Privacy Policy
Understand how StuffHub uses information and the choices you control.
Contact Mehdi IllalaStuffHub Pro purchases
Apple processes App Store payments. StuffHub uses RevenueCat to retrieve subscription offers, validate purchases, restore purchases and determine whether your Pro entitlement is active. RevenueCat receives an app-specific anonymous customer identifier, purchase and subscription transaction information, and technical request information such as app/device platform and IP address. StuffHub does not send your tasks, journals, HealthKit records, photos or other feature content to RevenueCat, and does not receive your payment-card number. No email address or advertising identifier is explicitly supplied to RevenueCat by this integration. Subscription records may be retained to provide access, support restorations and comply with financial or legal requirements. Manage or cancel subscriptions through your Apple Account; resetting StuffHub does not cancel an Apple subscription. Contact the developer with subscription or privacy questions.
Who operates StuffHub
StuffHub is operated by Mehdi Illala. Contact mehdi.illala@gmail.com for privacy questions or requests. This policy explains the information used by the current app, why it is used, where it is processed and the choices available to you. Some features work on your device; features that request online information also contact the services described below. This policy applies to StuffHub and its app-operated service, not to independently operated websites you choose to visit.
Your information on the device
StuffHub stores the information you create or import to provide its features: tasks, habits and check-ins, subscription reminders, notes and their attachments, journals and selected images, pet profiles and care records, calendar plans, alarms, countdowns, water and food logs, workout records, cycle dates, favorites, wallet passes, invitations, chat history, selected cities and settings. Imported documents, photos, recordings and exported files may also be stored locally. These records may include sensitive information that you choose to enter. The current app has no StuffHub account system or developer-operated document-upload service. Routine app storage is not the same as an encrypted private vault.
Why information is used
Information you enter or authorize is used to provide the features you request, save your preferences and progress, schedule selected reminders, display widgets, process selected media and documents, and respond to support requests. Optional device permissions and iCloud backup remain under your control. StuffHub has no advertising or third-party behavioral analytics SDK in this version and does not sell your personal information or use HealthKit information for advertising. Network providers receive the request information needed for their services and may maintain their own operational logs. Device-only records are not automatically sent to the developer simply because you use the app.
Health and fitness
With your permission, HealthHub reads steps, active energy, exercise minutes, walking/running distance, sleep, resting heart rate, heart-rate variability, respiratory rate and blood oxygen from Apple Health. Gym can read workout history and write workouts you complete after authorization. Availability depends on which devices and apps record these measurements. Health readings and summaries are processed and cached locally; the current health services do not upload these readings to an AI server. StuffHub does not use HealthKit data for advertising or marketing. Cycle, nutrition, hydration and workout logs are also personal health information. Future app-managed iCloud backups exclude these structured health records. Older backups may still contain manually logged health records; delete those backups separately if needed. Withdrawing Health access does not erase Apple Health or existing local records. Manage permission and delete source records in the Health app. If you enable Apple Health heart-event alerts, StuffHub also requests read access to high-heart-rate, low-heart-rate and irregular-rhythm events already recorded by Apple Health. Available changes and goal milestones may be checked using OS-controlled HealthKit background delivery. StuffHub does not continuously detect heart emergencies or replace Apple Watch safety features.
Permissions you control
Location supports local weather, maps, travel, prayer times and Qibla. The camera supports scans, food recognition, wallet codes and visual tools. Selected photos and files support editors, journals, widgets and attachments. Microphone access supports tuning, recordings, sound effects and dictation. Calendar access lets you import and create events. The system contact picker supplies only the contact you choose for Fake Call. Motion sensors support tools and tilt games. Notifications and AlarmKit support reminders and alarms. Local-network access supports nearby games. Face ID uses Apple's authentication system; StuffHub receives the result, not your face template. You can refuse or revoke permissions in iPhone Settings or the Health app; affected features may stop working. Reset App cannot revoke system permissions. Optional background arrival reminders use significant location changes only when enabled and Always Location permission is granted. Apple geocoding resolves a city, country and time zone. Your base city, last country/time-zone transition and reminder deduplication records remain on the device; no travel history is sent to StuffHub's backend.
