# Privacy Policy

Date of last revision: 2026-10-06

## 1. Who we are and what this covers

Stophy ("we", "us") operates stophy.dev, the Stophy dashboard and the Stophy API. This policy explains what information we collect when you use them, how we use it, who we share it with and what choices you have.

## 2. What we collect

We collect your name, email address, and profile avatar when you create an account via email or OAuth (Google, GitHub). We do not collect more than what is necessary to operate the service.

We log API request metadata: endpoint called, HTTP status code, credits consumed, and response time. We use this to operate the service, display your usage dashboard, and detect abuse. We do not log or store the content of your API requests or the data returned in responses.

Payments are processed by Stripe. We receive transaction confirmations (session ID, amount, credits granted) and store Stripe customer IDs. We do not store payment card details.

We record how the website and dashboard are used, such as pages viewed, buttons clicked and errors that occur. We do not record your screen or your keystrokes.

## 3. How we use your data

Your account data (name, email) is used to authenticate you and communicate service-related updates. We do not send marketing emails unless you opt in.

Request logs are used to display your activity dashboard, calculate credit usage, and monitor service health.

Usage records are used to find and fix problems and to decide what to improve.

## 4. Who we share it with and why

We do not sell, rent, or share your data with third parties for advertising purposes. We share it only with the providers that help us run the service:

Stripe processes payments. Stripe receives the payment details you enter at checkout.

Google and GitHub sign you in, if you choose to sign in with one of them. They tell us your name, email address and avatar.

PostHog provides product analytics and error reports. It receives the usage records described above. Usage is linked to your account only when you are signed in.

Hosting and database providers store and serve the application and its data on our behalf.

## 5. Content from other sites

The search box on our home page shows results from other sites, including video thumbnails, place photos and site icons. Your browser loads those images directly from YouTube and Google, so those sites receive your IP address and browser details when results appear.

## 6. Cookies and browser storage

We use a session cookie to keep you signed in. Our analytics stores an identifier in your browser so that visits can be counted. We do not use advertising cookies.

## 7. How long we keep it

Request logs are retained for 90 days from creation. When you delete your account, all associated personal data is permanently removed within 30 days, except records we are legally required to retain (such as payment transaction records).

## 8. Your rights

You may access, correct, export, or delete your personal data at any time from the Settings page. To delete your account, go to Settings → Account → Delete account. All associated data is removed within 30 days.

To exercise any data rights not covered by the self-service tools, or to ask questions about your data, email support@stophy.dev.

## 9. Security

We use HTTPS for all data in transit. API keys are hashed with SHA-256 before storage. Encrypted copies are stored separately and only used for the key reveal feature. We follow industry-standard security practices.

## 10. Changes to this policy

We may update this policy from time to time. For material changes, we will notify you via email or a dashboard notice. The date at the top of this page reflects when it was last updated.

## 11. Contact

For privacy questions or data requests, contact us at support@stophy.dev. For the full terms of service, see our Terms of Service page.