1. Who we are
Northstack Studio ("we", "us") builds AI-powered mobile and web applications, including the Northstack Studio app — an AI assistant for iOS and web — and the AI Core API. This policy explains what we collect when you use northstackstudio.com or our products, how we use it, and the rights you have over it.
2. The short version
We collect the minimum needed to make our services work and to communicate with you. We never sell your data. We do not train AI models on your private content. You can export or delete your data at any time.
3. Information we collect
- Account data — your name, email address, and an optional profile photo, used to create and secure your account.
- Conversation data — the messages, and any images you attach, that you create with our AI assistant. To generate a reply, this content is transmitted to our third-party AI provider, Anthropic (see “Sharing” below); the app asks for your explicit permission before sending anything to the AI the first time you use it. Conversations are stored on your device and synced securely to your account (via Google Firebase) so you can access them across your devices. You can delete any conversation, or your whole account, from within the app at any time.
- Contact data — any message you send through our contact form or by email.
- Project data — for clients, the briefs, files, and credentials you share with us to deliver the engagement.
- Usage data — in-app events tied to your account (screens viewed, features used, app version, platform, language) that we use to understand how the app is used and to fix issues.
- Attribution data — to understand which marketing campaign led you to install the app, our attribution partner Kochava may process device and advertising identifiers (such as the iOS IDFA, only with your permission via the App Tracking Transparency prompt) together with basic install and event signals. You can decline tracking and the app still works fully.
- Purchase data — if you subscribe to Premium, Apple processes the payment (we never see your card number) and your subscription status (active, expired, trial) is shared with us through RevenueCat so we can unlock Premium features across your devices.
4. How we use it
We use this data to deliver our services, respond to your inquiries, sync data across your devices where applicable, send essential service emails (receipts, security notices), and fix bugs. When you message the AI assistant, the text and any images you send are transmitted to our AI provider (Anthropic) solely to generate a response — only after you have granted permission in the app. Anthropic processes this content under contractual protections equivalent to those described here and does not use it to train its models. We do not use your data for behavioral advertising.
5. Sharing
We share data only with the subprocessors needed to run the service:
- Google Firebase — cloud infrastructure, authentication, and database (account data, analytics events, contact submissions).
- Anthropic — AI provider that processes the messages and images you send to the AI assistant to generate responses. Data is shared only after you grant in-app permission, is handled under contractual protections equivalent to this policy, and is not used to train Anthropic's models.
- Sentry — crash reporting and error monitoring. Sentry may receive technical data such as device type, OS version, and anonymized stack traces when the app encounters an error.
- Apple — processes App Store payments for subscriptions. We never see your card number.
- RevenueCat — manages subscription status and entitlements so Premium unlocks across your devices.
- Kochava — mobile measurement partner that tells us which marketing campaign led to an app install (install attribution). Kochava may receive device and advertising identifiers (such as the iOS IDFA, only if you allow tracking when prompted) and basic install/event signals. Used solely to measure marketing performance; never sold.
6. Retention
We keep your data for as long as your account or engagement is active. When you delete your account or close an engagement, we delete personal data within 30 days, except where we are required to keep records (e.g. invoices for tax purposes, kept for 7 years).
7. Your rights
You can access, export, correct, or delete your data at any time. You can delete your account and all associated data directly in the app under Account → Settings → Delete account; this permanently removes your profile, conversations, and personal data. If you are in the EU, UK, or California, you also have specific rights under the GDPR and CCPA — write to batamapps.info@gmail.com and we will respond within 30 days.
8. Security
Data is encrypted in transit (TLS 1.3) and at rest (AES-256) wherever we store it. We follow least-privilege access, run security reviews, and never store passwords in plain text.
9. Children
Our services are not directed at children under 13. If you believe a child has provided us with personal data, contact us and we will remove it.
10. Changes
If we make material changes to this policy, we will notify you by email (for customers) or by a notice on this page at least 30 days before the change takes effect.
11. Contact
Questions? Write to batamapps.info@gmail.com.