Short version: your data lives in your browser. We see nothing. Below is the long version.
What we collect
When you sign in with Google, we store your name, email address, and profile photo — only to identify you across sessions and within shared workspaces. The financial data you enter is stored in your private workspace database, isolated from all other users.
Encryption
Your financial data is encrypted with AES-256 before it is written to the database. The encryption key is a server-side secret that is not stored in the database — so a database breach alone cannot expose your data. As the operator, we technically hold the encryption key and therefore have the technical ability to access your data. We do not access it, have no automated processes that read it, and never will. The encryption protects you against third-party breaches, not against the operator.
Who can see your data
Only you — and people you explicitly invite to your workspace — can access your data through the application. The operator (the person who built and runs Stand) has the technical ability to access encrypted data via the server-side encryption key, but does not and will not do so except if required by law. No automated process reads your financial records.
How we use your email
Your email address is used for two distinct purposes:
- Product emails — critical notices, security alerts, account changes, and responses to your support requests. These are sent to all registered users and cannot be opted out of (they are essential to the service).
- Newsletter — occasional emails with budgeting insights, financial tips, Stand updates, and honest notes. This is opt-in only. You choose during onboarding and can change your preference any time in Settings.
We never send unsolicited emails. We never share your email with third parties. We never sell your email address. To unsubscribe from the newsletter, go to Settings → Newsletter, or reply to any email.
What we don't do
We don't sell your data. We don't share it with third parties for any commercial purpose. We don't run ads. We don't use your financial data to train AI models. We don't sell or share your email with anyone.
Third-party services
Three services are involved in running Stand:
- Google OAuth — handles sign-in. We receive only the identity token; we never see your Google password.
- Upstash Redis — stores your encrypted workspace data.
- Vercel Analytics — anonymous page view counts only. No cookies, no personal data, no individual-level tracking.
Your rights
- Access — you can view all your data inside the app at any time.
- Export / portability — you can download a complete copy of your data at any time from Settings → Data → Export.
- Correction — all data is editable directly in the app.
- Deletion — you can request full permanent deletion at any time (see below).
- Withdraw consent — you can unsubscribe from the newsletter any time in Settings → Newsletter.
Data retention
Your workspace data is retained as long as your account is active. If your account has had no login activity for 24 consecutive months, we will send a notice to your registered email. If there is no response within 30 days, the workspace and all associated data will be permanently deleted. You can request deletion at any time before that.
Data deletion
You can request full deletion of your account and workspace data at any time by emailing us at
chhatrapalchoudhary101@gmail.com with the subject line
Delete my account. We will permanently delete all records within 7 business days and confirm by email.
Grievance officer
For any privacy concerns, data requests, or complaints, contact:
Chhatrapal Choudharychhatrapalchoudhary101@gmail.comBengaluru, Karnataka, India
We will acknowledge your complaint within 72 hours and resolve it within 30 days.
If anything changes
If we ever change how your data is handled, this page will be updated and all registered users will be emailed before anything takes effect. No silent changes, ever.