Privacy Notes

Last updated: 2026-07-19

S-tello Trace is a tool that “sees” how you work. We believe the privacy notes for such a tool shouldn't read like lawyers writing to lawyers — you should be able to understand, in five minutes, exactly what is recorded, where it lives, what leaves your machine, and how to undo everything. Here are the full answers.

1. What gets recorded

• Foreground events: the app in front, its window title, the browser URL, and when the switch happened.
• Screen candidates and local replay (optional): app/page changes, missing context, repeated workflows, and meeting boundaries create candidates. They are deduplicated on-device before a few key frames are selected for a work segment. Local replay is off by default and can be disabled and cleared in settings.
• Calendar events: meeting titles and times from your system calendar (EventKit) and Lark/Feishu (if you connect it), used to tell meetings apart from focus work in reports.
• Exclusion rules drop data before it's stored: block specific apps and sites (password managers, private browsing) — matching events are discarded, not recorded.

2. Where it lives

Screen pixels are used in memory on-device for OCR and key-frame selection by default; selected frames are written to local files only if you enable local replay. OCR, window titles, URLs, raw timeline rows, and personal work memory are stored in a local SQLite database on your machine. Signing in does not automatically copy them to the Stello cloud. The app shows the location and provides export and deletion controls.

Accounts and S-tello-hosted AI are in invite-only beta. If you sign in, acknowledge the current processing disclosure, and redeem an invite, account, allowance, and usage metadata enter a separate cloud control plane; the versioned consent receipt stays on this device. Signing in does not copy local work history. Local capture, Today, Week, Briefs, search, export, and local deletion continue to work when cloud services are unavailable.

3. What leaves your machine

• S-tello-hosted AI (the fresh-install default): only after sign-in, acknowledgment of the current managed-AI processing disclosure, and invite redemption does bounded context needed for the current classification, brief, or workflow analysis go through the S-tello AI Gateway on Cloudflare Workers to a fixed Qwen3.5 Flash model on Alibaba Cloud Model Studio. It may include app names, window titles, URLs, times, meeting titles, and text derived from local evidence for that task; it does not upload the entire SQLite database, full timeline, or local replay library. The request and model response pass through the gateway runtime, but Stello's application database and gateway usage ledger store only account, operation, status, request ID, and token counts—not prompts, screenshots, OCR, URLs, window titles, or model content. If the processor, region, fields, or retention disclosure changes, the consent version changes and an older receipt no longer authorizes managed calls.
• Your own model service (optional): with BYOK, context needed for the current task goes directly from this Mac to the provider you choose; your API key does not pass through S-tello. Loopback Ollama can keep it on-device, while a remote Ollama host is still an off-device transfer.
• Cloud visual understanding (a separate choice): off by default. Representative frames selected on-device leave the device only after you test image support and explicitly agree. In S-tello-hosted mode, they follow the same Cloudflare Workers → Alibaba Cloud Model Studio route; with BYOK, they go from this Mac to the visual-model provider you choose. Account login, product feedback, and future organization Ontology sync do not enable this feature or upload the full local replay library to Stello.
• Account and invite allowance: sign-in sends your email and verification-code data to the account service. Redemption may store account ID, invite-redemption state, allowance and usage metadata, a personal tenant, server-authored capabilities, and security audit metadata. The versioned managed-AI consent receipt stays on this device. Login is not consent to upload work trails, enable hosted AI, or enable organization sync.
• Product feedback you submit: an ordinary submission contains category, message, current app page, app/platform version, and an idempotency ID. The native client attaches the active tenant from the signed-in session; the page cannot forge it. Ordinary feedback has no diagnostic attached by default and contains no screenshots, OCR, window titles, URLs, timeline rows, prompts, or API keys. A bounded diagnostic is attached to one feedback submission only after you consent in the separate diagnostic preview.
• Organization Ontology (not publicly enabled yet): joining an organization or switching tenants does not move personal history. A future device-connection flow must ask you to select tenant and purpose, preview the derived fields that would leave the device, and record versioned consent. Raw screenshots, OCR, window titles, URLs, and raw events remain local by default.
• Crash & health diagnostics (beta, opt-in): the app can record Apple-provided crash and hang diagnostics, an unexpected end to the previous run, and interface runtime errors on-device. Reports stay local first and sending is off by default. You can preview every field, dismiss a report, consent to one submission, or separately enable future automatic submissions of the same allowlisted scope and turn that off at any time. Allowed fields are limited to diagnostic version, report ID, occurrence time, app/build/macOS/CPU versions, bounded error and state values, a constrained page route, call stacks, and bounded health counts. They contain no screenshots, replay frames, OCR, window titles, URLs, raw timeline rows, work content, user input, clipboard content, prompts, model responses, or keys. Stello privately archives UUID-matched dSYMs for each release build to symbolicate call stacks; symbol files are not included in diagnostic packages or public installers. This website runs no analytics scripts.

