Privacy Policy

Effective October 16, 2026. Previously effective October 10, 2026.

This Privacy Policy explains how Stele AI LLC, a California limited liability company doing business as Stele ("Stele", "we", "us", or "our"), collects, uses, and shares personal data when you use stele-ai.dev, app.stele-ai.dev, and our related services (collectively, the "Service").

1. Information We Collect

Information you provide

When you sign in using GitHub or Google, we receive basic profile information from that provider, including your name, email address, and the unique identifier they assign you. We do not receive your password from these providers.

If you ask us to email you a reminder to create your account later, we receive the email address you enter. We send that address one reminder right away. If no account uses the address three days later, we send one final reminder. The first email lets you cancel the second. We do not add the address to any mailing list or use it for anything else. We keep it, with the information about which page or advertisement brought you to us, so we can tell whether the reminder led to an account.

When you communicate with us by email or through any support channel, we receive the contents of your message and any attachments you choose to send.

Information you submit to the Service

When you or an AI coding agent acting under your account submits content to Stele (including knowledge nodes, tasks, decisions, comments, documents, file paths, and code snippets), we store that content as part of your project. We process this content solely to provide the Service to you and the team members you authorize.

Some features process that content with an AI model provider listed in Section 4: search (we compute an embedding of each item's text so it can be found by meaning), automatic recall (described below), the in-app assistant, and the privacy check described below. These requests go only to providers with zero-data-retention terms, so the provider does not keep the content after the request and does not use it to train models.

Automatic recall

When an AI agent works in a project with the Stele plugin installed, Stele looks for project content that bears on each message before the agent answers. To do this, the plugin sends your message and the end of the agent's previous reply to the Service. We search your project with them, and an AI model listed in Section 4 reads the message together with the titles and excerpts of the matching items to decide which ones are relevant. We use the message and the reply only for that request and do not store them.

Privacy check on public projects

A public project can be read by anyone. When an AI agent writes to a public project, we may check the text before it is saved for credentials and for personal details about identifiable people, such as health, employment, or contact information. If the check finds something, the write is held back once and your agent is told why; you can then remove the details, make the project private, or save the text unchanged. The check is on by default for public projects and off for private ones, and project members can turn it on or off for each project in its settings. Bulk imports are not checked. The text is sent to an AI model provider for the check. We do not store the text as part of the check; we keep a record of the outcome (for example, which kind of detail was found and whether the write was published anyway).

Automatically collected information

When you use the Service, we and our infrastructure providers may automatically collect information such as your IP address, browser type and version, operating system, referring page, pages visited, actions taken in the application, and timestamps. We use this information to operate, secure, and improve the Service.

Agent telemetry (optional)

When you install Stele into a coding agent, we ask whether Stele may collect telemetry to improve the product, and we record your answer on your own machine. If you agree, two categories are collected:

• Usage — which Stele tool or command ran, how many times, whether it was invoked from the command line or through the agent integration, how long it took, whether it returned an error, the *names* (never the values) of the arguments passed, and your operating system, runtime, and Stele version. It also includes which coding agent you are using, the version and capabilities that agent reports about itself when it connects to Stele, and the name of the AI model driving it where the agent tells us. The model name is what the agent reports, and we never infer it from anything you or the agent wrote.
• Effectiveness — a score, computed on your own machine, of how much of the context Stele supplied to your agent was actually used, together with up to four short written answers from your agent about where Stele helped and where it got in the way. These are sampled occasionally rather than collected every session, and collecting them briefly resumes your agent, which consumes your own model provider quota.

We do not collect your prompts, your agent's transcripts, the contents of your notes, tasks, or documents, your files, or your source code through these channels. The Effectiveness score is derived from a session transcript that is read locally and never leaves your machine; only the resulting counts and scores are transmitted.

