Privacy policy

Last updated: 24 September 2026

Stae helps you discover resorts and homestays in Kerala and message the people who run them. This page explains exactly what we collect, why, and what you can do about it. We have tried to keep it specific rather than exhaustive.

Who we are

Stae is operated from Kerala, India. For anything in this policy, write to hello@stae.io.

What we collect

• Your account. Your name and email address. We store only a cryptographic hash of your password — never the password itself.
• Your saved stays. Which properties you save, and when. This is what lets your list follow you to a new phone.
• Your starting city. The city you choose, its approximate centre, country and region, and your discovery radius. We save this to your account to show destinations near your starting point. You can change it in the You tab or Explore header. We do not request GPS permission or track your device in the background.
• How you use the app. Which properties you were shown, what you searched for, which stays you saved, which detail pages you opened, and when you tapped through to WhatsApp. Each app launch gets a random session identifier so we can tell one browsing session from another. We use this to work out which stays people actually want and which ones nobody does.
• Technical data. Your IP address and device user-agent, recorded against your sign-in session. We use it to keep sessions secure and to rate-limit abuse of the sign-in endpoints.

If you list a property

Owners who list on Stae also give us the property's details and the phone and WhatsApp numbers they want travellers to use. Those numbers are shown to signed-in travellers by design — that is the entire point of the listing. Photographs you upload are stored by us and served from our own image hosting.

We do not collect payment details, precise location, contacts, photos from your device beyond ones you deliberately upload, or advertising identifiers. Stae carries no third-party ad or tracking SDKs.

If you stay at a property that uses Stae Host

Some properties run their bookings on Stae Host, our software for owners. If you book with one, the property — not Stae — decides what it needs from you, and we store it on the property's behalf. The property is responsible for that information; we process it for them. What the property records and what you give it through your check-in link:

• Your booking. The name and phone number of the person who booked, the dates, the rooms, how many are in your party, the meals you take and what you have paid.
• Everyone staying. Each guest's name, age and nationality, which Indian law asks a property to keep in its guest register.
• Identity documents. A photograph of each adult's ID (or only the lead guest's, if the property asks for that), the kind of ID it is, and its number. The number is masked before it is stored — only the last four characters are kept — so a full Aadhaar or passport number is never written to our database.
• If you are a foreign national. Your passport and visa details and the date you arrived in India, which the property must report to the immigration office (Form C) within 24 hours of your arrival.
• Anything else you choose to tell them — when you expect to arrive, what you can't eat, a request for your stay.
• Feedback you send the property. If you use its feedback page, what you type or the voice note you record, the room the card was in, and — only if you choose to leave them — your name and number. If you came from your own feedback link, or the card was in a room you are staying in, it is filed against your booking. It goes privately to the property and is never published.

ID photographs are kept in private storage with no public link. They can be opened only by the people who work at that property, and only after signing in. They are deleted 180 days after you send them; the masked number stays on the property's register. A photo is uploaded as soon as you choose it, so the form sends quickly; if you never send the form, it is deleted within three days, and the property never sees it. Until you send it, what you have typed is saved only in your own browser, so you can close the page and pick up where you left off. Voice notes are kept the same way, in private storage the property's staff can play only after signing in, and are deleted a year after you record them. Your check-in link is a private address sent to you — anyone who has it can see your booking's details, so don't forward it.

What we never see

Stae handles no money: payments go directly between you and the property, and a property on Stae Host records what it received rather than taking it through us. When you tap to message a property, you leave Stae for WhatsApp, and that conversation happens between you and the owner. We can see that you tapped the button; we cannot see the conversation. WhatsApp is operated by Meta under its own privacy policy, not ours.

Who processes it for us

• Neon — our database, hosted in Singapore (ap-southeast-1).
• Mapbox — when you search for a city, Mapbox receives your search text. When you view a radius map, Mapbox receives the selected city centre and radius. These requests also expose your IP address to Mapbox. We do not send your Stae account name or email with these requests.
• Cloudflare — serves the app, this page and the listing photographs from its global edge, sends account emails such as password resets, and holds guests' ID photographs and feedback voice notes in private storage (R2) for properties on Stae Host.

Each of these acts on our instructions. We do not sell your data, and we do not share it for anyone else's advertising.

How long we keep it

Your account, starting city and radius, and saved stays are kept until you delete your account. Usage events are kept so we can understand demand over time; when an account is deleted, the events it produced are detached from it and remain only as anonymous counts.

For a stay at a property on Stae Host, ID photographs are deleted 180 days after they were sent, and feedback voice notes a year after they were recorded. The rest of the booking and the guest register stay for as long as the property keeps its records, which the law may require; to have something corrected or removed, ask the property, or write to us and we will pass it on.

Deleting your account

Open You → Account → Delete account in the app, or your account page in the owner portal. This is immediate and permanent: your account, starting city and radius, saved stays and your sign-in sessions are erased. There is no recovery, so export anything you want to keep first. Listings you own are unlinked from you rather than deleted, so a property does not vanish from travellers mid-trip — email hello@stae.io if you want the listing removed too. You can also email us and we will delete the account for you.

Your rights

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Under India's Digital Personal Data Protection Act you may also withdraw consent and raise a grievance with us before approaching the Data Protection Board. Write to hello@stae.io and we will respond within 30 days.

Children

Stae is intended for adults. Do not create an account if you are under 18. If we learn that we hold an account belonging to a child, we will delete it.

Changes

If we change what we collect or why, we will update this page and change the date at the top. Material changes will also be announced in the app.