Privacy notice

Last updated: 2026-09-29.

This notice explains what personal data we process when you use Stakk, why, and how you can exercise your rights. It follows Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), as in force since 2025.

This English version is provided for convenience. If it differs from the Spanish version, the Spanish version prevails.

Data controller

[Responsable: pendiente], located at [Domicilio: pendiente], is responsible for processing your personal data. For any privacy matter, email [email protected].

Data we process

If you create an account:

Your name, email address, username and preferred language.
Your password, stored only as a hash: a transformed value that can't be read back.
Session data: IP address, user agent (which browser and operating system you use), and when the session started and expires. Our authentication system stores it to keep you signed in and protect your account.

If you use account features:

Collections: their name and description, the apps you save, your notes, and whether each one is public or private.
Suggestions: the app's name and web address, the reason you give, and whether you say you made it.
Claims: the app you claim, the verification method and its result, and the changes you propose.

If you're just browsing:

When you click “Visit site,” we add one to a counter per app, day and language. We don't store your IP address or any identifier, so that count can't be traced back to you.

We don't ask for sensitive data, such as your health, ethnic origin, beliefs, political opinions or sexual orientation, or for financial data. Please don't include it in your notes, collections or suggestions.

How we use your data

Primary purposes. We need these to provide the service:

Create, confirm and manage your account.
Sign you in, keep you signed in and detect unauthorized access.
Store your collections and notes, and show the ones you make public.
Receive, review and respond to your suggestions.
Verify your claims and review the changes you propose.
Send you essential emails: account confirmation, password resets and updates on your suggestions.
Answer your messages and your data rights requests.
Comply with legal obligations and requests from authorities.

Secondary purposes. Today we don't process your data for any secondary purpose. We don't send newsletters, we don't use analytics tools and we don't show third-party ads.

If we ever add one, we'll update this notice first and give you a way to opt out. You can always opt out by emailing [email protected] with the subject line “Opt out of secondary purposes.” Opting out doesn't affect your account or your access to the site.

What's public

Your public profile shows your name, your username and when you joined. It never shows your email address.

Collections are private by default. If you make one public, anyone can see it, including its notes. You can make it private again at any time.

Service providers. We use providers for web hosting, database hosting and email delivery. They act as processors: they handle your data only to provide those services to us and according to our instructions. This doesn't require your consent.

Transfers. We don't sell or rent your data. We only transfer it without your consent where the law allows, for example:

to an authority that requests it under the law or by court order;
when needed to establish, exercise or defend a right in legal proceedings.

If we ever need any other transfer, we'll ask for your consent first.

Third-party sites. When you click “Visit site,” the destination site may know you came from Stakk, especially if it's an affiliate link. That site has its own privacy notice and its own cookies.

Cookies and local storage

Stakk only uses the cookies needed to keep you signed in. Without them, you can't access your account. We don't use analytics, advertising or tracking cookies.

Your preferences, such as light or dark theme, are saved in your browser's local storage (localStorage). They aren't sent to our servers, and you can clear them in your browser settings.

Your ARCO rights

Under Mexican law, you have the right to:

Access your personal data and learn how we process it.
Rectify it if it's inaccurate or incomplete.
Cancel it when you believe we no longer need it for the purposes in this notice.
Object to its processing for specific purposes.

Together, these are known as ARCO rights. You can also withdraw your consent or ask us to limit the use or disclosure of your data. If withdrawing consent affects a primary purpose, we may no longer be able to keep your account.

Some changes you can make yourself: update your name, username and language from your account, or make a collection private.

How to submit a request

Email [email protected], ideally from the address linked to your account. Include:

Your name and an email address or other way for us to reply.
A document proving your identity or, if you're acting for someone else, your legal authority to do so.
A clear description of the data and the right you want to exercise.
Anything that helps us find the data, such as your username.
For a rectification, the change you're asking for and, if relevant, supporting documents.

If something is missing, we'll ask for it; the clock starts once your request is complete.

Deadlines. We'll respond within 20 business days of receiving your request. If it's granted, we'll carry it out within 15 business days of our response. Both periods can be extended once, for the same length of time, when justified; if that happens, we'll tell you.

The process is free. We may only charge justified shipping or copying costs.

If you're not satisfied with our response, you can contact the competent data protection authority in Mexico.

Retention and security

We keep your data while you have an account, or while it's needed for the purposes in this notice and to meet legal obligations. After that, we block it and then delete it.

If your account is deleted, your collections, notes and claims are deleted with it. Suggestions you sent are kept, but they're no longer linked to your account.

We protect your data with technical and administrative measures: the site only works over an encrypted connection (HTTPS), passwords are stored as hashes and database access is restricted. If a breach significantly affects your rights, we'll let you know.

Changes to this notice

We may update this notice because of changes in the law, the site or our providers, for example if we add analytics or a newsletter. We'll post the new version on this page with its date. If the change is significant, we'll also let you know by email or with a visible notice on the site.