Stapel

Nederlands

Privacy statement

Privacy

This page is the source. If the app changes, this page changes in the same commit.

Responsible
Robin Speekenbrink, Haarlem, the Netherlands. A private individual, not a company.
Applies to
The Stapel Android app and this website.
Last changed
Status
The app has not been released yet. This statement describes the app as it will be published.

What Stapel does not do

The short version is a list with nothing in it

  • No account
  • No sign-in
  • No user id
  • No analytics
  • No crash reporting
  • No advertising id
  • No ad network
  • No offers feed
  • No Firebase
  • No Google Wallet
  • No location history
  • No server of ours

There is no server of ours for your data to go to. It does not exist, and that is an architecture rather than a promise. What we do claim is narrower and more precise: no network call you did not ask for. Two calls, both described in full below, and neither carries anything about you.

What Stapel stores, and where

Everything the app keeps. The "leaves the device" column is the point.
Data Where it lives Leaves the device
Card numbers and barcodes Local database on the device Never
Card names, chains, notes, folders, ordering Local database on the device Never
Photos you take of a card The app's local storage Never
Voucher expiry dates and balance text Local database on the device Never
Your location In memory only, to work out which shop is near Never
Shops you pin yourself A separate table the sync never touches Only if you compose and send a mail about one yourself
Settings Local preferences on the device Never

There is no server of ours for any of this to go to. It does not exist.

Every network call the app can make

Two. This is the complete list, not a selection.

1. Refreshing the store list

When
Automatically, at most once a month, unmetered Wi-Fi only. It cannot run on mobile data.
What
One unauthenticated GET to one fixed, public address. No account, no device id, no card data, no location, no analytics, no cookies.
Size
With If-None-Match, so a check that finds nothing new costs a few hundred bytes.
Verification
ECDSA P-256 signature with SHA-256, checked before anything is parsed. An older version is rejected; the previous file stays in place until the new one parses cleanly.
Default
On, with one switch to turn it off. Off, the bundled list keeps working.

The honest limit. A download reveals your IP address to the server serving the file, like any other download. If you would rather not, switch the sync off.

2. Looking up an address for a shop you pin yourself

When
Only when you press the "find the address" button. Never on its own, never in the background.
What
One reverse lookup of the coordinates you just captured, through Android's own Geocoder. On most devices that question goes to Google, with those coordinates attached. That is stated on the button.
Required
Never. An address is decoration; coordinates are what makes the alert work.
If it fails
Nothing. The field stays empty, the pinned shop works fine.

There is no third party. No analytics SDK, no crash reporting sent anywhere, no advertising id, no Firebase, no Google Wallet, no fused location, no A/B testing service, no font from someone else's server.

Permissions, and why each one

Seven. A test in the source code asserts that the app requests exactly these and no others, so this list cannot quietly go stale.

The complete permission set, checked against the manifest on 4 September 2026.
Permission What for Required
CAMERA Scanning a barcode. No image is stored or sent No, only for scanning
INTERNET The two calls above and nothing else Yes, but the sync can be switched off
ACCESS_COARSE_LOCATION Which shop is nearby, only while the app is open No, only for arrival detection
ACCESS_FINE_LOCATION Accurate enough to tell a shop from its neighbour No, only for arrival detection
ACCESS_BACKGROUND_LOCATION Putting the card up while the app is closed. Only after a separate screen explaining the cost No, off by default
POST_NOTIFICATIONS Arrival notifications and warnings about a voucher expiring No
RECEIVE_BOOT_COMPLETED Re-arming proximity alerts after the device restarts No, only for background arrival detection

Location

Arrival detection is off by default. On, the app hands Android's proximity alerts the coordinates of roughly the twenty nearest stores, and Android taps the app when you enter one. No location history, no trail, no coordinate sent, no Google Geofencing API and no fused location. The only exception is the button in section 2.

Backup: read this bit

Two things can make a copy of your cards, and they are not the same.

The export you make
An encrypted file you save wherever you want. We hold no key to it and never see it.
Android Auto Backup
An operating-system feature. If it is on, Android itself puts a copy of the app's data into your Google account, encrypted with your screen lock. Nothing reaches us, but your card numbers do end up in a Google account. Switch it off under Settings → Google → Backup; the app says this on the backup screen too.

Google Play Services is in the app

Google Play Services ships inside the install package, for on-device barcode scanning and nothing else. The scanning library cannot be separated from it; that was attempted in every version.

  • The model runs locally. No photo and no code goes to a server.
  • The app talks to no Google service on its own initiative.
  • Only the scanner component. No Wallet, no Firebase, no fused location, no geofencing, no analytics, and the build fails if any of those creep in.
  • So we say "no Google network call, no account, no analytics" rather than "no Google code". It is also why Stapel will not be on F-Droid.

Deleting your data

Uninstalling erases everything: no copy elsewhere, no account to close. Delete your own export yourself, and an Auto Backup copy through your Google account's backup settings.

For the Play data-safety form

This block exists to be copied verbatim into the Play Console. The page is the source; the store listing is the copy.

Answers to the data-safety form.
Question Answer
Does the app collect user data? No
Does the app share data with third parties? No
Is data encrypted in transit? Yes, as far as anything is transmitted at all. The store list is fetched over HTTPS from one fixed host and sends nothing about you. Press “look up the address” and the coordinates you just pinned go over HTTPS to Android’s Geocoder
Can users request deletion? Uninstalling erases everything. Nothing is stored remotely to delete
Location Used on the device, optional, off by default. Not collected and not stored off the device. One exception, which you switch on yourself: the “look up the address” button shares that single coordinate with Android’s Geocoder
Photos and camera Imagery is processed on the device to read a barcode. Not stored and not transmitted
Personal info, financial info, contacts, messages None of these are collected
Analytics, crash reporting, advertising id Not present
Backup note Android Auto Backup may copy app data into the user's own Google account. That is a platform feature, it can be switched off, and the developer receives nothing

This website

No scripts, no cookies, no analytics, no Google fonts, no CDN, no embedded video, no share buttons, no request to any other server. That is why there is no cookie banner: there is nothing to consent to.

The hosting provider, like any web server, sees your IP address and user agent in its own logs. We have no access to those.

Your rights under the GDPR

The GDPR gives you the right to access, correct and delete personal data someone processes about you. Here there is nothing to access: no personal data about app users is processed, and there is no dataset you could appear in.

If you find a call that is not described here, we want to hear it through Contribute. A hole in this page is a bug.

When this page changes

Changes appear in the release notes. If the promise narrows, it is narrowed here in the same change that alters the app.