Privacy Policy

Who is responsible

Stealthy is the product name. The controller/operator’s legal identity and jurisdiction remain for owner review. An active support/privacy contact is not yet confirmed.

Information collected

Website browsing: hosting providers receive ordinary connection data such as IP address, request path and browser information to deliver and secure the site. The site does not ask for precise location, contact lists or a device fingerprint.

Checkout and account: we ask for the email you will use to sign in. Stripe processes payment details and may collect billing details, device/browser information and fraud-prevention signals. Card numbers are handled by Stripe, not stored by Stealthy’s licensing server.

Desktop access: the app sends a hashed device identifier, device name, account identity when signed in, and access requests. Trial timestamps, subscription state, registered devices and key-redemption records are stored to verify access and enforce device limits. Raw firmware identifiers are hashed locally.

Product use: saved points, favorites, route drafts, preferences and pairing records remain on your computer. Map tiles, place searches and road routing use external map services, which receive the requests needed to return that data. This is not an assertion that all coordinates always stay offline.

Why information is used

To deliver downloads and the website, authenticate sign-ins, provide purchases and subscriptions, verify trial/license eligibility, prevent repeated trials and abuse, process support requests and meet applicable obligations. No optional advertising or analytics integration is enabled in this website.

If you contact support, provide only what is needed to investigate the issue. Never send payment card numbers, passwords, sign-in codes or full device logs unless specifically requested through an appropriate secure channel.

Service providers

Stripe handles payments, billing portal sessions and payment security. Supabase provides account authentication and the licensing database. Sites/Cloudflare supplies website hosting. Desktop map and route providers receive map-related requests. Email delivery configuration is still being finalized; the intended provider is Resend through Supabase SMTP.

Providers may process information in other countries under their own service terms and privacy practices. Applicable transfer arrangements and the operator’s processing locations must be confirmed before public launch.

Retention

Trial-device records are retained to remember that a device has used its one-time trial. Account, billing, registered-device and webhook records currently persist until administratively removed; no automatic account-deletion schedule is claimed. Billing records may need to be retained for legal or accounting obligations.

Expired backend rate-limit records are eligible for cleanup after one day; the cleanup runs hourly while the service is running. Local saved routes and preferences remain until you remove them or clear application data. Provider log and financial-record retention follows the applicable provider’s settings and obligations.

The owner must confirm a formal retention schedule, deletion workflow and any required statutory retention periods.

Cookies and local storage

No optional analytics or advertising trackers load on the marketing page. A necessary-only privacy preference can be saved in this browser. Stripe’s payment service loads after you choose Continue to payment and may use cookies or similar technology for requested checkout and fraud prevention. See the Cookie Policy for details.

Choices and security

Use Cookie preferences in the footer, clear local browser storage or remove locally saved app data. You can cancel recurring billing through the app’s Account settings. Depending on applicable law, you may have rights to access, correct, delete or restrict processing of personal information. The operator must provide a working privacy contact to receive those requests.

Server credentials stay on the backend. Access controls and row-level database policies restrict client access. The Windows app stores refresh tokens in Credential Manager. These measures reduce risk but do not guarantee absolute security.