Privacy policy

Last updated: 30 August 2026

This policy explains how Sthang handles information for its websites, documentation, Windows applications, and optional integrations. Sthang is a personal hobby project operated from Cambodia; it is not a registered company. This policy is written for the current hobby and Beta scope and may change as the project changes.

Information we handle

Optional Discord connection

If you choose to connect Discord, Sthang requests only the identify and guilds scopes. The broker may receive the Discord account identifier and permitted profile/account-health data, plus guild identifiers and names, so the app can show the requested account and guild discovery information. Sthang does not request or process message content, reactions, server-management actions, or other write capabilities.

The Discord client secret is kept only in the server-side broker. Callback and polling authorities are one-way-hashed, while token and capability envelopes are encrypted for the short-lived operation. Normal operation state is removed after the roughly 10-minute flow; if provider cleanup is ambiguous, encrypted recovery state may be retained until the issue is manually resolved. On Windows, a credential needed for a connected account remains in the current-user protected local vault until you disconnect or delete it.

Sthang ACO

ACO keeps application settings, wallet references, local history, and other operator data on your device. When you ask it to use a blockchain, RPC, marketplace, or other provider, the relevant request is sent to that provider. Those providers may receive network, wallet-address, transaction, or request data under their own policies. Sthang does not ask you to send private keys to Sthang by email or through this website.

Sthang Studio

Caption timing, editing, projects, history, and exports remain local. When you choose Generate or Regenerate, Studio sends normalized WAV audio, relevant context, and requested wording directly to Google Gemini with your own API key. Studio sets store: false on Gemini interactions, but audio is still uploaded through the Gemini File API; Studio does not delete those uploads, and Google controls retention for up to 48 hours. See Studio’s published privacy details and Google’s privacy policy.

Website and support information

If you contact Sthang, the project receives the information you choose to include, such as your email address and message. For operation-start abuse throttling, Cloudflare supplies the connection IP to the Worker. The Worker normalizes and one-way-hashes that IP, does not product-log or store the raw address, and uses the hash for the limiter key. Other presented authorities and operation IDs are also one-way-hashed into supplemental limiter keys. Cloudflare separately processes network and security data as part of its service; see Cloudflare’s privacy policy. Sthang does not sell personal information, serve advertising, run analytics, or retain Discord invocation logs as a product feature.

Do not send wallet keys, API keys, OAuth tokens, seed phrases, or other secrets in support messages.

How information is used

Sthang uses information only to provide the feature you request, maintain local account state, respond to support or privacy requests, prevent abuse, and protect the project and connected providers. Sthang does not use Discord data for advertising, profiling, or unrelated enrichment.

Who receives information

Information may be handled by the service needed for your request: Discord for the authorized OAuth data, Cloudflare for the broker and its security layer, and providers you explicitly use from ACO or Studio. Sthang does not sell personal information or share it with data brokers. Providers are independent services with their own terms and privacy policies. Their handling may occur outside Cambodia.

Retention and deletion

You can disconnect or delete the Discord connection from the app to remove its local credentials. Short-lived broker state is removed after the normal OAuth operation, while encrypted recovery state may remain only until an ambiguous provider cleanup is resolved. Email deletion requests can cover only broker and support data under the operator’s control. Delete local vault data, application data, backups, and exports in the app or on your device. Provider-held data, including Discord account data, Cloudflare request data, Google uploads, or blockchain records, is controlled by the relevant provider and must be addressed through that provider’s process.

For a privacy or deletion request concerning broker or support data under the operator’s control, email privacy@sthang.app with enough information for the project to understand and verify the request. Do not include secrets. Sthang may need to retain a minimal record of a request or security event where required to resolve abuse, a dispute, or a legal obligation.

Security

Sthang uses HTTPS for web and broker traffic, keeps the Discord client secret server-side, one-way-hashes callback and polling authorities, encrypts token and capability envelopes, and uses Windows current-user protection for local credentials. No service can promise absolute security. Keep your device, browser, Discord account, wallet, and API keys protected, and report suspected problems without including secrets.

Children and changes

Sthang is not directed to children who cannot legally use the relevant product or connected provider. Do not use the Discord connection unless you meet Discord’s age and eligibility requirements. Sthang may update this policy by publishing a revised version at this page; the “Last updated” date identifies the current version.

Contact

For privacy questions or requests concerning broker or support data under the operator’s control, contact privacy@sthang.app. Local vault and application data must be removed in the app or on your device, and third-party data must be addressed through the relevant provider. Sthang is a hobby project operated from Cambodia, not a registered company. Nothing in this policy prevents you from exercising a right that applicable law gives you.

This is plain-language project information, not legal advice.