Privacy Policy

What we collect

Everything DocStash collects, and why.

When you connect an AI agent, it acts only as you, on your own account. We never receive the agent's conversation with you, only the tool inputs it sends us, such as the content of a document you asked it to create.

Your documents

You own the documents you create or upload. We store them only to run the service. We do not read, analyze, index, sell, or train AI models on them, and our staff do not access their contents except to debug an issue you report (with your consent), to investigate abuse, or where legally required.

How we use it

Only to run and improve DocStash and to keep it secure. We do not sell your personal information or run advertising trackers.

Communications

We may send you product updates, tips, and occasional marketing emails. You can opt out of marketing emails at any time using the unsubscribe link in any of them. We will still send essential account and security messages, which are needed to operate your account.

Aggregated data

We may create aggregated, de-identified, or anonymized data from how DocStash is used, and use or share it for our business purposes, including to analyze and improve the service. This data is never derived from the contents, names, or descriptions of your documents, and cannot reasonably be used to identify you.

Cookies

We set one essential session cookie that is httpOnly, Secure, and strictly necessary to keep you signed in. We don't use analytics, advertising, or third party tracking cookies.

AI tool integrations

When you connect an AI assistant (Claude, ChatGPT, Cursor, etc.) via MCP and ask it to read or write a document, the document content passes through that assistant's servers under its own privacy policy. We do not control how those providers process, store, or train on that content. Review the relevant provider's terms before sharing sensitive documents.

Public documents

Documents are private to you (or your org) by default. If you explicitly make a document public, from the web app or via the set_public_link MCP tool, its URL becomes reachable on the open internet by anyone with the link. Public documents are not indexed or advertised by us, but they are not authenticated either. You can revoke public access at any time.

Retention & deletion

We keep your account and documents for as long as you use DocStash. Deleting a document moves it to a trash bin you can restore from, and we don't auto-empty trash, so it stays recoverable until it is permanently deleted. An organization admin can permanently delete a trashed document from the app, which removes the file and its contents and can't be undone. To delete your entire account, email us at the address below and we'll remove your data within 30 days.

We may retain certain information for as long as necessary to provide the service and for legitimate business purposes, such as security and abuse prevention, audit and usage records, resolving disputes, enforcing our terms, and complying with legal obligations. Aggregated data is handled as described above.

Your rights

If you're in a jurisdiction with a data-protection law (GDPR, CCPA, and similar) you have the right to access, correct, export, or delete your personal data. Email us and we'll handle it.