Privacy Notice
Last updated: 28 August 2026. This notice explains what Stella collects, why, and what control you have.
What we collect
- Account data — username, email address, hashed password, verification state, and profile fields you choose to fill in (avatar, bio, links).
- Content you create — characters, greetings, prompts, lorebooks, personas, memories, and uploaded images.
- Conversations — the messages exchanged between you and a character, stored so you can return to a chat.
- Provider configuration — the endpoints and credentials you enter for your model provider, stored so requests can be made on your behalf.
- Operational data — request counts, error counts, and uptime. We do not run third-party analytics or advertising trackers.
Why we use it
To authenticate you, to store and display the content you create, to route your requests to your chosen model provider, to enforce the Terms and act on reports, and to keep the service running and secure. We do not sell personal data.
Who it is shared with
Prompt and conversation content is sent to the model provider you configure, and is then subject to that provider’s privacy policy. Email is sent through a delivery provider for verification and password resets. Content you publish publicly — a character, a profile — is visible to anyone, including search engines. Beyond that, data is disclosed only where the law requires it or where it is necessary to address a credible threat to someone’s safety.
Cookies and local storage
Stella stores your session token and interface preferences in your browser’s local storage. There are no advertising or cross-site tracking cookies.
How long it is kept
Account data and content are kept until you delete them. Deleting your account removes your profile, characters, and conversations; residual copies may persist briefly in backups, and moderation evidence may be retained where it is needed to handle a report or a legal obligation.
Your rights
You can view and edit your profile and content at any time, export characters, and delete individual items or your whole account from settings. Depending on where you live you may also have rights to access, correct, port, or restrict processing of your data; use the report and contact route on the Safety page to exercise them.
Children
Stella is not directed at children under 13. If we learn that an account belongs to a child under that age, we remove it.
Security
Passwords are stored hashed, sessions are token-based and revocable, and uploads are re-encoded server-side before storage. No system is perfectly secure; report a suspected vulnerability rather than testing it against other users’ accounts.
Changes
Material changes to this notice will be posted here with an updated date.