Privacy Policy.

operated by moqa studio · last updated september 7, 2026

/ overview

Upstacked (formerly Dump It.) is designed with privacy at its core. Your saved links, articles, highlights, and reading history are stored locally on your device and are never uploaded to our servers. We only collect the minimum data necessary to provide authentication, subscription management, and the optional AI digest feature.

/ 1. information we collect

1.1 Account information

When you sign in with Apple, we receive:

• Your Apple ID email address (or Apple’s private relay address if you choose to hide your email)
• Your name (if you choose to share it)

This information is stored securely via Supabase Authentication and is used solely to authenticate your account. We do not use your email for marketing or share it with third parties.

1.2 Locally stored data

The following data is stored exclusively on your device in a local SQLite database and is never transmitted to any server:

• Saved links (URLs, titles, descriptions, images)
• Article content extracted for offline reading
• Categories and organizational data
• Text highlights and annotations
• Reading status (read/unread)
• Cached images and favicons
• App preferences (theme, text size, notification settings)

This data remains on your device. If you delete the app, this data is permanently deleted.

1.3 Analytics data

We use PostHog (hosted in the EU) to collect anonymous usage events to understand how the app is used and improve it. Autocapture is disabled: we only track specific, manually defined events:

• Feature usage events (e.g., “link saved”, “category viewed”, “digest generated”)
• Associated metadata: category name, domain name, save count
• Subscription events (paywall shown, plan selected)

We do not track:

• The specific URLs you save
• The content of articles you read
• Your browsing history
• Any personally identifiable information through analytics
• Device location

You cannot currently opt out of analytics within the app, but the data collected is anonymous and cannot be linked to your identity.

1.4 AI digest data

When you generate a weekly digest, the following data is sent to our server (a Supabase Edge Function) for processing by Anthropic’s Claude AI:

• Titles, domains, categories, and descriptions of your unread links from the current week
• Extracted article content (if available)
• Aggregate reading statistics (total saved, total read, top categories)

This data is:

• Transmitted over HTTPS (encrypted in transit)
• Processed in real-time to generate your digest
• Not stored on our servers after processing
• Not used to train AI models: Anthropic’s API usage policy prohibits using API inputs for model training

The generated digest is stored locally on your device only.

1.5 Subscription data

Subscription and purchase management is handled by RevenueCat. RevenueCat processes:

• Your anonymous app user ID
• Purchase receipts and subscription status
• Transaction history

RevenueCat’s privacy policy applies to this data: revenuecat.com/privacy

1.6 Clipboard access

The app checks your clipboard for URLs to offer a quick-save feature. This check is performed locally on your device using Apple’s privacy-safe clipboard API (which does not trigger the iOS paste notification). Clipboard contents are:

• Never stored beyond the immediate check
• Never transmitted to any server
• Only read when the app is in the foreground

/ 2. how we use your information

/ 3. third-party services

We use the following third-party services, each with their own privacy policies:

We do not sell, rent, or share your personal information with any other third parties.

/ 4. data security

• All network communication uses HTTPS (TLS encryption)
• Authentication tokens are stored in iOS Secure Enclave via Expo SecureStore
• Local data is stored in a sandboxed SQLite database accessible only to the app
• No non-exempt encryption is used beyond standard HTTPS

/ 5. data retention and deletion

• Local data: Stored on your device until you delete it within the app or uninstall the app. Uninstalling permanently deletes all local data.
• Account data: Your Supabase authentication record is retained until you request deletion.
• Analytics data: Retained by PostHog according to their data retention policies. Data is anonymous and cannot be linked to your identity.
• Digest processing data: Not retained. Processed in real-time and discarded.

Requesting account deletion

You can request complete deletion of your account and associated server-side data by contacting us at hello@moqa.studio. Upon request, we will:

• Delete your Supabase authentication record
• Confirm deletion within 30 days

Local data on your device is not accessible to us. Delete the app to remove it.

/ 6. children’s privacy

Upstacked is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at hello@moqa.studio.

/ 7. international data transfers

• Analytics data is processed by PostHog in the European Union
• Authentication and digest processing occur via Supabase (cloud infrastructure)
• Subscription data is processed by RevenueCat in the United States

By using the app, you consent to the transfer of the limited data described above to these services.

/ 8. your rights

Depending on your jurisdiction (including under GDPR, CCPA, and similar laws), you may have the right to:

• Access the personal data we hold about you
• Delete your account and associated data
• Port your data (your saved links and content are stored locally and can be exported)
• Object to processing of your data

To exercise any of these rights, contact us at hello@moqa.studio.

/ 9. changes to this policy

We may update this privacy policy from time to time. We will notify you of any material changes by updating the “Last updated” date at the top of this policy. Continued use of the app after changes constitutes acceptance of the updated policy.

/ 10. contact us

If you have any questions about this privacy policy or our data practices:

Email: hello@moqa.studio
Moqa Studio · Robin Champsaur