Location and online services
Online requests reveal your public IP address and connection information to the receiving service. Weather forecasts and solar times use MET Norway. Requests send coordinates rounded to four decimal places and your public IP address to MET Norway, which logs requests on servers in Oslo, Norway. City search and geocoding continue to use Apple services. No WeatherKit service is used. Forecasts are cached locally and shared with widgets; an older cached forecast may appear when the network is unavailable. Maps and Travel use Apple place search, geocoding and directions; offline map downloads contact OpenFreeMap. Prayer times send coordinates and calculation settings to Aladhan. Currencies uses Frankfurter. Network tools and Speed Test contact ipify, ipwho.is, Cloudflare, RIPE and selected LibreSpeed servers. Speed tests transfer generated test data, not your documents, and can consume substantial mobile data. Providers have their own retention practices and may process requests in different countries.
News, media and background updates
News sends country/category selections and search terms to StuffHub's Cloudflare service. The service supports FreeNewsAPI.io for headlines and original publisher links, and Openverse for openly licensed illustrative images. Cloudflare receives request connection information including the public IP address; upstream providers receive the service's requests. API credentials remain server-side and are not stored in the app. News feeds are cached operationally in HTTP edge caches and on the phone for up to six hours; short article-link/detail metadata and image-license metadata are cached for one day. News does not use Cloudflare KV. The existing request guard stores rate/quota counters, not article bodies. Licensed image downloads contact their hosting providers. Publisher RSS, GDELT feeds and publisher image scraping remain disabled. Opening an original report or image source contacts that destination. Travel loads Wikimedia/Wikivoyage content. Life Hacks may refresh from Stack Exchange. Subscription logos may load through Google's favicon service. Background news refresh and reminders make requests only when iOS allows them. External destinations follow their own policies. The extended converter uses a nonpersistent WebKit website-data store with document navigation and native messages restricted to its origin and main frame; selected file bytes enter remotely supplied JavaScript and these safeguards cannot guarantee that external code never transmits them.
AI, model downloads and speech
Downloaded chat models and Stable Diffusion image generation run locally after required resources are available. Apple's Foundation Models path uses the on-device framework when supported. Downloading models contacts Hugging Face and its delivery hosts, which receive your IP address, requested model and download metadata. The current chat generation path is local; having a provider-key setting does not make a working cloud AI integration or mean data is sent to that provider. Any future online provider integration needs an updated disclosure and consent before sending your content. Speech recognition uses Apple's Speech service and is not forced to run on-device, so dictation audio may be processed by Apple online. Do not assume the name 'Offline' guarantees offline dictation. Chat history is stored locally and may be included in an enabled iCloud backup. Avoid placing sensitive health or confidential information in chats or shared exports.
StuffHub 1.1: devices, language and local preferences
StuffHub supports iPhone and iPad, with English, French, Spanish and Arabic interface choices. Language, appearance, Focus customization and Home card preferences are kept on the device. Removing all Home cards leaves an empty dashboard; it does not delete the underlying section records. Subscription spending summaries are calculated from the service records and billing dates you enter, not from access to your bank account. Focus uses bundled artwork and audio locally, without camera or microphone permission. Its session history is local, not a developer-hosted activity log. These additions do not introduce advertising, an account requirement or a new analytics provider. Optional permissions remain controlled by iOS; an already granted permission can remain granted after onboarding or reinstalling. While Using location does not authorize continuous background arrival detection.
Focus sessions and local history
Focus is an optional StuffHub Pro section for offline focus sessions with an animated illustrated cat. Session durations, preferences and session history are stored locally on your device, not sent to StuffHub's backend. Focus does not require a StuffHub account or access to other apps. Sessions cannot be paused; cancelling requires holding the cancel control continuously for five seconds. You can independently choose the scene, timer style, cat pose and colors. Purring and touch-triggered meows are optional, bundled recordings played on your device without microphone access. You can delete individual sessions or all saved Focus history without stopping the active timer. Completion sounds are configurable in Settings, General, Notifications, Notification Sounds, Focus.
