Last updated 21 September 2026

Privacy policy

This policy explains what Elsewhere collects, why, and how long it is kept. It covers the Android app and this website, both run by [legal entity], [registered address].

1. What we collect

Your email address, used to sign you in and to tell you about your account. Encrypted files and the size of each, so we can store them and measure use against your plan. Random IDs for each phone you sign in on and each vault with a cloud copy. Basic subscription records: plan size, billing period, payment status. Technical logs, which can include your IP address, kept for a short time to prevent abuse and fix faults.

2. What we cannot collect

File contents, file names and folders are encrypted on your phone before upload. Vault passwords and recovery keys never leave the phone. We cannot decrypt your vaults, and there is no process by which access can be given to anyone, including us.

3. Why we process it

To provide the service you asked for (performance of a contract), to bill you and meet tax and accounting duties (legal obligation), and to keep the service secure and working (legitimate interest). We do not use your data for advertising and we do not sell it.

4. Analytics

The app contains no third-party analytics or advertising code. This website sets only cookies of its own: one keeps you signed in, one remembers the theme if you pick one, one lives two minutes while a sign-in comes over from the web app, and one remembers that you signed out. It loads nothing from other sites.

5. Who else is involved

Encrypted files are stored with Hetzner, in Helsinki, Finland. Payments on this site are handled by Dodo Payments, and subscriptions bought in the app by Google Play. Card details never reach us. Email is sent by Resend. Each of them is bound by a data processing agreement and receives only what it needs.

6. Retention

Encrypted files are kept while your account is active and for 30 days after it is deleted or lapses. They are then removed from live systems, and from backups within a further 60 days. Billing records are kept as long as tax law requires. Technical logs are kept for 30 days.

7. Your rights

You can ask for a copy of the data we hold about you, correct it, delete your account, or object to processing. The stored files are encrypted with keys we do not hold, so an export gives you encrypted data, which your app can read and we cannot. Write to privacy@stonesafe.app and we will answer within 30 days.

8. Legal requests

If we receive a valid legal order, we can produce only what we hold: an email address, subscription records, random IDs and encrypted files. We tell the people affected unless the order forbids it.

9. Children

The service is not directed at children under 13, and we do not knowingly create accounts for them.

10. Changes

We post every change on this page. For a material change, we email account holders at least 14 days before it takes effect.