Privacy

This page describes how StoreStage treats your projects. It is a product notice, not legal advice. Last updated 7 October 2026.

Local-first drafts

If you are not signed in, projects, screenshots, logos, and fonts stay in this browser (IndexedDB / localStorage). StoreStage does not upload them in the background. Moving a project to an account is an explicit action.

When you create an account

We store the email and sign-in providers you use, cloud project documents you choose to sync, asset files you upload, export-ledger counts, and billing status from Paddle. Service-role keys and Paddle secrets never ship in the browser bundle.

Payments

Card and tax details are processed by Paddle. StoreStage keeps subscription status and Paddle customer/subscription identifiers so entitlements can be enforced server-side. Refunds are described on the refund policy.

Support

The support form sends your name, email, topic, message, and optional Paddle transaction ID to StoreStage through Postmark. The submission also includes the network address and browser user agent so we can reply, rate-limit abuse, and diagnose delivery. Your request is delivered to [email protected], and we send an acknowledgement and support replies to the email address you provide. We also store the request and replies in our Supabase database for authorized support staff. Database support requests and replies are deleted 180 days after submission or the latest staff reply, whichever is later. Our support inbox and Postmark sending logs have separate retention policies; deleting a database request does not delete those copies. Submitting the form also sends the CAPTCHA token and network address to Cloudflare Turnstile so we can reject automated abuse. Cloudflare does not receive the message body. That verification is processed under Cloudflare's privacy policy.

Analytics and errors

If product analytics is configured, StoreStage records funnel events such as opening the editor, starting checkout, or viewing a paywall, and which StoreStage pages are viewed. Page views record the page path (never the query string), the referring site, campaign (UTM) parameters, and a coarse browser, operating system, and device type so we can see where visitors come from and which devices they use. IP addresses are never sent to PostHog or used for location. To limit abuse, our server keeps a one-way hash of the address in its rate-limit table. Counters expire after a minute, and a scheduled job deletes expired rows every 15 minutes, so a hash is kept for at most about 16 minutes. A random identifier in your browser's local storage links events from one browser; it is tied to your account once you sign in. Staff pages are not tracked. Event payloads are allowlisted. Screenshot pixels, logos, fonts, passwords, and long base64 strings are stripped. Analytics is off when no server key is set.

If error monitoring is configured, StoreStage sends crash reports to Sentry. Request bodies, cookies, account emails, and screenshot or logo bytes are stripped before upload. Errors from the MCP endpoint carry a one-way, keyed hash instead of your account id or email (the id itself is never sent), plus the connecting app, your plan and the tool name, so one affected account is counted once. Session Replay is not used, so the editor canvas is not recorded. Error monitoring is off when no DSN is set.

Your controls

Signed-in users can download a JSON export of account metadata and project documents (without binary assets) and can delete the account. Deletion cancels an open Paddle subscription immediately when the API is configured, removes cloud rows and stored files, then deletes the auth user. To send the deletion confirmation after an interrupted request, we temporarily retain the recipient address for up to seven days; it is removed by scheduled maintenance after a delivery attempt or expiry. Local browser drafts are not cleared by account deletion.

Manage data from your account. See also Terms.

Contact

Privacy questions: Support.