Stacklight Privacy Policy

Effective: 28 May 2026 · Last updated: 28 May 2026

The short version: Stacklight collects nothing about you. The app has no backend, no analytics, no accounts. Everything below is the long-form version of that sentence, written for App Review and for anyone who wants to verify the architecture before installing.

Who is “we”? Stacklight is built by an independent iOS developer. Throughout this policy, “Stacklight”, “the app”, and “we” refer to the iOS and watchOS application available on the Apple App Store. “You” means the person using the app.

1. What we don’t collect

We don’t collect any of the following, and we have no infrastructure that would let us start:

Your name, email address, phone number, or any other identifier.
Your usage of the app. We don’t know if or how often you open it.
Analytics, telemetry, or crash reports.
Your IP address. We run no servers, so there’s nothing to log it.
Advertising identifiers (IDFA), location data, or any unique identifier.
The URLs of services you add, your credentials, or any data those services return.

The App Store nutrition label for Stacklight reflects this as “Data Not Collected.” The labels are binding under Apple’s developer agreement.

2. What lives on your device

Stacklight stores two things locally so the app can do its job:

Your service configuration: the names, URLs, and per-integration settings of the services you’ve added. This lives in the app’s SwiftData store on your device.
Your service credentials: API tokens, passwords, and tokens for the services you choose to connect. These are stored in the iOS Keychain, encrypted at rest by iOS, and never transmitted to anyone other than the service you set them for.

Two ways to clear what’s stored:

Delete an individual service from the Services tab (swipe to delete, or tap into the editor and use Remove). Stacklight removes that service’s Keychain entry as part of the same action.
Uninstall the app to remove every service, every credential, and the local database in one step. iCloud-synced copies on your other devices stay until you also turn off iCloud for Stacklight or sign out of iCloud on those devices.

Apple’s iCloud Keychain may retain credentials independently on your other devices per iOS’s own sync rules; that’s Apple’s system, not ours, and is managed through iOS Settings → [your name] → iCloud → Passwords & Keychain.

3. What syncs through your iCloud

To make Stacklight feel like a real Apple ecosystem app, your service list syncs across your devices via Apple’s CloudKit. What that means concretely:

Your service names, URLs, and configuration sync to your own iCloud private database using your own iCloud account. We don’t have access to this database. Apple does, under Apple’s own privacy policy.
Your credentials sync via iCloud Keychain if you have it turned on in iOS Settings. iCloud Keychain is end-to-end encrypted by Apple. If iCloud Keychain is off, your credentials stay on the device you entered them on.
You can turn off iCloud sync for Stacklight from iOS Settings → [your name] → iCloud → Stacklight. We’ll keep working with everything local-only.

4. What the app sends over the network

Two things, in two specific directions:

To the services you’ve added. When the app refreshes a service’s status, it sends an authenticated API request directly from your device to the URL you configured. The request includes the credential you saved for that service. We don’t see this traffic. It doesn’t pass through us.
To Apple, for iCloud sync. When you add or change services, iOS pushes the change to your iCloud private database. This is Apple-to-Apple, and only your own iCloud account sees it.

There is no third request type. Stacklight does not contact any Stacklight-operated server, because none exists.

5. Third-party services

The only third party Stacklight relies on is Apple:

Apple iCloud / CloudKit: syncs your service list across your devices.
Apple iCloud Keychain: syncs credentials across your devices, end-to-end encrypted by Apple.
Apple App Store / StoreKit: handles distribution and any in-app purchases.

All three are governed by Apple’s privacy policy.

Stacklight ships with no third-party SDKs at all: no analytics, no ads, no crash-reporting, no attribution, no remote config. The only code in the binary is Apple’s frameworks and our own Swift.

6. The services you connect to

When you add a service in Stacklight (Pi-hole, Proxmox, Plex, etc.), you’re telling the app to send authenticated requests to a server you control. Whatever logs that server keeps are governed by however you’ve configured it, not by this policy. From our perspective, it’s your network and your data going to your machine.

7. Children

Stacklight is a homelab tool aimed at adults. We don’t knowingly collect anything from anyone, including children under 13. Stacklight is rated 4+ on the App Store because there is no objectionable content; it is not designed for children, but it doesn’t harm them either, since again, we collect nothing.

8. Your rights (GDPR, CCPA, and friends)

Under GDPR (EU), CCPA (California), and similar laws, you have rights to access, correct, or delete personal data we hold about you. The practical effect of those rights, in Stacklight’s case, is bounded by the fact that we hold no personal data about you. There is nothing for us to look up, return, or delete on our side, because no “our side” exists.

Data on your device is yours: delete the app to remove the local copy. Data in your iCloud is yours: manage it from iOS Settings → your name → iCloud → Manage Account Storage → Stacklight.

9. Changes to this policy

If we ever change something here, for example if we add a feature that requires processing data we don’t currently process, we’ll update this page and bump the “Effective” date at the top. We’d also surface it inside the app the next time you open it, because that’s the only way you’d learn: we don’t have your email.

10. Contact

Privacy questions, security disclosures, or “is-the-app-actually-doing-what-this-page-says” inquiries:

[email protected]

← Back to Stacklight

Apple, iOS, iPadOS, watchOS, iCloud, iPhone, iPad, Apple Watch, and the App Store are trademarks of Apple Inc., registered in the U.S. and other countries. Stacklight is an independent application and is not affiliated with, endorsed by, or sponsored by Apple Inc. All other product names, logos, and brands referenced on this site (including but not limited to Pi-hole, Proxmox, TrueNAS, Home Assistant, Plex, Jellyfin, Sonarr, Radarr, Lidarr, Readarr, qBittorrent, Transmission, Synology, Unraid, OPNsense, Gitea, Forgejo, Overseerr, Jellyseerr, Nginx Proxy Manager, AdGuard Home, Immich, Paperless-ngx, Uptime Kuma, Scrutiny, and Bitaxe) are trademarks of their respective owners and are used here for the sole purpose of identifying the third-party service that Stacklight connects to.