You may decline when asked, and you may turn either channel off at any time by running stele telemetry off (Usage) or stele telemetry feedback off (Effectiveness). Declining does not limit your use of the Service in any way. If Stele is installed non-interactively — in an automated environment, where we cannot ask — the Usage channel is enabled by default and the Effectiveness channel is not enabled; you can turn Usage off at any time with the command above.

Cookies and similar technologies

We use a small number of strictly necessary cookies for authentication and security — for example, to keep you signed in to app.stele-ai.dev. We also store a few first-party preferences in your browser (such as your theme and the project you last opened) so the Service works the way you left it. We do not use advertising cookies, and we do not load advertising or tracking scripts from an advertiser on our pages.

Our product analytics are privacy-friendly and cookieless: they do not set cookies, do not track you across other sites, and do not build an advertising profile. We count page visits without identifying anyone; see *Counting page visits* below.

When you arrive from somewhere else — a search result, a link, an ad — we remember which site sent you, and any campaign tag on the link you followed, so we can tell which channels bring people to Stele. This is kept in your browser's session storage, which means it belongs to that browser tab alone, is never sent to anyone else, and is discarded when you close the tab. It records the referring site's name only, never the address you came from or anything you searched for. We do not set a cookie for this, and we cannot read it from any other site. It is never used to build a profile. Where the link you followed was a paid advertisement, see *Measuring our advertising* below.

The first time you visit, we show a brief notice about this. If we ever introduce cookies or similar technologies that go beyond what is described here — for example, advertising cookies or anything that follows you across other websites — we will update this Policy and ask for your consent before setting them, where required by law.

Counting page visits

We count how many times each page on our sites is opened. For every page load we record the date, which of our two sites served it, the page's address with any identifying parts removed, whether you arrived from another website rather than from a page of ours, and whether the request looked like it came from an automated crawler.

We keep a running total, not a record of your visit. There is no entry for you, no identifier of any kind, no cookie, nothing stored on your device, and no record of your IP address. Nothing here can be traced back to a person, by us or by anyone who obtained the data.

Because we do not identify anyone, we cannot tell how many separate people visited — only how many times a page was opened, and how many of those arrivals came from off our sites. We accept that limit rather than issue an identifier to remove it.

We use these counts to see which pages people read and where they stop. We keep them for 180 days. They are never combined with your account, never shared with an advertiser, and never used to build a profile.

Counting how our pages are used

On our marketing pages we also count how often each of the main links and buttons is used: the sign-up button, the sign-in link, a button that copies an install command, and the badges that add Stele to another product. On the sign-up page we count how often the offer to email yourself a reminder is shown, tapped and sent, and whether it was shown inside another app's built-in browser. For each one we record which control it was, roughly what size of screen it was used on, and which page it was on.

We also count how pages are read: how far down a page people scroll, which parts of it come into view, how long it stays open while on screen, which part was in view when it was closed, and which links lead away from it. Each of these is a count per page and per day, the same as the button counts.

Sometimes we show two versions of our homepage to see which one helps people more. The version is picked at random when you arrive. It travels in the web address while you browse, so you keep seeing the same one, and the counts above are kept per version. Nothing is stored on your device, so a later visit may show you the other version.

So that our own visits do not distort these counts, a browser in which a Stele team member is signed in as an administrator gets a small cookie that leaves its visits out. It is never set for anyone else.

These counts are sent from your browser to our own website and stored in our own database, which runs on the providers named in our list of sub-processors. Some of the button counts are also recorded by our hosting provider's analytics.

This works the same way as counting page visits and is subject to the same limits. There is no entry for you, no identifier, and no cookie. We cannot tell that the same person used two different buttons, and we cannot connect any of it to your account or to anything you later do in the Service.

We use these counts to find the places where our own pages fail people, such as a button nobody can find, or an option we only offer on a screen size where it cannot be used.

Measuring our advertising

We advertise Stele on Google, on ChatGPT, and on Reddit. When you click one of those advertisements, the advertising platform adds its own click identifier to the web address you arrive on — Google calls it a gclid, OpenAI calls it an oppref, and Reddit calls it an rdt_cid. We did not create that identifier and it does not identify you to us by name.

