PRIVACY POLICY

1. Open Source & Self-Hosting Notice

If you self-host StoneWay, you are the sole data controller. You maintain your own database and encryption keys. The authors and maintainers have zero access to your self-hosted infrastructure.

2. Data We Collect & Store

• Account Data: GitHub ID, username, email, and avatar obtained via GitHub OAuth (minimal read-only scopes: read:user, user:email). We never request repo write scopes.
• Memory Files: Your raw markdown notes (StoneWay.md) and structured JSON matrix (StoneWay.json).
• API Credentials: Your StoneWay API token is stored as a cryptographic SHA-256 hash for authentication. An encrypted copy is kept inside an AES-256-GCM envelope strictly for your manual dashboard reveal.
• Third-Party Tokens: Optional external tokens (GitHub PAT, Notion token) are encrypted using AES-256-GCM with a 96-bit random IV. They are never logged or exposed in plaintext.

3. What We Never Do

We never sell, rent, monetize, or trade your personal data. We never use your private profile content, notes, or agent prompts to train machine learning models.

4. Your Rights (Export & Deletion)

You can download your entire profile as raw .md and .json files at any time. You can wipe your active memory with one click in the editor, and all historical revisions are soft-archived for 30 days before permanent destruction.