personal data held by us or our processors, email prberg@proton.me. We ask only for information reasonably needed to verify and locate your records. An approximate time, app version or event reference can help locate diagnostics; those reports do not contain your installation identifier, and we do not collect extra identity data solely to make otherwise unidentifiable records identifiable. We erase eligible live records and request processor deletion where applicable; protected backups expire through their cycles. We explain any necessary legal-obligation or claim exception. Clearing history or uninstalling does not erase remote diagnostic/support records, cancel a subscription or necessarily remove the Keychain identifier. Copies of reports you share are subject to the recipients you choose.
Security
Hosted requests use HTTPS. The installation identifier is in device-only Keychain; saved history/photos use protected local storage excluded from backups. Quota keys use HMACs and separate product namespaces. Apple purchase verification and server admission control paid use. Diagnostics rebuild events from an allowlist, removing arbitrary text and request content, and disable screenshots, tracing and replay. GlitchTip receives the transport address before its stored-IP masking. These safeguards reduce exposure but cannot guarantee absolute security.
Your rights and choices
Depending on applicable law, you may request access, correction, erasure, restriction and portability of your personal data. You may object to processing based on legitimate interests for reasons relating to your situation; we stop unless overriding compelling grounds or legal-claim grounds justify continuing. Where consent is the basis, withdrawal does not affect earlier lawful processing. Contact prberg@proton.me. We normally respond within one month; if complexity or volume requires up to two additional months, we explain that within the first month. We explain a refusal and complaint options. Rights apply subject to their legal conditions.
Complaints
You may complain to Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP), https://www.dataprotection.ro/, or another competent supervisory authority, including where you live or work in the EEA or where an alleged infringement occurred. You do not have to contact us first.
Children and intended audience
Stowfit is an adult travel utility intended for people aged 18 or over and is not directed at children. We do not knowingly collect children’s personal information. If you believe a child submitted personal information, contact us so we can investigate and delete it where appropriate.
AI, sensitive inputs, and automated decisions
Online photo checks send one normalized bag image through Vercel AI Gateway to a Google Gemini model for structured observations, uncertain dimension intervals and abstention where a defensible estimate is unavailable. The app compares the returned intervals locally with its airline catalog. We do not use your inputs to train our own models. Google commercial AI terms restrict training use, while permitted safety/abuse processing, caching, retention and authorized personnel access depend on the provider route and agreement. We do not promise that no human can ever access data.
Keep faces, addresses, luggage labels, boarding passes, personal documents and sensitive information out of the photo. We do not need special-category personal data or intentionally analyze it. GlitchTip event payloads exclude these inputs. Results are advisory for your review; they are not a decision about you with legal or similarly significant effects. They cannot determine weight, fare entitlement, compression, airline acceptance or fees.
Questions and changes
Contact prberg@proton.me with privacy questions or requests. The effective date above identifies this version. Material changes will be communicated as required by applicable law.