Your saves. Your privacy.

1. About Stelth and contact

For questions about Stelth and the personal data processed through this service, contact: stelth.xyz@gmail.com. This notice covers stelth.world, its vault, waitlist and the connection to the Instagram account @stelth.xyz.

Instagram and ChatGPT also process information under their own privacy terms when you use those services.

Privacy at a glance

• Your vault is private. Saving a post does not publish it or your notes to a shared library.
• The Instagram connection processes supported messages you send to @stelth.xyz, not your entire inbox.
• The current service does not analyse videos, generate AI outputs, take subscription payments or operate public rankings.
• You can delete saves, disconnect Instagram or contact us to request access to or removal of your data.

2. What we process and why

An email is necessary to join the waitlist. Signing in is necessary for a private vault. Instagram connection data is necessary only if you choose that feature. You can browse the landing page and this notice without an account.

3. What happens to a DM

Meta sends the bot supported message events. Before you connect a vault, we use your sender identifier to generate a temporary connection link and reply. We do not add that first message to a vault. After connection, supported messages and shared links are saved to your vault. Send only content you want the service to process.

The current integration saves text and links. It does not import your entire Instagram inbox or saved collection, download full videos or automatically transcribe them. Meta may also include attachment information in an event. A shared link can identify its original author.

Stored content is not visible to other Stelth users. This is access controlled storage, not end to end encrypted storage. Authorised operation and infrastructure access may allow access where needed to run or support the service.

4. Who receives information

Stelth uses OpenAI’s Sites infrastructure for hosting and ChatGPT sign in, with Cloudflare infrastructure for serving the website and storing application data. Meta provides the Instagram connection and receives the bot’s service replies and delivery identifiers. Google processes support correspondence sent to our Gmail address.

Access is limited to what is needed to operate the service, provide support or meet a legal obligation. We do not sell personal data or provide private vaults to advertisers. Information may be disclosed where legally required. Following a saved link takes you to a separate service with its own practices.

Provider notices: OpenAI, Cloudflare and Meta / Instagram.

5. International processing

Providers operate internationally, so information may be processed outside Finland and the European Economic Area. We do not promise that all data stays in the EU. Locations and transfer safeguards depend on the provider and applicable service agreement. Contact us for information about the arrangements applicable to your data.

The exact hosting subprocessor arrangements, backup retention and applicable transfer safeguards for this early version are still being verified. Publishing this notice does not itself complete that verification.

6. How long information is kept

Vault content remains until you delete it or request removal. An Instagram connection remains until disconnected or removed. Disconnecting stops new saves for that connection but does not delete existing content.

Connection links and pairing codes expire after 10 minutes. Expiry makes them unusable; expired records are removed during subsequent connection operations rather than by an exact ten minute deletion timer. Reply delivery is limited to 23 hours from the relevant message time. Stored reply text is cleared after confirmed delivery, or when an expired reply is processed.

Duplicate prevention records and reply metadata can remain after processing. There is currently no general automatic expiry job for those records. They are included in a deletion request where they can be associated with your account.

Waitlist information is kept while access and launch updates remain relevant or until you withdraw. Support correspondence is kept while resolving your request and for justified follow up or legal requirements. Provider logs and backups follow provider retention settings; exact expiry for every backup has not yet been verified. Deleting a save does not instantly erase every backup.

7. Security and browser storage

Connections use HTTPS. Private vault requests are checked against the signed in user. Owner integration secrets are encrypted before application database storage and are not returned by the settings screen. These controls reduce risk but cannot guarantee absolute security.

The application does not add advertising pixels or optional analytics. Sign in and infrastructure may use cookies or similar mechanisms needed for authentication and security. Instagram access tokens are not stored in browser local storage. Do not save passwords, payment details or sensitive personal information in your vault.

8. Your choices and rights

You can inspect, edit and delete individual saves and disconnect Instagram in your vault. To request a copy, correction, full deletion, restriction, portability where applicable, or to object to processing based on legitimate interest, email stelth.xyz@gmail.com. See the deletion instructions.

Withdraw waitlist consent at any time by emailing from your registered address. Withdrawal does not affect earlier lawful processing. We may ask for proportionate verification before disclosing or deleting account data. Never send passwords, access tokens or app secrets.

We respond without undue delay and normally within one month. If a lawful extension or exception applies, we explain it. You can complain to Finland’s Office of the Data Protection Ombudsman or your local supervisory authority.

9. AI analysis and future connections

The current vault does not send saved content to an AI model for analysis or training. Planned AI connections, video analysis, weekly rankings and the community are not operating features. We do not currently build public rankings from private saves or publish DMs. Before new processing, we will update this notice and seek consent where required.

Before introducing AI analysis, we will explain which providers receive content, what is sent, why, and the applicable retention and training arrangements. These terms do not authorise undisclosed future processing. Any new legal basis or consent requirement will be addressed before the feature is enabled.

10. Shared library and weekly discoveries

A shared library and weekly top 10 are planned, including possible paid access. They are not operating today. A private save is not permission to publish it. Your private notes, account identity and DM conversations will not automatically become library content.

Before contributions are enabled, the contribution screen will identify exactly what would be shared, with whom, whether it is available to paying members and how to remove your contribution. Publication requires appropriate content rights as well as a lawful basis for any personal data involved.

Any future popularity counts must be designed to avoid revealing individual saving activity. Removing names alone does not necessarily make information anonymous. We are not currently using private saves to create public rankings.

11. Age and automated decisions

Stelth does not make automated decisions with legal or similarly significant effects on you. The early service is intended for adults and is not directed at children. Contact us if you believe a child has submitted information so we can investigate and remove it where appropriate.

12. Changes and contact

We update the date when practices change and provide appropriate notice of material changes. Questions and requests: stelth.xyz@gmail.com.