Accounts and hosted AI are enabled only for the invite beta; organization/FDE sync is still not a public capability. Signing in, redeeming an invite, changing models, or submitting ordinary feedback does not enable organization sync.

4. Hosted-AI providers, regions, and retention

• Cloudflare Workers (S-tello AI Gateway): receives and forwards hosted-AI requests and responses. Processing is not pinned to one region; requests normally execute at a Cloudflare data center near their source, so processing in a single country or region cannot be guaranteed. The current gateway configuration retains Worker logs sampled at 100% and traces sampled at 5% for 7 days. Automatic runtime records include metadata such as request method, path, status, duration, and request/response size. The logs we write contain only request ID, operation, model, and token counts; we do not write prompt or image bodies to logs.
• Supabase (account and allowance control plane): the current invite-beta project is in ap-south-1 (Mumbai, India). It stores account, invite-redemption, allowance, usage, and security-audit metadata—not hosted-AI prompts, screenshots, OCR, URLs, window titles, or model content. This metadata is currently retained for the account lifecycle; no shorter automatic cleanup period is configured. The invite allowance's 14-day validity is not a data-retention period. During the invite beta, request deletion through the contact below; deletion is not complete until support confirms it.
• Alibaba Cloud Model Studio (Qwen3.5 Flash): the current hosted-model endpoint is in Beijing, China. It receives context needed for the current task and, if you separately enable cloud visual understanding, selected representative JPEG frames, then returns the model result. Alibaba Cloud states that data generated during model calls may be stored as required by applicable laws and regulations and is not used to train or improve models without separate authorization or consent. Its public product documentation does not give an exact retention period for this call data, so we do not promise immediate deletion or zero retention by the model provider.

This hosted-AI path may involve cross-region or cross-border processing across Cloudflare's global network, Mumbai, India, and Beijing, China. Before using it, exclude sensitive apps and sites such as password managers and medical, financial, legal, or customer-confidential systems. Do not intentionally submit passwords, API keys, identity credentials, or other highly sensitive content to hosted AI. If this path is not acceptable, switch to loopback Ollama or choose and assess your own BYOK provider.

5. API keys and account sessions

The model key for S-tello-hosted mode stays server-side and is never sent to the client. API keys you provide are stored in the macOS Keychain; local configuration retains only non-secret provider, endpoint, and model metadata. A BYOK key is used only between your machine and that provider and is never attached to product feedback or organization data. The cloud-account refresh token uses a separate Keychain item; the access token is memory-only and does not enter the WebView, localStorage, logs, or exports.

6. How to undo

• Pause recording: one click in the menu bar to pause/resume.
• Disable screenshots: a single switch in settings; existing captures can be deleted manually.
• Withdraw hosted-AI consent: withdrawing the local receipt under “Account & AI” immediately stops new S-tello-hosted text and vision calls. It does not delete local evidence or already-issued allowance metadata, and data already processed by a provider remains subject to the retention boundaries above.
• Disable or dismiss diagnostics: diagnostic sending is off by default. You can dismiss one local report or disable future automatic submissions in settings. If the account or network is unavailable, the report remains local and is not marked as sent.
• Delete local work data: use the deletion control in settings to clear the database, replay frames, and local configuration. Uninstalling the app does not delete files you previously exported.
• Sign out: removes the local cloud session and active-tenant selection only. It does not delete the cloud account, memberships, submitted feedback, or local work data.
• Delete the cloud account: this is a separate, explicit operation. During the invite-only beta, contact us using the link below; the isolated self-service deletion gateway is not yet a public capability. The request is not complete until support confirms deletion. Local data can be deleted separately at any time.

7. About Stello and organizations

Personal and organization spaces are separate isolation boundaries: joining an organization does not move personal history into it. Organization views should receive only separately consented derived facts and default to role, team, and workflow aggregates; cohorts smaller than three are not shown as team aggregates. FDE access will be purpose-, resource-, and time-bounded rather than tenant-wide or raw-evidence access by default. Cross-organization training and the data flywheel are currently disabled; organization consent does not grant cross-customer learning rights.

8. Questions

If anything above is unclear — or you find behavior that contradicts this document — reach us via s-tello.com/contact. “Behavior doesn't match the docs” is treated as a highest-priority bug here.