Privacy

What we collect

Requests and visits. When you use our website, search API or MCP server, we log basic request details, such as what was requested, when, the referring page, the country and network Cloudflare reports, and the kind of browser or client. We also count page visits. We keep these logs to run and protect the service and to understand how it's used.

We monitor page-level events for aggregate metrics.

Searches. We store search text as you typed it, for up to 180 days. Please keep personal information and secrets out of searches.

IP addresses. We use IP addresses to keep the service safe, to spot fake search-engine crawlers and to count visits. We don't keep them in a readable form, apart from short-term backups and logs that are deleted within 30 days.

File conversions. Files you convert are deleted when the conversion finishes, and we never keep their contents.

Conformance checks. To check a domain, we fetch its public ARD catalog. Results are shown on the public scoreboard only for domains already in our index.

Publishers. We index public ARD catalogs as their publishers list them. Our crawler also reads other public registries.

Domains you add. If you add a domain on our Publish page, we store the domain, when you sent it and what our crawler found there (for example "found" or "nothing found"). We don't publish what you type. Our crawler then reads only the files that site publishes about itself at its /.well-known/ addresses. If they're valid, the resources they describe are indexed like any other publisher's. To stop abuse, we keep a scrambled (keyed hash) copy of your IP address for 2 days.

Waitlist. If you join the Private ARD waitlist, we store your email address, the company size you pick, and anything you add afterwards (your role, your company and what you'd list first). We also store when you agreed to be emailed and the exact wording you agreed to, the website that sent you, and any campaign tags in the link. To stop spam, we keep a scrambled (keyed hash) copy of your IP address for 30 days.

Why and on what basis. We use this only to email you about Private ARD early access, and only because you asked us to (your consent). You can withdraw your consent at any time: use the unsubscribe option in any email, or write to privacy@stealthstack.ai.

Where it lives and who sees it. Waitlist details are stored in a database in StealthStack's own Cloudflare account. Only StealthStack can see them. We don't sell them, share them, or upload them to advertising platforms.

Your copy. Ask privacy@stealthstack.ai for a copy of what we hold about you, or for it to be corrected or deleted.

How long we keep it

• Search text: up to 180 days.
• Request logs: kept to run and protect the service and to understand usage.
• Backups: deleted within 30 days.
• Domains you add: until our crawler has checked them, then 90 days after that check.
• The scrambled copy of your IP address from the "Add your domain" form: 2 days.
• Waitlist details: until 12 months after early access opens, and never more than 18 months. If you don't confirm our first email within 30 days, we delete your details. If you ask us to remove you, we stop emailing you at once and delete your details within 30 days.
• The scrambled copy of your IP address from the waitlist form: 30 days.
• If you unsubscribe or ask to be removed, we keep only a scrambled (keyed hash) copy of your email address, so that we never email you again even if someone else types it into the form. It can't be turned back into your address. To rejoin, write to privacy@stealthstack.ai from that address.

Third parties

• Cloudflare hosts our website, API and data. Cloudflare Web Analytics counts page views, and Cloudflare says it uses no cookies.
• Our pages load fonts from Google Fonts, so your browser contacts Google.
• GitHub runs our crawler and scheduled jobs, and holds short-term backups.
• The waitlist form and the "Add your domain" form use Cloudflare Turnstile to check that you're a person. Turnstile doesn't read what you type. Cloudflare's Turnstile privacy addendum explains what it collects.
• We send waitlist emails from our Google Workspace account.

Cookies

We don't use tracking or advertising cookies. Cloudflare may set a strictly necessary security cookie.

What we don't do

We have no accounts and no ads, and we don't sell data.

Contact

Questions, or want something deleted? Email privacy@stealthstack.ai. If what we collect changes, we'll update this page.