Privacy policy

Torsvik Labs (org. no. 937 316 704), Eliasmarken 14, 5164 Laksevåg, Norway, is responsible for the data described here. You can use Stelora without telling me who you are. Contact: hello@stelora.app.

In plain words

You don't have to tell me who you are. Upload without an email and the session is a cookie in this browser — your images hang off that, not off a name. Your IP is kept for a day, so that one visitor can't flood the queue. An email, if you leave one, is how you get back to your uploads from another device and how I'd reach you about a job — leaving one after a finished image is what makes an account, and opening the link I send is what confirms it. I don't share it and I don't run a marketing list.

One more thing I store, from your first upload on: a random number in this browser, so I can tell whether anyone comes back for a second image. That's the number that decides whether Stelora keeps going. Nothing about you or your device goes into it — it's random, and that's all it is — and it's never sent anywhere but here: no ad network, nothing that follows you off stelora.app. If you've given me an email, I do join the two up, so uploads from this browser and from that address count as one person and not two. Clearing your browser storage wipes the number for good and starts you over as a new visitor, as far as I can see. Page views, referrers, countries and device types are also counted by Vercel Web Analytics, without cookies and without personal data.

What I store, and why

• Your uploads and finished images — to process them and let you download them. Kept until you delete your account or ask me to delete them. I look at them only to find out why a job failed, when you ask me for help, when you have given me permission, or to check that a change to the processing does not make results worse.
• A session cookie — a random token that ties your uploads and free credits to this browser. Needed for the service to work.
• A random number in browser storage, from your first upload on — to count whether people come back. It contains nothing about you. Before your first upload, the same kind of number is kept only in the open page, not stored. If you give an email address, I link the two, so your uploads count as one person. Clearing browser storage removes it.
• Sign-in cookies, only if you sign in — they keep you signed in on this browser.
• Visit and upload events — which page you opened and which step you reached (file chosen, price shown, result viewed, download, rating), with the random number above, the referring site's name and the campaign tag of the link you came from. No IP address and nothing that identifies your device. These events go only to stelora.app and my own database. If you leave an email address, it is recorded with that event.
• Your IP address — kept for one day, to stop one visitor flooding the queue.
• Your email address, only if you give it — to sign you in, and to tell you when an image is ready if you ask. No marketing emails.
• Credits and purchases — a record of every credit given and used, and, for paid plans, your Stripe customer and subscription IDs. Kept while you have an account, and as long as accounting law requires for purchases.
• Page views, referrers, countries and device types — also counted by Vercel Web Analytics, without cookies and without personal data.

The legal basis is the contract with you (running the service you asked for) and, for abuse protection and visit counts, a legitimate interest in keeping the service working.

Payments

Stripe processes payments as merchant of record and is responsible for the payment data it collects (card details, billing address, VAT). I never see your card number. See Stripe's privacy policy.

Who else handles the data

• Supabase — database and file storage, in the EU (Stockholm)
• Fly.io — image processing, in Stockholm
• Vercel — website hosting
• Resend — sending email
• Stripe — payments

Vercel, Resend and Stripe may process data in the United States, under the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Nothing is sold or shared with anyone else, and nothing is used for advertising.

Your rights

You can ask to see, correct, export or delete your data. Deleting your account from the account page deletes your images, your credits and your account. Visit and upload events that carry your email address are deleted when you ask. You can complain to the Datatilsynet, the Norwegian data protection authority.