Support ID and Home preferences
Copy Support ID copies the current RevenueCat App User ID to the device clipboard only when you tap it. The ID already identifies your subscription record; this action does not create a new account, change your identity, start a purchase or send the ID to support automatically. StuffHub requests a device-local clipboard item with a ten-minute expiry, rather than Universal Clipboard sharing. You may voluntarily send the ID to the developer for subscription troubleshooting or a complimentary-access request. Treat it as private support information, not a password or proof of ownership. An anonymous ID can change after reinstalling; always use the current installation. Home starts with To-Do, Countdown and Weather on new installs; saved layouts, including an intentionally empty Home, are retained. These preferences do not delete the records in those sections.
Birdyzelo: offline play
Birdyzelo runs locally using Apple's SpriteKit. Its difficulty-specific personal bests and your day/night, bird color, pipe color, sound and haptic preferences are saved on the device. The game has no account, online leaderboard, advertising SDK or game-specific analytics, and does not send gameplay records to StuffHub's server. Sound effects are synthesized locally. Removing local app data can remove these records; do not assume game progress is synchronized between devices.
Account-free nearby games
Chess, Checkers, Backgammon and Wordzelo exchange player names, session details and moves directly with nearby devices using Apple's encrypted Multipeer Connectivity. No gaming account, internet matchmaking provider or gaming cloud is used. Local Network permission and nearby connectivity are required. Local game saves and Solitaire statistics remain on the device. Other participants can retain shared information. Leaving, app suspension or connectivity loss may end a session.
Notes and optional iCloud sync
Notes stores your text, checklists, selected photos, captions, handwriting and paper preferences locally on your device. Notes does not send this content to StuffHub's server or an AI provider. If you enable Sync notes with iCloud in Paper & type, note documents are synchronized through your own Apple iCloud Drive account using Apple's service and available iCloud storage. Concurrent edits may be kept as recovered copies to avoid losing your work. Turning this switch off stops future synchronization and retains local notes; it does not erase copies already in iCloud. Notes files, including Recently Deleted records, may also be included when you separately enable the app's optional iCloud backup. Moving a note to Recently Deleted keeps it recoverable without automatic expiry. After confirmation, Delete all recently deleted notes removes those notes' content and attachments from the app's current local records; they can no longer be restored through Recently Deleted. Minimal deletion metadata, including the note identifier and deletion time, remains to prevent older synchronized copies from reappearing. This deletion propagates when Notes sync is enabled and successfully completes; offline devices and unavailable iCloud services can delay it. Existing backups, exported or shared files and previous cloud file versions are not erased by this action and must be managed separately. Reset App clears local notes and disables Notes sync but does not delete existing iCloud documents, backups or exported files. Manage those copies separately through iCloud storage and the app's backup controls. PDF sharing, picture sharing and TXT export send content only to destinations you choose. PDF and pictures can contain text, photos and handwriting; TXT contains typed text and checklist states, with attachment descriptions rather than embedded photos or handwriting. Ending a Pro subscription does not automatically delete your notes or cancel an existing sync preference. Protect your device and Apple Account; do not assume local storage is a separate encrypted vault.
Documents and conversion
Native PDF, photo and audio processing takes place on the device. Before an extended conversion, including a fallback from a native conversion, the app asks whether to use the third-party converter. Continuing passes the selected file bytes and filename to p2r3 converter code loaded in an embedded web view. Declining does not authorize that transfer. The bridge does not intentionally upload files to a StuffHub server, but externally delivered JavaScript is not a fully bundled offline engine and may have its own network behavior. Use native processing for confidential files unless you are comfortable with this separate processing environment. Internet access may be needed to load conversion modules. Sharing or saving files to another app, cloud drive or destination is an action you choose and is subject to that destination's practices.
Optional iCloud backup
When you enable Back Up to iCloud, StuffHub copies supported app preferences and selected files to your private iCloud Drive container using Apple's service, not a StuffHub server. Supported files include journal images, pass and invitation records, saved route records and chat history. Structured health readings and health logs, API keys, app-lock credentials, model downloads and caches are excluded from future app-managed backups. This is not a complete backup of every imported file or every feature. Journals and chats can still contain sensitive information you type yourself; decide whether to back them up accordingly. A backup includes its creation date, app version and device host name. Turning backup off stops future backups but does not delete an existing one. Use Delete iCloud Backup to remove the app-managed backup. Apple's device backups and files you export to iCloud are separate and controlled by you and Apple.
