Privacy Policy
1. What this policy covers
Stealth-X operates the official website, account system, license and key features, script services, and related APIs available through our official domain. This policy explains the information the service handles and the reasons it is used.
2. Information we handle
- Account information: email address, display name, account status, account creation and update times, and last-login information.
- Authentication information: a securely stored password hash when you use email/password sign-in, plus an external authentication identifier and profile photo URL when you use supported Google or GitHub sign-in.
- License and device information: license records, activation state, plan information, and HWID/device information needed to enforce license and device rules.
- Security and abuse-prevention information: request metadata and rate-limit information used to protect authentication, API endpoints, license flows, and the service from abuse.
- Support information: information you voluntarily provide when asking for help through our official support/community channels.
We do not intentionally collect unrelated personal files or browser history merely because you visit the site.
3. Why we use information
- To create and authenticate accounts and keep sessions working.
- To provide license, key, device, and HWID features.
- To protect the service against automated abuse, excessive requests, fraud, and account-security incidents.
- To operate payments, account management, support, and service administration where applicable.
- To maintain logs needed for security, troubleshooting, and service integrity.
4. Account security
Account sessions use the ca_session cookie. The current implementation sets it as HttpOnly, SameSite=Lax, and Secure when served outside local development, with a maximum session lifetime of seven days. Passwords are not stored in plaintext; email/password accounts use a PBKDF2-SHA-256 password hash with a per-password salt.
5. Third-party services
Stealth-X may rely on third-party infrastructure for services such as authentication, bot protection, payments, hosting, or external community links. Those providers may process information under their own privacy policies when their services are involved.
The site currently includes Google/Firebase-based identity verification for supported OAuth sign-in and Cloudflare Turnstile for bot protection during account-related flows.
6. Retention
Account, license, device, payment, and security records may be retained for as long as reasonably necessary to provide the service, enforce license rules, prevent abuse, resolve disputes, maintain security, or meet applicable obligations. Short-lived authentication and verification material is designed to expire as part of the relevant flow.
7. Sharing
Stealth-X does not sell personal information. Information may be shared with service providers only when reasonably necessary to operate, secure, support, or process a feature you use, or when disclosure is required by law.
8. Your choices and requests
Depending on where you live, you may have rights to request access, correction, deletion, export, restriction, or objection regarding certain personal information. For account or privacy requests, contact the Stealth-X team at contact@getstealthx.site or support@getstealthx.site, or through the official Discord community. We may need enough information to verify that a request relates to the correct account.
9. Children
Stealth-X is not intended for children under 13, and we do not knowingly collect personal information from children under 13.
10. Changes
We may update this policy when the website, backend, authentication, licensing, or legal requirements change. The latest version will be published at getstealthx.site/privacy.