Effective date: August 6, 2026
1. Who we are
Stak is operated by WeStak, LLC, a New Jersey limited liability company.
136 Oakland Ave
Jersey City, NJ 07306
ahman@westak.co
This policy covers the Stak iOS app and the website at trystak.com. Together we call these the Service.
2. The short version
Stak connects to bank accounts you choose and shows you what is safe to spend. To do that, we receive information about your accounts and transactions.
We do not sell your information. We do not share it for advertising. We do not use it to build a profile that anyone else can buy. No merchant pays us to appear in Stak or to influence what Stak shows you.
You can disconnect a bank or delete your account at any time from inside the app.
3. Who can use Stak
Stak is for United States residents aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has given us information, email ahman@westak.co and we will delete it. If we discover it ourselves, we will delete it without waiting to be asked.
4. What we collect
| Category | What it includes | Where it comes from | Why we have it |
|---|---|---|---|
| Account information | Name, email address, password credential, profile photo if you upload one | You | To create and secure your account |
| Bank connection data | Account name, account type and subtype, the last four digits of the account number, current and available balances, currency, institution | Your bank, through Plaid | To calculate your Spending Power |
| Transaction data | Merchant name, amount, date, and category for transactions in connected accounts | Your bank, through Plaid | To identify recurring bills and produce Money Stories |
| Spending Power settings | Savings set-asides, committed bills you confirm or adjust, income cadence | You | To calculate the number the app is built around |
| Wishlist data | Items you save, including name, price, image, and retailer link | You, and the retailer pages you save from | To show you what you can afford |
| Money Stories | Short narrative summaries generated from the data above | Generated by us | To show you what changed and why |
| Device and usage data | Device identifiers, app version, screens viewed, features used, in-app events | Your device | To understand how the app is used and fix problems |
We do not collect your location. The app requests no location permission and contains no location code. Our analytics provider does derive an approximate city, postal code, and country from your IP address, as almost all internet services do. That is an estimate of the region you connect from, not your device's location.
We do not receive your full account number or your routing number. Only the last four digits.
We never receive your bank username or password. See the next section.
5. How the bank connection works
Stak uses Plaid Inc. to connect to your financial institutions. When you connect an account, you enter your bank credentials into Plaid's own interface, not ours.
We do not receive, see, or store your bank username or password at any point. Plaid gives us a token that lets us read the account information listed above.
Plaid is an independent company that handles your information under its own policies. Read Plaid's End User Privacy Policy before you connect an account. Plaid decides how long it keeps what it collects. We do not control that.
You can disconnect any account at any time in the app. See Section 8 for what happens to information we already have.
6. How we use your information
- To calculate and display your Spending Power.
- To identify recurring bills and upcoming obligations.
- To measure Wishlist items against what you can afford.
- To write Money Stories describing your account activity.
- To send you notifications you have not turned off, including occasional reminders in your first month.
- To operate, secure, debug, and improve the Service.
- To respond to you when you contact us.
- To comply with law.
We do not use artificial intelligence to process your transactions. Money Stories are produced by fixed templates from numbers we have already calculated. If that changes, we will update this policy before the change ships.
We do not make automated decisions about you and we do not profile you in any way that produces legal or similarly significant effects.
7. Who we share it with
We share only what each provider needs to do its job.
| Who | What they get | Why |
|---|---|---|
| Plaid Inc. | The connection token and requests for your account data | To retrieve information from your bank |
| Supabase | All stored account, bank, transaction, Wishlist, and Money Stories data | Database and authentication |
| Railway | Server traffic and application logs | Hosting for our backend |
| PostHog | Device identifier, app version, operating system, device model, locale, timezone, screens viewed, feature usage, and an approximate city derived from your IP address | Product analytics |
| Apple | Subscription and purchase information | Billing and push notification delivery |
No financial information is sent to our analytics provider. Analytics events record that something happened, such as opening the app or adding a Wishlist item. They do not carry amounts, balances, merchant names, or transaction details. The same events are also written to our own database.
We may also disclose information if required by law, to enforce our Terms, to protect someone's safety, or in connection with a merger, acquisition, or sale of assets. If ownership changes, we will notify you before your information becomes subject to a different privacy policy.
We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not allow any third party to use your financial data for their own purposes.
8. How long we keep it
| Data | How long |
|---|---|
| Account, bank, transaction, Wishlist, Spending Power, and Money Stories data | For as long as your account is open |
| Everything above | Deleted when you delete your account, immediately and permanently |
| Plaid connection token | Until you delete your account |
| Data from a disconnected bank | Kept until you delete your account |
| Application logs | Held in a rolling buffer on our servers, cleared on each deployment, and retained by our hosting provider under its own schedule |
| Database backups | None. Our database has no automated backups, so deleted data does not persist in one |
When you disconnect a bank account, we stop pulling new data from it immediately. The balances and transactions we already received stay in your account so your history does not disappear. To remove them, delete your account.
9. Your rights
Wherever you live in the United States, you can:
- Access the personal information we hold about you.
- Correct it if it is wrong.
- Delete your account and everything in it, from inside the app.
- Obtain a copy in a portable format.
- Opt out of notifications and non-essential communications.
- Limit how we use sensitive personal information. Financial account information is sensitive. We already use it only to operate the Service, never for advertising or profiling.
- Appeal if we deny a request.
Email ahman@westak.co to make a request. We will verify your identity by confirming control of the email address on your account, and we may ask for additional confirmation for sensitive requests. An authorized agent may submit a request with written proof of authority.
We respond within 45 days, and may extend once by another 45 days if the request is complex. We will tell you if we need the extension.
If we deny a request, you may appeal by replying to our decision. We will respond to the appeal within 45 days.
We will never discriminate against you for exercising these rights.
California residents. The categories of personal information we collect, our purposes, and the third parties we disclose to are listed in Sections 4 and 7. We have not sold or shared personal information in the preceding twelve months. Retention is in Section 8.
10. How we protect it
- All traffic between the app and our servers uses encrypted connections.
- Access to production systems is limited to people who need it.
- Your account data is protected by row-level security, so one user's records cannot be read by another.
- We monitor for errors and unusual activity.
No system is completely secure, and we cannot guarantee that your information will never be accessed without authorization.
11. If there is a breach
If personal information is exposed in a way that creates a risk to you, we will notify affected users and the appropriate authorities without unreasonable delay and as required by applicable law.
To report a security issue, email ahman@westak.co.
12. Changes
We may update this policy. If a change is material, we will tell you in the app and by email before it takes effect, and update the date at the top. Clerical corrections will not get advance notice.
13. Contact
WeStak, LLC
136 Oakland Ave
Jersey City, NJ 07306
ahman@westak.co