Privacy Policy & Data Disclosures
Comprehensively disclosing data collection, handling, storage, security, and third-party processing across the Stackly Web Platform and official Stackly Chrome Extension (Version 1.0.2).
UDP Compliant
Chrome Developer Rules
AES-256 / TLS 1.3
Encrypted End-to-End
No Data Selling
100% Data Protection
GDPR & CCPA
User Data Rights
At-A-Glance Privacy Summary
Data We Collect
Name, Email, password hash for accounts. Destination URLs, custom aliases, QR configs, click counts, browser user-agent, coarse country/city from IP. Chrome extension collects active tab URL strictly on user click.
How Data is Used
Strictly to deliver link shortening, QR generation, user auth, analytics dashboards, abuse prevention, and billing. We NEVER run background history harvesting or use data for targeted advertising.
Sharing & Control
We NEVER sell your data. Data is processed only by essential infrastructure providers (AWS, PostgreSQL, Stripe, Cloudflare). You can export data or request full deletion anytime at privacy@stackly.in.
Overview & Scope
This Privacy Policy applies to Stackly (accessible via https://stackly.in), its subdomains, backend services, and the official Stackly Chrome Extension (Version 1.0.2), operated by Forepine Technologies Pvt. Ltd. ("we", "us", or "our").
We are committed to respecting your privacy, safeguarding your personal data, and maintaining maximum transparency regarding how user data is collected, handled, processed, stored, and shared.
Core Privacy Guarantee
Stackly operates under a strict No Data Monetization Guarantee. We never sell, rent, license, trade, or transfer your personal information, browsing history, or URL activity to third-party data brokers, marketing networks, or credit reference agencies.
Chrome Extension User Data Privacy & Prominent Disclosure
Google Chrome Web Store UDP Disclosure
Compliance Reference: User Data Privacy & Prominent Disclosure Standard
The Stackly Chrome Extension interacts with user browser data solely to deliver explicit, user-initiated link shortening and QR code generation actions. Below is a comprehensive breakdown of all data collection, storage, and permission usage within the Chrome Extension.
1. What Data the Chrome Extension Collects & Transmits
Active Webpage URL & Page Title
Trigger: Collected ONLY when you explicitly click the Stackly extension popup button ("Shorten Current Page") or use the right-click context menu ("Shorten Page Link").
Non-Background Operation: The extension does NOT read, capture, or log your browsing history or open tab URLs while running silently in the background.
User Authentication Session Token
When logged into your Stackly account within the extension, a secure JWT session token is stored locally in your browser's isolated chrome.storage.local area.
This token authenticates API calls made directly to https://api.stackly.in.
2. What the Chrome Extension Does NOT Do
- No Background Activity Tracking: We do not track, index, monitor, or harvest URLs of pages you visit while browsing the web.
- No Form Field Capture: We do not read keystrokes, password fields, personal credentials, payment details, or form contents on web pages.
- No Targeted Advertising: Extension user data is never utilized for targeted ads, creditworthiness scoring, lending decisions, or data resale.
Chrome Extension Permissions Breakdown
In accordance with Google Chrome Web Store Single Purpose and Minimal Permission policies, the Stackly extension requests only the minimum set of permissions strictly necessary to function:
| Permission | Technical Name | Purpose & User Action | Scope & Storage |
|---|---|---|---|
| Active Tab | activeTab | Allows reading the current tab's URL and title only when you click "Shorten Current Page" or right-click to shorten link. | User-initiated only. Never silent. |
| Local Storage | storage | Persists user auth tokens, default alias preferences, and active theme locally inside browser. | Stored strictly in local browser storage. |
| Context Menus | contextMenus | Adds convenient right-click context menu options ("Shorten with Stackly") for highlighted links and page URLs. | Triggers action only upon user click. |
| Host Permissions | https://*.stackly.in/* | Allows secure HTTPS API communications between the Chrome Extension and Stackly cloud servers to create links & QR codes. | Encrypted TLS 1.3 endpoints. |
Google API Services User Data Policy & Limited Use Disclosure
Google API Services User Data Compliance
Compliance Reference: Limited Use Disclosure
Stackly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
1. Google OAuth & Google API Scopes Requested
Stackly requests only the minimum necessary Google permissions required to enable user authentication and user-requested Google Sheets synchronization features:
| Google Scope | Technical Scope URI | Purpose & Functionality | Storage & Handling |
|---|---|---|---|
| User Email | .../auth/userinfo.email | Used to identify your account and create a seamless single sign-on (SSO) experience with Google. | Stored in your account profile. |
| Basic Profile | .../auth/userinfo.profile | Used to populate your user name and profile picture avatar within the Stackly dashboard. | Stored in your account profile. |
| Google Sheets | .../auth/spreadsheets | Enables optional, user-configured automated syncing of shortened link click logs, visitor timestamps, and analytics into user-selected Google Sheets. | User-initiated only. Never accessed without user configuration. |
| Google Drive Files | .../auth/drive.file | Allows Stackly to create new spreadsheet files or access only the specific spreadsheets created or opened by Stackly for link analytics export. | Limited strictly to files created or selected by the user. |
2. How Google User Data is Protected & Stored
Token Encryption (AES-256)
All Google OAuth access tokens and refresh tokens received from Google authorization servers are encrypted at rest using industry-standard AES-256 encryption. Tokens are only decrypted in volatile memory during active API synchronization requests.