Widgets, notifications and nearby play
Widgets share app snapshots and actions through StuffHub's on-device App Group container. Home Screen widgets, Lock Screen widgets, Live Activities and notifications may expose tasks, health summaries, photos, reminder titles and other selected information to someone looking at your device. Choose which widgets and previews to display using the app and iPhone Settings. Interactive widgets change local app records. Nearby Wordzelo exchanges your player/session information and round settings with invited nearby devices through encrypted Multipeer Connectivity sessions. It is not internet matchmaking. Other participants can retain what you share; disconnecting does not delete their copies. Reminder notifications may include habit symbols, cached subscription logos or a pet photo as an on-device image attachment. Cycle notifications contain estimates based on logs, not a medical prediction. Scheduled alerts are subject to iOS permissions, Focus and delivery controls; news alerts are not guaranteed when the app is closed.
Server notification delivery
If you allow notifications and enable news alerts, StuffHub registers this installation with Apple Push Notification service and its Cloudflare-hosted notification service. The service stores the Apple device token, delivery environment, news country preference, notification sound filenames, update baselines and a short pending-delivery queue. A random per-installation access credential stays in this device's Keychain and is excluded from iCloud backup. No health measurements, tasks, habit names, journals, contacts or precise location are sent for these server alerts. Cloudflare processes these notification records and connection information, and Apple processes the device token and notification content for delivery. Public news responses continue to use the existing content caches. Notification records are removed when all server alerts are disabled and the app successfully synchronizes, when Apple reports an invalid token, or after 90 days without a registration refresh. Uninstalling the app cannot immediately notify the server; expiry and Apple's token invalidation handle retained records. Failed preference changes retry while the app can run and on later app visits. Pending alerts older than ten minutes are discarded. News checks run every 15 minutes; coverage, outages, Focus and Apple's scheduling can delay or prevent delivery. The service does not claim a general news headline is verified breaking news. You can disable these alerts in Settings, General, Notifications. Delivery status and a test control are available there.
Retention, deletion and security
App records generally remain until you delete them in their section, reset the app or remove the app. Clear Cache removes supported caches, not all personal records. Reset App clears app-managed local data; exported files, Photos, Apple Health, calendar events and existing cloud backups are separate and may remain. An app-managed backup can restore earlier records, so delete it too when you want those copies removed. App Lock is an access gate, not separate encryption for every file or widget. The passcode hash uses Keychain; provider-key preferences currently use local app preferences, not a dedicated credential vault, and are excluded from the app-managed backup. No app or network service can guarantee perfect security. Use a device passcode, protect your Apple Account and share documents carefully.
Privacy choices, rights and contact
Use feature permissions and notification switches to control access; turn off iCloud backup and delete its existing copy separately; use per-item deletion, exports where available and Reset App for local records. Depending on applicable law, you may have rights to information, access, correction, deletion, portability, restriction, objection and withdrawal of consent, and to complain to the competent data-protection authority. Contact mehdi.illala@gmail.com for questions or requests. We cannot remotely access or delete records held only on your device or erase another provider's records. If you email us, your address and message are processed to respond and kept while needed for that request or legal obligations; do not attach sensitive records unless necessary. Processing may rely on your consent for optional access, providing requested features and applicable legal obligations; the relevant basis and cross-border requirements require review for the release territories. This notice does not waive statutory rights.
International processing and service logs
Online features may send the request information described in this policy to services in different countries, including Apple's services, Cloudflare, MET Norway, model download hosts and content providers. Request information can include your public IP address, the requested resource and, for location-based features, coordinates or a city. These providers' policies describe their storage locations, retention and applicable safeguards. The app's cache durations describe temporary content storage, not a promise that every provider deletes its operational logs on the same schedule. You can avoid optional online features or withdraw related permissions; local tools remain subject to their own feature requirements.
Children and changes
StuffHub is a general-purpose app, not a dedicated child account service. Parents should supervise Kids Stories and review generated content before sharing it with children. Do not enter children's identifying information into networked features without appropriate authority and safeguards. No advertising SDK or third-party behavioral analytics SDK was identified in the audited app sources; external services and Apple's platform may still collect operational data under their own policies. This notice must be updated before adding analytics, advertising, cloud AI, new data recipients or materially different processing. The review date identifies this version; reading this page is not blanket consent to future changes.