Privacy and third-party services

DiapStash is designed to preserve your privacy. By default, the application sends none of your stock or history to any server. Your data stays on your device until you enable Cloud Sync.

This page details every service the application talks to besides your own device, which data it receives, and why. For the legal text, read the privacy policy. The code of everything described here is open source.

Overview

DiapStash account and Cloud Sync

Self-hosted. Sign-in, Cloud Sync and the DiapStash API (including the catalog) are hosted on our own servers, with no SaaS platform involved. Sign-in uses OpenID Connect on account.diapstash.com.

• Data received: your account identifier, and what you choose to sync: stock, change history, custom types, and sharing settings. Data is linked to a unique, randomly generated identifier.
• Why: to keep your devices in sync and to let you share a stock or a history.
• How to stop: disabling Cloud Sync in the application settings deletes the data from our servers (see Cloud Sync).

The catalog and its images are also served by DiapStash servers.

Error reports (Sentry)

Self-hosted. This is our own instance of Sentry, running on our servers (sentry.diapstash.com). Reports are never sent to Sentry's cloud service or to any other company.

• Data received: when the app crashes or hits an unexpected error, a technical report: the error message, the stack trace, the app version, the platform and system version, and the steps that led to the error (navigation breadcrumbs).
• What is not sent: your stock, your history, screenshots, view hierarchies, the list of packages. No usage metrics or analytics are collected.
• Why: to detect and fix bugs.

Feature flags (Flagsmith)

Self-hosted. This is our own instance of Flagsmith, running on our servers (features.diapstash.com). No data is sent to Flagsmith's cloud service or to any other company.

• Data received: an identifier to decide which flags apply to you: your user ID if Cloud Sync is enabled, otherwise a random device identifier generated by the application. The request is made in a transient way: the identity is not stored in the Flagsmith database. Flagsmith analytics are disabled.
• Why: to enable new features progressively, test them live without impacting all users, or activate a feature for a user who asked the DiapStash team for it.

Emails (Zoho CPaaS)

DiapStash sends transactional emails through Zoho CPaaS (formerly ZeptoMail), a third-party email delivery service, on its European infrastructure. It is used by two of our services:

• DiapStash account: the forgotten password email, sent only when you request it. It contains your username, a reset link valid for 15 minutes, and its expiry date. This is the only email sent by the account service today.
• Donations: your receipts, see Donations. For these emails, open and click tracking are disabled.

The service receives your email address (and your name or username), and the content of the message. No newsletter or advertising email is sent through it, and your email address is not used for anything else.

Push notifications (Apple and Google)

Push notifications are delivered by Apple (Apple Push Notification service, APNs) on iOS and by Google (Firebase Cloud Messaging, FCM, through Google Play services) on Android. They are the only way for DiapStash servers to reach your device when the app is closed.

When is it used?

Push is only used when you use features that involve DiapStash servers:

• Push updates (Cloud Sync): when you start or end a change, or record an accident on one device, your other devices are notified so they can refresh. It is turned on by default when you enable Cloud Sync.
• Sharing notifications: when someone you share a stock or a history with does something (uses a diaper from a shared stock, starts or ends a change, records an accident). See notifications. This is only active for the shares where you enabled receiving notifications.

It is never used for the reminders you configure (change reminders, night mode): they are scheduled on your device, with no server involved.

Push is not available on the web app, nor on Android 7.1 and older.

Which data is involved?

• A push token that identifies your device to Apple or Google. It is also sent to DiapStash servers, together with the platform (APNs or FCM) and the shared stocks you want notifications for, so they can address the push.
• The notification itself. It is a silent message that wakes the app, and the text displayed is built on your device. Apple or Google see that a message was delivered to your device, as with every push notification.

How to not use it

Any of the following is enough:

1. Don't enable Cloud Sync and don't use sharing. Without them, DiapStash never registers for push and never sends your token anywhere.
2. Turn off Push updates: in Settings → Cloud, disable Push updates. Your device then stops receiving pushes for your own changes, and the app unregisters it.
3. Turn off sharing notifications for a stock or history shared with you, from the sharing settings (see notifications).
4. Refuse the notification permission in the system settings. The pushes can't be displayed anymore. See Permissions.

Donations (Stripe)

Donations to the DStash Foundation are processed by Stripe, from the Support settings page. One-time and monthly donations are available. Nothing is sent to Stripe or recorded if you don't donate.

The donation part of DiapStash servers (the DSF backend) is a small service, self-hosted like the rest. It does not have a donor database: donor information lives in Stripe, and DiapStash keeps only what is needed to issue receipts and to publish the DStash Foundation's finances.

How it works

1. In the donation form, you enter an amount, a name and an email address (needed for the receipt only).
2. The app asks the DSF backend to prepare the payment. The backend creates (or updates) a Stripe customer with your name and email, and a Stripe payment (one-time donation) or setup (monthly donation). It sends back to the app a temporary secret to confirm the payment.
3. The payment form (the payment sheet) is displayed by Stripe's own component. You enter your payment details and billing address directly in it, or you pay with Apple Pay on iOS.
4. When the payment succeeds, Stripe notifies the DSF backend (webhook). For a monthly donation, the backend then creates the monthly Stripe subscription, which Stripe renews every month. The backend retrieves your name, email and billing address from Stripe, and issues your receipt.

Which data is involved?

Stripe also applies its own fraud prevention, which can collect technical information about your device and connection while you pay. This is handled by Stripe, under its own privacy policy.

What the DSF backend keeps

• Nothing about the donor in its own database. Its database only contains the DStash Foundation's accounting: for each donation, the net amount (after Stripe fees) and the Stripe charge reference, used to publish the DStash Foundation's budget. No name, email or address.
• The Stripe customer (name, email, billing address, payment method, subscription) is kept by Stripe, in the DStash Foundation's Stripe account.
• Receipts: the PDF receipt is built from your name, billing address, the date and the amount. It is sent to you by email, and the DStash Foundation keeps it for its accounting, as required by law.
• Technical logs of the servers record the requests received

Receipt email

The receipt is sent by Zoho CPaaS, see Emails. Your name and email address are only used to send you this receipt and, for a monthly donation, the following ones and a link to manage your subscription.

Monthly donations

A monthly donation is a Stripe subscription. You receive a receipt at each payment, with a link to the Stripe customer portal to update your payment method or cancel. The identifiers of your Stripe customer and subscriptions are kept in the application settings on your device.

Donating from the website

Donations made from the DiapStash website use Stripe Checkout, with the same backend and the same processing: Stripe collects your name and billing address on its own page.

Not using it

Donations are entirely optional, and the application works the same without them. To ask for a correction or a deletion of your data, contact us at [email protected], within what the law requires the DStash Foundation to keep for its accounting.

App stores

DiapStash is distributed through the Apple App Store and Google Play. These stores collect their own data (downloads, crashes if you opted in, device information) according to their own policies. DiapStash receives only anonymous aggregated statistics from them.

Open source

You don't have to take our word for it: the elements described on this page are open source, and their code is published on gitlab.com/diapstash. You can check what the application sends and how the servers handle it:

• the DiapStash application, including the push notifications plugin;
• the DiapStash account (sign-in, forgotten password email);
• the DSF backend (donations, receipts);
• the documentation and the website.

The third-party services themselves (Stripe, Apple, Google, Zoho CPaaS) are not part of this code and follow their own privacy policies.

What DiapStash does not use

• No advertising, and no advertising identifier
• No analytics or tracking SDK (no Google Analytics, Firebase Analytics, etc.)
• No social network SDK
• No location, contacts, or microphone: see Permissions