Strict Purpose Limitation
Google user data is accessed strictly to provide user-facing features (logging into Stackly and synchronizing link analytics to your connected spreadsheet). We do not access, process, or retain any data outside of these declared features.
3. Google User Data Strict Prohibitions & Non-Sharing Guarantees
- No Data Resale or Advertising: Google user data is never sold, leased, or transferred to third-party data brokers, ad networks, or credit assessment platforms under any circumstances.
- No AI/ML Model Training: Google user data is NEVER used or transferred to develop, train, fine-tune, or improve generalized Artificial Intelligence (AI) or Machine Learning (ML) models.
- No Human Inspection: No human at Stackly or Forepine Technologies Pvt. Ltd. reads or inspects your Google user data or spreadsheets, unless you provide explicit consent to resolve a specific technical support issue, for security investigations, or as required by law.
4. How to Revoke Access & Delete Google Data
You retain full control over Stackly's access to your Google account at all times:
Revoke via Google Account Security
You can revoke Stackly's access to your Google account at any time by visiting your Google Third-Party App Permissions and removing Stackly.
Disconnect via Stackly Dashboard
Navigate to Dashboard > Settings > Integrations and click "Disconnect Google Account" or "Disconnect Google Sheets". This immediately revokes and permanently deletes all stored tokens on our servers.
Web Platform & Service Data Collection
When you register an account on the Stackly web platform or create shortened links, we collect the following categories of data:
- User Profile: Full name and email address provided during signup.
- Authentication Credentials: Password stored strictly as a secure one-way salted hash (bcrypt/argon2). Plaintext passwords are never stored.
- OAuth Identifiers: Account ID, profile name, avatar URL, and email if signing up via Google OAuth or GitHub SSO.
- Destination URLs: Long target URLs, custom link aliases, campaign tags, and QR code configurations.
- Visitor Click Analytics: Click timestamps, referrer header, browser user-agent (browser type and OS), and coarse geographic location (country/city derived from IP address).
- IP Address Handling: IP addresses are processed in real-time to compute coarse location metrics and block malicious bot traffic, but are anonymized and not stored in raw format.
How We Use Collected Information
We process your information strictly for legitimate, declared business purposes:
1. Deliver Core Platform Tools
To shorten URLs, generate dynamic QR codes, render digital business cards, route clicks to destination pages, and compute dashboard analytics.
2. Account Management & Support
To manage user authentication sessions, handle password resets, send transactional billing updates, and respond to technical support tickets.
3. Platform Security & Anti-Abuse
To detect and block phishing, malware links, DDoS attacks, unauthorized account access attempts, and automated spam activity.
Third-Party Data Sharing & Infrastructure Disclosures
To provide robust edge infrastructure, global link redirection, and billing, Stackly engages trusted third-party sub-processors. All sub-processors adhere to strict data protection standards and are prohibited from using your data for any unauthorized purpose:
| Service Provider | Category / Role | Data Processed | Security & Compliance |
|---|---|---|---|
| Amazon Web Services (AWS) / Render / Vercel | Cloud Hosting & Edge Routing | Encrypted database records, static assets, backend API workloads. | SOC 2 Type II, ISO 27001 |
| PostgreSQL Managed / MongoDB Atlas | Database Infrastructure | User account metadata, shortened link configs, hashed credentials. | AES-256 at Rest Encryption |
| Stripe Inc. | Payment Processing | Subscription billing details, transaction IDs. Stackly never stores raw credit card details. | PCI-DSS Level 1 Compliant |
| Cloudflare Inc. | CDN, SSL & DDoS Protection | Edge traffic routing, SSL certificate termination, bot filtering. | TLS 1.3 Encrypted Transit |
Data Handling, Storage, Security & Retention
TLS 1.3 Encryption
All data in transit between web app, Chrome Extension, and API is encrypted via TLS 1.3 SSL.
AES-256 Storage
All database backups and persistent disk storage are encrypted at rest with AES-256.
Retention Schedule
Active account data retained while account is open. Account deletion purges data within 30 days.
User Data Control, Rights & Deletion Procedures
Regardless of your geographic location, Stackly guarantees full control over your personal data:
How to Delete Your Data & Account
1. Self-Service: Navigate to Dashboard > Settings > Account Settings and click "Delete Account". This immediately disables your account and queued links.
2. Direct Request: Email our Privacy Officer at privacy@stackly.in with the subject line "Data Deletion Request". Requests are verified and fulfilled within 7 business days.
Data Export Rights (Data Portability)
You can download a full CSV/JSON export of your shortened links, custom domains, QR codes, and click analytics at any time directly from the Stackly Dashboard.
Children's Privacy & International Compliance
Children's Privacy (COPPA): Stackly services and Chrome extension are intended for general professional audiences and are not directed to children under the age of 13. We do not knowingly collect personal information from individuals under 13 years of age.
Global Data Regulations: Stackly complies with applicable data protection legislation including EU General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA/CPRA), and the Digital Personal Data Protection (DPDP) Act.
Policy Changes & Contact Information
We may update this Privacy Policy from time to time to reflect platform enhancements, Chrome Web Store policy revisions, or legal requirements. Material updates will be announced via email and prominent in-app notification before changes become effective.
Privacy Email: privacy@stackly.in
Support Email: support@stackly.in
Turnaround: Within 24-48 Business Hours