Privacy Policy

Effective date: 14 October 2026 · Version: 1.1

1. Who we are

Stacks (“Stacks”, “we”, “us”) is an invite-only community for founders and builders in India.

This policy explains what personal data we collect, why, who can see it, how long we keep it and the choices you have. It covers the Stacks apps for iPhone and Android, the website stacks.ltd and its pages on api.stacks.ltd, the emails we send, and Stacks events where the app is used (together, the “Service”).

Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary for your personal data. This policy also follows the Information Technology Act, 2000 and the rules made under it.

2. In short

• We do not sell your personal data, to anyone.
• There are no ads in Stacks and no tracking. We do not use advertising or third-party analytics tools, and we do not share your data with ad networks or data brokers.
• We collect what the Service needs to run a private founder community, and we say why below.
• Your phone number, email address and date of birth are never public. Section 6 explains exactly who can see your numbers.
• You can see, correct and delete your data at any time. You can delete your account yourself in the app (section 11).

3. What we collect

Information you give us

• Account: your personal email address. Work email addresses are not accepted.
• Profile: full name, date of birth, city, whether you are a founder, and optionally your company and its website, sector, what you are building, a short bio and a profile photo. Name, date of birth, city and founder status are required; the rest is optional.
• Contact numbers (optional): phone and WhatsApp numbers, and whether each is shown to your connections.
• Social links (optional): LinkedIn, Instagram, X, a website and similar, each marked public or private.
• Event activity: event registrations, check-ins (when you scan an event code or enter it by hand), entries at the door, and the people you mark Interested or Skip in Discover.
• Requests to connect: after an event you can send a request to connect with a short note. We also keep the members you block and any reports you make.
• Applications (only if you apply): for Spotlight, your pitch, social accounts, shoot preferences and the consent you give; for Partner with Stacks, your name, phone, address, organisation, LinkedIn and your reason; for the beta programme, your phone, LinkedIn, profession, years of experience, company and your reason. You can also exchange messages with the team about an application.
• Suggestions (only if you suggest): details of an event, hacker house or venue, which can include a host’s name and phone number.
• Help & Support: what you write to us and our replies.
• Pre-registration on stacks.ltd (only if you sign up there): your full name, pronoun, email address and whether you are a founder, and then either your company (and optionally its website) or your profession. We email you a confirmation.

We do not collect Aadhaar, PAN, passport details, bank or card details, passwords, health data, biometrics, your contacts or your location. Face ID and fingerprint checks happen on your phone; we never receive them. The camera is used only to read Stacks event codes; nothing is recorded.

Information collected when you use the Service

• Sign-in and security: one-time sign-in codes (stored only as one-way hashes), session records with the device name, platform and app version, and an identifier for your phone if you turn on quick sign-in. IP addresses are stored only as one-way keyed hashes, to stop abuse; we do not keep plain IP addresses in our records.
• App usage (our own analytics): which screens and features are used and when, together with the app version, operating system version, device model, language, time zone and a random identifier created when the app is installed (so that use before sign-in can be counted). We measure this ourselves on our own servers. There are no third-party analytics or advertising tools in the app.
• Push notifications: if you allow notifications, the push token Apple or Google gives your phone, and your notification settings.

Information from other people

• Other members may mark you Interested at an event, send you a request to connect, block you or report you. This creates a record about you.
• Suggestions: a member may give us a host’s name and phone number. We use it only to contact that host about their event, and only Stacks admins can see it.

4. Why we use your data

We use personal data only for these purposes:

• to create and secure your account, send sign-in codes and keep you signed in;
• to show your profile to other members of the community (section 5);
• to run events: registration, waitlists, check-in and entry at the door;
• to help members meet: show who is at an event, record interest, create connections and requests to connect;
• to share contact numbers between members only under the rules in section 6;
• to review applications and suggestions, and to produce and publish Spotlight content you agreed to;
• to send service messages and notifications (sign-in codes, event updates, decisions, replies, security alerts);
• to send Stacks Updates, our members’ email newsletter, which you can unsubscribe from at any time;
• to answer support requests;
• to let people who pre-registered on stacks.ltd know when Stacks opens and invite them to join;
• to keep the Service safe: prevent abuse, scraping and fraud, and enforce our Terms of Use;
• to improve the Service using our own usage statistics;
• to meet legal obligations and respond to lawful requests.

Our legal basis under the DPDP Act is your consent, given when you create an account and when you choose to use each optional feature, and the legitimate uses allowed by Section 7 of the DPDP Act (for example, complying with the law).

We do not use your data for advertising. To protect members, accounts that behave like automated scrapers can be limited automatically; if this happens to you by mistake, write to us and a person will review it.

5. What other members see

• Members you share a link with (for example, people at the same event, people you have connected with, and people who are interested in meeting you) can see your name, photo, founder status, company, sector, city, bio, what you are building and the social links you marked public.
• Your email address and date of birth are never shown to other members.
• At an event, people who checked in to the same event can see you in Discover while it is on.
• Interest: if you mark someone Skip, nobody is told. If you mark someone Interested, they can see that you are interested in meeting them, along with your profile.
• Blocking: members you block can’t send you requests or mark you Interested, don’t see you in Discover and can’t see your numbers. They are not told.

6. Phone and WhatsApp numbers

Your numbers are optional and never public. Each number is shown only if you turned on “Show to my connections” for it, and then only to:

1. members you are connected with (you are both Interested in each other), and
2. members you marked Interested (you showed interest in them, so they can reach you).

Someone who marked you Interested does not see your numbers until you mark them Interested too. You can turn each number off at any time, and it disappears straight away. Notifications on your lock screen never include phone numbers or email addresses.

