← Back to Stadu Stadu

App Privacy Policy

In short

Stadu keeps your life on your phone. There is no account and no cloud sync. We run exactly one small endpoint of our own — it forwards game searches to IGDB and stores nothing about you. Everything you log — entries, ratings, notes, photos, trips, collections and your birth date — is stored only in the app's local storage on your device. We never receive it and we cannot read it.

Stadu shows no ads, bundles no advertising SDKs, and does no behavioural tracking, profiling or cross-app tracking. Nothing is sold or shared for marketing.

Responsible party

Fabian Bartl, Felsenmeerweg 9, 72459 Albstadt, Germany · dev.bartlf@gmail.com — see the imprint.

What leaves your device

Stadu contacts an outside service only when you do something that requires it. There are five cases, and two of them are entirely optional.

1. Looking up titles and artwork

When you search for a film, show, book, game, record, card, concert or place, your search text is sent to the matching catalogue so results and cover art can come back. Those services receive your search term and your IP address (as any web request does). They do not receive your name, your other entries or anything else from the app.

  • The Movie Database (TMDB) — films and TV, plus cover images
  • Games — a game search you type is sent to stadu.app/api/games, an endpoint we run ourselves, which forwards it to IGDB (Twitch Interactive). We use our own endpoint so that the credentials IGDB requires are not shipped inside the app. It receives your search term and IP address, does not log them, and caches results only by search term — never by person or device.
  • rawg2steam (operated by Phalcode) — a Steam-backed stand-in used only if the endpoint above cannot be reached, so game search keeps working.
  • Open Library — books, plus cover images
  • Discogs — music releases
  • Apple iTunes Search — music and media metadata
  • Last.fm — music metadata
  • setlist.fm — concert setlists
  • Pokémon TCG API — Pokémon trading cards
  • Scryfall — Magic: The Gathering cards
  • Mapbox — place search, geocoding and the static map images used on trips

Legal basis: Art. 6 (1) (b) GDPR — performing the function you asked for. Each provider is independently responsible for what it does with the request; their own privacy policies apply.

2. Crash and error reports

Stadu uses Sentry to report crashes and errors so they can be fixed. A report contains technical diagnostics: the error itself, a stack trace, the app version, your device model and OS version, and which screens were open. It does not contain the content of your entries.

Stadu uses Sentry's EU region, so crash data is processed on servers inside the European Union. Session replay and screen recording are switched off, and IP-address collection is not enabled.

Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in a working app.

3. Optional: AI quick capture

Stadu can turn a sentence like “watched Dune last night, loved it” into entries. This feature is off unless you turn it on by entering your own Anthropic API key in Settings.

While it is on, the text you type in that field is sent to Anthropic (Claude) to be parsed, and structured entries come back. Only that text is sent — not your existing entries. Your API key is stored locally on your device and is sent only to Anthropic to authenticate the request. Anthropic's own terms and privacy policy govern their handling. Turn the feature off, or remove the key, and nothing further is sent.

Legal basis: Art. 6 (1) (a) GDPR — your consent, given by enabling it.

4. Optional: library imports

If you choose to import from Steam or Discogs, the credentials you enter (a Steam ID and API key, or a Discogs token) are stored locally on your device and sent only to that service to fetch your own library. We never see them. Deleting them in Settings ends it.

Legal basis: Art. 6 (1) (a) GDPR — your consent.

5. App updates

Stadu checks for app updates when it starts, by asking Expo (Expo Application Services, expo.dev) whether a newer version of the app's code is available. That request tells Expo your app version, platform and a random installation id — never your entries, your name, or anything you have logged. It is how bug fixes reach you without waiting for an app-store review.

Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in shipping fixes.

Photos

Stadu asks for photo library access only so you can pick cover images and trip photos, and for camera access only if you choose to take a photo instead of picking one. Photos you select or take are copied into the app's local storage and stay on your device — they are never uploaded. Stadu does not use the microphone.

Backups

The export in Settings writes a .json file and hands it to your system share sheet. Where it goes from there is entirely your choice. The file deliberately excludes your API keys and import credentials, so it is safe to store and share. We never receive it.

Deleting your data

Because everything lives on your device, uninstalling Stadu deletes all of it. There is nothing on our side to request or erase. Individual entries can be deleted in the app at any time.

Children

Stadu is not directed at children and does not knowingly collect data from them. As nothing is transmitted to us, no such data reaches us.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority. Since we hold no personal data about you, requests will usually be answered by pointing you here — but write to dev.bartlf@gmail.com any time.

Changes

If Stadu's data handling changes, this page changes with it and the app links to the current version.