Privacy policy

Last updated: 13 September 2026

Stae helps you discover resorts and homestays in Kerala and message the people who run them. This page explains exactly what we collect, why, and what you can do about it. We have tried to keep it specific rather than exhaustive.

Who we are

Stae is operated from Kerala, India. For anything in this policy, write to hello@stae.io.

What we collect

• Your account. Your name and email address. We store only a cryptographic hash of your password — never the password itself.
• Your saved stays. Which properties you save, and when. This is what lets your list follow you to a new phone.
• Your starting city. The city you choose, its approximate centre, country and region, and your discovery radius. We save this to your account to show destinations near your starting point. You can change it in the You tab or Explore header. We do not request GPS permission or track your device in the background.
• How you use the app. Which properties you were shown, what you searched for, which stays you saved, which detail pages you opened, and when you tapped through to WhatsApp. Each app launch gets a random session identifier so we can tell one browsing session from another. We use this to work out which stays people actually want and which ones nobody does.
• Technical data. Your IP address and device user-agent, recorded against your sign-in session. We use it to keep sessions secure and to rate-limit abuse of the sign-in endpoints.

If you list a property

Owners who list on Stae also give us the property's details and the phone and WhatsApp numbers they want travellers to use. Those numbers are shown to signed-in travellers by design — that is the entire point of the listing. Photographs you upload are stored by us and served from our own image hosting.

We do not collect payment details, precise location, contacts, photos from your device beyond ones you deliberately upload, or advertising identifiers. Stae carries no third-party ad or tracking SDKs.

What we never see

Stae takes no bookings and handles no money. When you tap to message a property, you leave Stae for WhatsApp, and everything after that — your phone number, your conversation, what you agree to pay — happens between you and the property owner. We can see that you tapped the button; we cannot see the conversation. WhatsApp is operated by Meta under its own privacy policy, not ours.

Who processes it for us

• Neon — our database, hosted in Singapore (ap-southeast-1).
• Mapbox — when you search for a city, Mapbox receives your search text. When you view a radius map, Mapbox receives the selected city centre and radius. These requests also expose your IP address to Mapbox. We do not send your Stae account name or email with these requests.
• Cloudflare — serves the app, this page and the listing photographs from its global edge, and sends account emails such as password resets.

Each of these acts on our instructions. We do not sell your data, and we do not share it for anyone else's advertising.

How long we keep it

Your account, starting city and radius, and saved stays are kept until you delete your account. Usage events are kept so we can understand demand over time; when an account is deleted, the events it produced are detached from it and remain only as anonymous counts.

Deleting your account

Open You → Account → Delete account in the app, or your account page in the owner portal. This is immediate and permanent: your account, starting city and radius, saved stays and your sign-in sessions are erased. There is no recovery, so export anything you want to keep first. Listings you own are unlinked from you rather than deleted, so a property does not vanish from travellers mid-trip — email hello@stae.io if you want the listing removed too. You can also email us and we will delete the account for you.

Your rights

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Under India's Digital Personal Data Protection Act you may also withdraw consent and raise a grievance with us before approaching the Data Protection Board. Write to hello@stae.io and we will respond within 30 days.

Children

Stae is intended for adults. Do not create an account if you are under 18. If we learn that we hold an account belonging to a child, we will delete it.

Changes

If we change what we collect or why, we will update this page and change the date at the top. Material changes will also be announced in the app.