7. Who we share data with

• Other members, as described in sections 5 and 6.
• Service providers who process data for us, on our instructions:
  • Hostinger runs our servers, database and email. Your account data, photos and messages are stored on Hostinger servers, and our emails are sent through Hostinger.
  • Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) deliver push notifications to iPhones and Android phones. They receive your phone’s push token and the text of the notification.
  • Expo (650 Industries, Inc.) delivers app updates. When the app checks for an update, Expo’s servers receive the request, which includes your IP address, the app and platform version and a random identifier created by the update system. No account, profile or contact data is sent to Expo.
  • Apple and Google also distribute the app through the App Store and Google Play, under their own privacy policies.
• Authorities, when Indian law or a court order requires it, or to protect the rights, property or safety of Stacks, our members or the public.
• A successor, if Stacks is transferred to a company or another person, under the same protections. We will tell you before that happens.

If you take part in a Spotlight session over Google Meet, Google’s own terms apply to that call.

We never sell or rent personal data, and we never share it for advertising.

8. Where your data is stored

Your data is stored on servers run by Hostinger. Apple, Google and Expo may process the limited data described in section 7 outside India. Any transfer outside India follows Section 16 of the DPDP Act.

9. How long we keep data

• Account and profile: while your account is open. When you delete your account, your data is erased as described in section 11.
• Sign-in codes: expire 10 minutes after they are sent; the records are deleted after 30 days.
• Sessions: a session lasts up to 30 days unless you sign out. Records of ended sessions and quick sign-in are deleted 30 days after they end.
• Requests to connect: a request expires after 30 days; the note in it is erased once the request has closed and expired, unless a report refers to it.
• Partner and beta applications: your personal details are deleted if the application is not approved, or when you withdraw it.
• Suggestions: deleted with your account. A host’s contact details are used only to contact them about their event.
• Support requests: kept while your account is open, so we can follow up. When you delete your account, what you wrote is erased.
• Pre-registrations on stacks.ltd: kept until you ask us to delete them. Write to support@stacks.ltd from the email address you pre-registered with and we will delete your details.
• Event activity, interest and connections: while your account is open. On deletion they are no longer linked to your name, email or contact details (section 11).
• Spotlight consent records: kept as evidence of the consent you gave for as long as the related content is published and the law requires, no longer linked to your email.
• Usage statistics: kept to understand how the Service is used. When you delete your account they are made anonymous.
• Security and audit records: deleted after one year.
• Backups: deleted data can remain in our backups until they are replaced in the normal cycle. We never use backups to bring back a deleted account.

10. Your rights

Under the DPDP Act you have the right to:

• Access: get a summary of the personal data we hold about you, how we use it and who we shared it with.
• Correction: correct, complete or update your data. Most of it you can edit yourself in the app, under Edit profile.
• Erasure: delete your data and your account, except what the law requires us to keep.
• Withdraw consent: at any time, as easily as you gave it. Some features will stop working, and processing already done is not affected.
• Grievance redressal: complain to us and get an answer (section 13).
• Nominate another person to use these rights for you if you die or become unable to act.

To use these rights, write to support@stacks.ltd from the email address you use for Stacks, or use Help & Support in the app. We may ask you to confirm it is you. We respond within a reasonable time, as required by applicable law.

11. Deleting your account

In the app: open the menu, tap Settings, then Delete account. Type your email address to confirm. Your account is deleted at once and you are signed out on every device.

Without the app: email support@stacks.ltd from the address you use for Stacks, with the subject “Delete my account”. We confirm it is you and then delete the account, as required by applicable law.

What is deleted: your profile, photo, company and links; your date of birth; your phone and WhatsApp details; your event registrations, notifications and notification settings; your Partner, beta, Spotlight and suggestion submissions and the messages about them; the text of your support requests; your requests to connect, blocks and reports; your quick sign-in and push notification records. Your email address is removed from your account, so it can no longer be used to sign in.

What stays, without your identity: a closed account record with no name, email, photo or contact details (it keeps only the city, sector and founder status you chose), which nobody can see in the app; records of past event check-ins, entries and interest attached to that closed record; usage statistics made anonymous; Spotlight consent records, as the law requires; and security records until they expire (section 9).

12. Security

We protect personal data with reasonable security practices: encrypted connections (HTTPS) between the app and our servers; encryption of the most sensitive fields in our database, including email addresses, phone and WhatsApp numbers, dates of birth, addresses, messages and push tokens; sign-in codes, invite codes and IP addresses stored only as one-way hashes; sign-in by one-time codes with no passwords; limits that stop repeated sign-in attempts and data scraping; and admin access limited to approved devices, with an audit log. No system is perfectly secure. If a personal data breach happens, we will tell the Data Protection Board of India and the affected members, as the DPDP Act requires.

13. Grievance Officer and contact

For questions or complaints about your personal data or this policy, contact our Grievance Officer:

Grievance Officer, Stacks — support@stacks.ltd

We acknowledge and resolve complaints within the timelines required by applicable law, including the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (currently, acknowledgement within 24 hours and resolution within 15 days). If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

14. Age

Stacks is only for people who are 18 or older. We do not knowingly collect data from anyone under 18. If we learn that someone under 18 has joined, we delete the account.

15. Emails and notifications

Sign-in codes and security emails and notifications cannot be turned off, because they protect your account. You can turn off other notifications in Settings → Notifications, and you can unsubscribe from Stacks Updates in the app or with the link in each email. Our emails do not contain tracking pixels.

16. Changes to this policy

When we change this policy, we will post the new version here with a new date. For important changes we will tell you in the app or by email before they take effect and, where the law requires, ask for your consent again.

17. Law and language

This policy is governed by the laws of India. If it is made available in another language, the English version prevails.

Contact and Grievance Officer: support@stacks.ltd