Privacy Policy

1. What we collect

• Account: email address, a scrypt hash of your password (or a GitHub id if you sign in that way), display name.
• Team and project metadata: names, membership, invites, personal access token names and hashes.
• Environment snapshot metadata: tool and runtime versions, lockfile hashes, environment variable names, git branch, commit and dirty-file paths, OS and timezone.
• Content your team creates: debug session messages and attachments, announcements, policies, work claims and run records.
• Operational records: request logs (method, path, status, duration, account, IP), error records, and delivery records for notification emails.

2. What we deliberately do not collect

Environment variable values. Source code and file contents. Secrets of any kind. This is a structural property of how snapshots are built, not a promise about handling. Message bodies, attachments and error records additionally pass through server-side redaction for common credential shapes before storage.

3. Why we process it

To provide the Service you signed up for (contract), to keep it secure and working (legitimate interests), and to send the notifications you choose (your settings, which you can change at any time).

4. Where it lives

The European Union — Microsoft Azure, North Europe. Backups stay in the same region.

5. Who else touches it

Microsoft Azure (hosting and database) and Resend (notification email). If billing launches, Stripe will handle payments and card details will never reach our servers. We do not sell data and there are no advertising trackers.

6. How long we keep it

• Snapshots: 90 days by default, and only the most recent per machine and project.
• Resolved debug sessions: kept as your team's archive until you delete them.
• Operational logs and error records: 30 days.
• Account data: until you delete the account.

7. Your rights

Access, correction, deletion, portability and objection. Deleting your team or account from the app satisfies most of these immediately; for anything else, write to privacy@stma.ai and we will answer within 30 days. You may also complain to your local data protection authority.

8. Cookies

One session cookie, httpOnly and SameSite=Lax, plus a short-lived cookie during sign-in verification. Nothing for advertising or cross-site analytics.

9. Contact

privacy@stma.ai — Matte AI LLC, 30 N Gould St, # 47622, Sheridan, WY 82801, USA. Security reports go to security@stma.ai.