We record that identifier, the pages you then open on our own sites, and coarse details of the visit: the country the request came from, whether you are on a phone or a desktop computer, and which site referred you. We do this so we can see whether our advertising reaches people and where our pages lose them. None of this is stored on your device: the identifier travels in the web address, and the record is kept on our own servers.

If you go on to create a Stele account in that same visit, we tell the advertising platform that the click it sold us resulted in a signup. We send the platform back its own click identifier. We do not send your name, your content, or anything you do inside Stele. We ask these platforms to use this for measuring and billing our advertising, and we do not ask them to use it to personalise advertising to you.

To Google and to Reddit, the click identifier is the only thing we ever send. We do not send either of them any information about you personally, anywhere in the world.

To OpenAI, if you are outside the European Economic Area, the United Kingdom and Switzerland, we also send a one-way cryptographic hash of your email address, which lets them recognise an account holder they already know without us handing over the address itself.

If you are in the European Economic Area, the United Kingdom, or Switzerland, none of these platforms receives any information about you personally, and we tell Google and OpenAI that we are not asserting your consent, which means each applies its own default and may not count the conversion at all. We would rather lose the measurement than claim a permission we did not ask you for.

Where the GDPR or UK GDPR applies, our basis for recording the visit and reporting that a signup happened is our legitimate interest in understanding whether our advertising works, balanced against your rights, which is why that report carries no information about you personally. You can object at any time by contacting us, and we will stop reporting conversions associated with your account.

We keep the page-by-page record of an advertising visit for 180 days. The summary of the visit — which advertisement it came from and whether it led to a signup — is kept for as long as we need it to assess that campaign.

2. How We Use Information

We use personal data to:

• provide, operate, maintain, and secure the Service;
• authenticate you and the team members you authorize;
• respond to support requests and other communications;
• investigate and address actual or suspected security incidents, abuse, or violations of our Terms;
• check text written to public projects (and to private projects where the check is turned on) for credentials and personal details before it is saved, to help prevent accidental disclosure;
• understand how the Service is used so we can improve it. This can include asking an AI model provider listed in Section 4 to summarize usage statistics together with project names and descriptions; the contents of your projects are not included; and
• comply with applicable legal obligations.

We do not sell personal data. We do not use the content you submit to the Service to train machine-learning models for any purpose other than improving features that you have explicitly enabled within your own account.

3. Legal Bases for Processing (EEA / UK Users)

Where the EU/UK General Data Protection Regulation applies, we process personal data on the following bases: performance of a contract with you (to provide the Service); our legitimate interests in operating, securing, and improving the Service (balanced against your rights); your consent (where we ask for it, such as for optional features); and compliance with legal obligations.

4. Sub-Processors and Service Providers

We rely on the following sub-processors to operate the Service. Each is contractually obligated to protect personal data and to process it only on our instructions:

• Supabase, Inc. — hosted Postgres database, authentication, and realtime infrastructure. Stores all of Your Content and account data.
• Vercel, Inc. — hosting and content delivery for our web applications and APIs. Processes request metadata and logs.
• Resend, Inc. — transactional email delivery (sign-in confirmations, invites, account notifications).
• GitHub, Inc. (a Microsoft subsidiary) — OAuth identity provider, used only if you choose to sign in with GitHub.
• Google LLC — OAuth identity provider, used only if you choose to sign in with Google. Separately, where you reached us through a Google advertisement, Google receives its own click identifier, and nothing else, so that it can measure and bill that advertising. See *Measuring our advertising*.
• Stripe, Inc. — payment processing, used only if and when you elect a paid plan.
• Sentry, Inc. — error monitoring and crash reporting for the hosted service. Receives error events and stack traces; request bodies, cookies, and headers are scrubbed before transmission and no user content is included.
• OpenAI, L.L.C. — advertising measurement, used only where you reached us through a ChatGPT advertisement. Receives its own click identifier, and outside the EEA, the UK, and Switzerland also a hashed email address. See *Measuring our advertising*.
• Reddit, Inc. — advertising measurement, used only where you reached us through a Reddit advertisement. Receives its own click identifier, and nothing else. See *Measuring our advertising*.
• AI model providers, reached through Vercel's AI Gateway — run the features described in *Information you submit to the Service*. Requests are routed only to providers with zero-data-retention terms; they do not keep the content after the request and do not use it to train models:

- Microsoft Corporation (Azure OpenAI Service) — search embeddings of your content's text. - Anthropic, PBC — the in-app assistant, and summaries of usage statistics with project names and descriptions. Anthropic's models may also be served through Amazon Web Services or Google Cloud under the same terms. - Amazon Web Services, Inc. (Amazon Bedrock) — titles for assistant conversations, and serving the assistant's models when needed. - Google LLC (Google Cloud Vertex AI) — serving the assistant's models when needed. - TypeSafe AI — the privacy check on text written to projects where the check is on, and choosing which project items automatic recall shows to your agent.

This list will be updated in this Policy if it changes. We will provide notice of any new sub-processor before it begins processing personal data on our behalf, where practical and required by law.

5. International Data Transfers

We are based in the United States. Our sub-processors may store and process personal data in the United States or other countries. Where personal data is transferred from the EEA, the UK, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards, including the EU Standard Contractual Clauses or equivalent mechanisms.

6. Data Retention

We retain Your Content for as long as your account is active. If you delete a project, we delete its content from our active systems within 30 days. Backups are retained for up to 30 additional days before being overwritten on rotation. We may retain limited information for longer periods where required by law or for legitimate business purposes such as fraud prevention or dispute resolution.

Signup reminder requests (Section 1) are deleted 90 days after you make them.

Agent telemetry (Section 1) is retained for 12 months and then deleted automatically. Deleting your account deletes all agent telemetry associated with it.

Records of privacy checks on public projects (Section 1) contain the outcome of each check, never the checked text. They are deleted when you delete your account.

7. Your Rights

Subject to applicable law, you may have the right to: access the personal data we hold about you; correct inaccurate personal data; request deletion of your personal data; object to or restrict certain processing; receive your personal data in a portable format; and withdraw consent where processing is based on consent.

You can delete your account and download a copy of your personal data directly from the Account → Security section in the app — no request email needed. For other rights (correction, restriction, objection), or if you encounter any issue with the self-serve options, email legal@stele-ai.dev from the address associated with your account. We will respond within the timeframes required by applicable law (generally 30 days under the GDPR and 45 days under the California Consumer Privacy Act).

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what categories of personal information we collect, the right to request deletion, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

If you are in the EEA, the UK, or Switzerland, you also have the right to lodge a complaint with your local data protection authority.

8. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit (TLS), encryption at rest where supported by our sub-processors, row-level security policies in our database, principle-of-least-privilege access controls, and required multi-factor authentication for our administrative accounts. No method of transmission over the internet or method of electronic storage is perfectly secure, however, and we cannot guarantee absolute security.

Suspected security issues can be reported to security@stele-ai.dev. Our responsible disclosure policy is also available on the website.

9. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, contact legal@stele-ai.dev and we will take steps to delete it.

10. Local Stele Clients

If you install and run the Stele command-line interface or the Claude Code plugin on your own computer, those clients store credentials and local cache files locally. We do not have access to that local data. When those clients communicate with the hosted Service on your behalf, the data they send is still subject to this Policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice by posting the updated Policy on stele-ai.dev with a revised effective date and, where reasonably practical, by emailing the address associated with your account.

12. Contact

Privacy questions and data-subject requests: legal@stele-ai.dev. Security issues: security@stele-ai.dev. General support: support@stele-ai.dev.

Stele is operated by Stele AI LLC, a California limited liability company.