Privacy Policy

StoneCloud · Effective date: 6 July 2026 · Last updated: 8 September 2026

This Privacy Policy explains how we collect, use, disclose, and protect your information when you use StoneCloud ("the app", "we", "us").

StoneCloud is provided by an individual developer (a sole trader) based in Australia, ABN 70 202 810 083. You can contact us about this policy or your data at support@stonecloudworks.com.

1. Information we collect

Account information — your email address when you register, and, if you choose social sign-in, the account identifier returned by Apple or Google. Passwords are handled by Firebase Authentication and are never stored by us in plain text.
Content you create — tasks, notes, tracking records, ledger and money entries, profile fields (such as region, currency, time zone, and optional tax-related fields you enter), and any files or attachments you upload.
AI input — the text, images, and documents you submit to AI-assisted functions. The app does not record audio and does not use a microphone.
Diagnostics — crash reports and basic technical information (app version, platform, device locale) used to keep the app stable.

2. How we use your information

To provide and sync your data across your devices.
To authenticate you and keep your account secure.
To power AI-assisted features when you choose to use them.
To diagnose crashes and improve reliability.

3. Infrastructure and sub-processors

We use Google Firebase (Firebase Authentication, Cloud Firestore, and Cloud Functions) to authenticate users and to store and sync your content. Your data is held on Google Cloud infrastructure. Data is encrypted in transit, and access to stored data is restricted to the accounts and services needed to operate the app. Some operational logs and security records may be retained for a limited period where reasonably necessary to maintain the security and integrity of the service.

4. AI processing, cross-border transfer, and long-term memory

When you use AI-assisted features, the content you submit is sent through our Cloud Functions (hosted in Google Cloud's australia-southeast1 region) to third-party AI providers to generate a response:

OpenAI — for text and image-based AI assistance and document understanding.

These providers may process your input on servers located outside your country (including the United States). Overseas recipients may not be subject to the same privacy protections as those under Australian law, and by using AI-assisted features you consent to this cross-border disclosure. We send only the content needed to fulfil your request. We do not use your content to train our own AI models. Third-party AI providers process your data in accordance with their own terms and privacy policies.

AI long-term memory (optional)

StoneCloud can build an optional long-term memory to personalise AI responses over time. This feature is off by default. Once you turn it on, we automatically compile short summaries of personal facts from your interactions with the AI, and you can review, edit or delete any individual item at any time, or turn memory off altogether. We store a de-identified summary — not the raw input text — in a separate memory store.

Cross-border disclosure: Where you have enabled memory, the stored summaries will be sent to OpenAI (located outside Australia) together with future AI requests, so the assistant can personalise its responses. By explicitly enabling AI long-term memory, you consent to this cross-border disclosure of memory summaries to OpenAI and its sub-processors.

Protection of sensitive information: The following categories are excluded from memory by default and cannot be stored or re-sent unless you separately and explicitly permit: health information (medical conditions, diagnoses, treatments), criminal history, financial account numbers (including credit card, bank account, PayPal, BSB, IBAN, SWIFT, and similar identifiers), and tax file numbers or ABN. When you delete individual items, they are immediately removed from memory and will not be sent in future AI requests.

Your control: You retain full control of this memory at all times. From within the app, you can view, edit, or delete individual remembered items at any time, and you can withdraw your consent to store and send memory entirely. Remembered items are included in your data export. When you delete your account, all remembered items are permanently removed within 30 days, except where retention is required by law.

5. Sharing

We do not sell your personal information. We share data only with the infrastructure and AI providers described above, as needed to operate the app, or where required by law.

6. Data retention

We retain your account and content for as long as your account is active. When you delete your account, we delete your content from Firestore and remove your authentication record, except where retention is required by law. Backups and provider logs may persist for a limited period before being overwritten.

7. Your rights and choices

Access — you can view your data inside the app at any time.
Deletion — you can permanently delete your account and associated data from Settings → Account → Delete account. If you no longer have the app installed, see Delete Your Account and Data for how to request deletion by email, what is deleted, and what may be retained.
Export — you can export your notes, time, money and statistics history from within the app (Stats → Generate History Backups), and you can view or remove individual AI memory items from Settings → Account → Manage AI memory. For a complete machine-readable copy of everything held in your account, request it by contacting us and we will provide it within the time required by applicable law.
AI features are optional — you are only asked to send content to AI providers when you actively use an AI feature.
AI memory control — AI long-term memory is off by default. If you turn it on, remembered items are compiled automatically, and you can view, edit, or delete each remembered item, or turn memory off entirely, at any time from within the app.
Complaints — if you have a privacy concern, contact us first and we will try to resolve it. Where the Australian Privacy Act applies, you may also complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. As a small business we may be exempt from parts of the Act, but we aim to follow the Australian Privacy Principles regardless.

8. Children

The app is not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date on this page.

10. Contact

If you have questions about this policy or your data, contact us at support@stonecloudworks.com.