Privacy Policy
Last updated September 26, 2026
- We collect your email address, the inventory you enter, and the photos you upload. That's what the service needs to work.
- There are no ads, no analytics, no tracking cookies, and we don't sell or share your data for marketing.
- Photos you ask us to read are sent to Anthropic's Claude to be transcribed. Everything else stays with Cloudflare, which hosts the service.
- You can export your data any time and delete your account yourself, in Settings.
Who we are
NowStocking ("we", "us") runs the hosted parts-inventory service at app.nowstocking.com and this website. Questions about privacy go to privacy@nowstocking.com.
NowStocking is also open-source software that people run on their own Cloudflare accounts. This policy covers only the service we run. If you use a copy someone else hosts, that person is responsible for your data there.
What we collect and why
| Data | Why |
|---|---|
| Your email address | To sign you in with a one-time code, to identify you to people in workshops you share, and to send invites and label PDFs you ask for. |
| Sign-in codes and a session cookie | To keep you signed in. Codes are stored only as one-way hashes and expire after 10 minutes. The session cookie (ns_session) is the only cookie the app sets. It's required for the service to work. |
| Inventory you enter | Kits, parts, locations, pick lists, quantities, notes, and a history of who changed what and when. This is the service. |
| Photos you upload | Packing-list and plans-page photos, and the text read from them, so you can review an import. |
| Usage and cost records | How many photo pages each workshop has read, and what reading them cost us, to apply the free allowance and limits. If you delete your account, these totals are kept without any link to you. |
| IP address and browser signals | To limit sign-in requests and to run the Cloudflare Turnstile bot check on the sign-in form. We don't store them with your account. Cloudflare keeps standard request logs for a short time for security and debugging. |
We don't use analytics or advertising tools, and we don't build profiles of you.
Who processes your data
- Cloudflare hosts the service and stores all of the data above. It also delivers our emails and runs the Turnstile bot check. See Cloudflare's privacy policy and its Turnstile privacy addendum.
- Anthropic receives a photo only when you start an import or a pick list from photos, so its Claude model can read it. Anthropic handles that data under its commercial terms. See Anthropic's privacy policy.
We don't sell your data or share it with anyone else, except where the law requires it.
Workshops you share
Everyone in a workshop can see its warehouses, parts, photos, and change history, including the email addresses of the people who made changes. If you invite someone, we email them the invite on your behalf.
How long we keep it
We keep your data until you delete it or delete your account. Photos stay until you delete the import or your account. Deleted data may remain in Cloudflare's point-in-time recovery for up to 30 days before it's gone for good.
Your choices and rights
- Export: Settings → Export CSV downloads every item in a warehouse.
- Delete: Settings → Delete account removes your account. Workshops where you're the only member are erased with their warehouses and photos. In shared workshops you leave, and your email is removed from their change history, but the parts you added stay for the others.
- Anything else: to get a copy of your data, correct it, or ask a question, email privacy@nowstocking.com. We'll respond within 30 days. Depending on where you live, you may have more rights under laws such as the GDPR or California's CCPA. We honor those requests too.
Security
Traffic is encrypted with HTTPS. Sign-in codes and session tokens are stored only as hashes. Each warehouse's data is stored separately, and every request is checked against your membership. No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you.
Where your data is
Cloudflare runs the service on its global network, so your data may be processed outside your country. We're based in the United States.
Children
The service isn't meant for children under 13, and we don't knowingly collect their data.
Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll tell you in the app or by email before it takes effect.