Last updated: 11 October 2026
The short version. You can play as a guest without giving us anything. If you make an account we store your username, email, a hashed password and your progress. Your username, stats and raid history are public. We never see your card number, because Stripe handles payments. We do not sell your data, and we run no analytics or advertising trackers of our own. You can delete your account yourself, in Account settings.
This summary is for orientation. The sections below are the actual policy.
Stashout is run by Anish Gupta, an individual doing business as Stashout. Anish Gupta decides what is collected and why. For anything in this policy, including requests to see or delete your data, contact [email protected].
You can play as a guest without giving us anything. A guest is a random token saved in your own browser. It carries no name, no email and no way for us to identify you as a person. The progress a guest makes is tied to that token alone, so if the token is lost the progress cannot be recovered.
| What | Why |
|---|---|
| Username | To identify you in game, on the leaderboard and to other players. |
| Email address | Login, password reset, verification, and account security notices. |
| Password, hashed with scrypt and a per-account salt | Login. We never store your actual password and cannot recover it, only reset it. |
| Linked Google or Discord account: their user id, and the email they report to us | Optional social login, if you choose to use it. |
| Account creation date | Support and abuse investigation. It is also shown on your public profile. |
| Each signed-in device: its IP address, its browser and operating system, and when it was last used | To show you the list of devices on your account so you can sign any of them out, and to email you when a device we have not seen before signs in. |
Everything the game remembers between raids: your stash and its tabs, worn equipment, backpack, money, career statistics, quests, achievements, unlocked titles, cosmetics, gacha state, tickets and raid history. Friends lists and in-game mail are stored so they can be delivered.
Anyone can look up an account by username without logging in. What they see is your username, the date you joined, your career statistics, your worn title, whether you have Premium, and your raid history, including the gear you took into and out of each raid. The leaderboard shows the same names and numbers. If you share a raid by link, anyone with that link can see that raid.
World chat is visible to the players in the world. The last 50 messages are held in the server's memory so someone arriving can see the conversation, and are not saved to our database. Your stash contents, money, mail and friends list are not public.
Because your username is public, do not use your real name or anything else that identifies you.
We record your IP address when you connect. It is used to enforce bans and is included in the security email we send when someone signs in to your account. Player reports are stored, including the names involved and anything the reporter wrote, along with moderation decisions and bans. A ban may be recorded against an IP address as well as an account. Actions taken by operators are written to an internal audit log.
Payments are processed by Stripe. Your card details go directly to Stripe and are never sent to, seen by, or stored on our servers. We keep the Stripe customer and subscription identifiers, and a record of what you bought, so we can give you what you paid for and handle refunds and support.
We use no tracking or advertising cookies. The game stores this in your browser:
account-token: your login session. This one is sent to us
with every request that needs to know who you are, which is what signs you in.
stash-token: the random guest identity, if you have not logged in.
Also sent to us, for the same reason.
account-name: your username, so the lobby can greet you before it loads.stash-muted-chat: players you have muted in chat.stashout-settings-3: volume, keybinds, graphics quality and the rest.stashout_adwall: set only if you use the ?adwall= testing
switch, which is a developer tool rather than anything the game does on its own.
stashout.editor.*: only if you open the in-browser map, game data or track
editors. These are development tools, and their drafts stay on your machine.
Everything above except the two tokens stays on your machine. The tokens have to travel, or we would have no way to tell your account from anyone else's.
There is exactly one cookie, and only if you log in with Google or
Discord: a short-lived oauth_nonce that exists to stop someone forging that
login. It is HttpOnly, expires within minutes, and identifies nothing about you.
Clearing your browser storage signs you out and discards an unclaimed guest.
We do not sell your personal information, and we never have.
Stashout is not intended for children under 13, and we do not knowingly collect anything from them. If you are under 18, you may only use Stashout with a parent or guardian's permission, and only they may make purchases.
If we learn that an account belongs to someone under 13 we delete it and its data. If you believe a child has given us information, email [email protected] and we will remove it.
Delete your account yourself. Open Account settings and choose Delete account. It takes effect immediately and cannot be undone. It removes your profile, stash, progress, mail, friend connections, login sessions and the account itself, and it signs you out of any raid in progress.
For anything else, email [email protected] from the address on your account and we will:
We answer within 30 days. We may ask you to confirm you control the account first, so that nobody can obtain or erase your data by pretending to be you. A guest is only a random token, which cannot be tied to a person, so these requests are about accounts.
Some records survive deletion where we are required to keep them, in particular payment records for tax and accounting, and ban records that exist to stop the ban being evaded.
You also have the right to object to or restrict how we use your data, and to complain to your local data protection authority. We use your data to run the game you asked to play, to keep it safe and fair, and to meet legal obligations such as tax records. We do not sell or share personal information for advertising, and we make no automated decisions that have a legal effect on you.
Passwords are hashed with scrypt and a per-account salt, so a copy of our database does not reveal them. Traffic is encrypted in transit. No service is perfectly secure, and we do not claim otherwise. If a breach affects you, we will tell you.
Our servers and our providers are in the United States. If you use Stashout from elsewhere, your data is transferred there.
We will update this page when the game changes what it collects, and move the date at the top. Material changes will be announced in game.
Anish Gupta, [email protected]