Privacy Policy

Who we are

Cekura, Inc. operates Stewdio. This policy covers our website, applications, and Stewdio MCP server. For privacy questions or requests, contact founders@stewdio.ai.

Information we collect

• Account information: your name, email address, profile image, sign-in information, and organization memberships and roles.
• Your work: the Files, compositions, Graphic scripts, and assets you create, import, or edit, together with information needed to save and synchronize them. This includes Comments you post and the Blocks you create, save, or publish.
• Community profile: the handle, display name, bio, and avatar you set for your public profile.
• Billing information: subscription status, billing contacts, invoices, and payment references. Stripe processes payment details when you use checkout or the billing portal.
• Usage and technical information: browser and device information, page visits, download clicks, product usage events, error reports, request logs, and network information used to operate and protect the service.
• Communications: information you send us when asking for support or contacting the team.
• Feedback: feedback about Stewdio that you send, or that a connected AI client sends for you, including its text, any images or videos attached to it, whether you or the client wrote it, and the account that sent it.

How we use information

We use information to provide Stewdio, sign you in, save and synchronize your work, manage organizations and subscriptions, respond to requests, understand website and product use, review feedback to improve Stewdio, and investigate errors or abuse. We also use it to meet legal obligations and send service communications or product updates you request.

Where a legal basis is required, we rely on performing our agreement with you, legitimate interests in operating and protecting the service, legal obligations, or your consent, as appropriate to the activity. You can ask us about the basis for a particular use or withdraw consent by contacting us.

Connected AI clients

When you connect Stewdio to an AI client, the client can request your File content and receive tool results, and can make changes within the access you authorize. Information sent to that client is also subject to its provider’s privacy policy and your settings with that provider. A connected AI client can send feedback about Stewdio to our team for you. It is instructed to ask you first unless you requested it, and to leave out File content and personal details you have not agreed to share. Stewdio can’t read your conversations with the client; it receives only what the client sends in tool calls. Disconnect the integration through the client when you no longer want to use it.

Service providers and other disclosures

We use providers including Cloudflare for hosting and storage, WorkOS for identity and organization management, Stripe for billing, Google for fonts, and PostHog for product analytics and error reports. They receive information needed for the services they provide. PostHog receives your account email and name with your product use and error reports. Your organization’s administrators may also receive membership and billing information needed to manage that organization.

People with access to a File see your name on the Comments you post there. Blocks you publish to the Community and your Community profile, including its handle, display name, bio, avatar, join date, and published Block and save counts, are public: anyone can view them on the web without an account, and signed-in users can save published Blocks and add them to their Files. Unpublishing a Block removes it from the Community, but copies others already added to their Files stay in those Files.

Graphic scripts run in an isolated frame on stewdiousercontent.com, a domain we operate separately from stewdio.ai. The frame receives only the script and File content needed to draw it and can’t access your account or sign-in. Depending on a File’s content, it can load public code libraries, fonts, and other resources from esm.sh and jsDelivr only. These requests omit credentials but send connection information to those services.

We may disclose information when required by law, to protect people or the service, or in connection with a merger, acquisition, or transfer of business assets, subject to applicable legal protections.

Cookies and browser storage

Stewdio uses cookies and browser storage for sign-in, preferences, and local File data. The production website and applications also load PostHog to measure visits, product use, and errors; it can use cookies and similar identifiers. Google Fonts requests send connection information to Google.

You can manage cookies and site storage in your browser. Blocking or clearing storage can affect sign-in, local preferences, and unsynced work.

How long we keep information

• Accounts and Files: we keep account information and saved Files while you use the service. Deleting a File removes it from normal access immediately. Contact us to request permanent deletion of a File’s stored content, assets, thumbnails, and application recovery copies, or to request account deletion. We handle these requests manually, aim to complete verified requests within 30 days, and will explain any information we need to retain.
• Temporary uploads: unfinished upload objects are set to expire one day after upload. Storage-provider cleanup can take additional time. Assets saved in a File follow the File retention period above.
• Routine hosting logs: logs stored in Cloudflare Workers Logs expire within seven days. Records needed to investigate a specific security incident may be kept until that investigation and any related dispute are resolved.
• Other records: support correspondence is kept as needed to handle your request, and feedback with its attachments is kept as needed to review and act on it; analytics follows the provider’s configured retention cycle. Necessary billing and accounting records are kept for the applicable recordkeeping period. Contact us for the retention details of a particular record.

Provider-managed recovery history can remain after live data is erased and expires under the provider’s recovery cycle. Account deletion does not automatically delete another person’s work or an organization’s records. We will work with you to resolve shared content and administration responsibilities.

Server deletion does not erase copies you saved or exported to your devices, or copies held by independent recipients. Connected AI clients apply their own retention policies to information they receive.

Security and international processing

We use access controls and other safeguards to protect information, but no storage or transmission system is completely secure. Our providers may process information in countries other than your own. Contact us for information about processing locations and the safeguards that apply to your information.

Your choices and rights

You can update profile information in Stewdio, edit your Community profile or remove its avatar, unpublish Blocks, and choose which AI clients you connect. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information, object to or restrict its use, withdraw consent, or complain to a data protection authority.

Send requests to founders@stewdio.ai using the email associated with your account. We may need to verify your identity before handling a request. To stop optional product emails, contact us at the same address. If you believe a child has provided personal information to us, please contact us so we can investigate.

Changes and contact

We may update this policy as the service changes. We will post the revised policy here with an updated date and provide additional notice when required. Visit Support or email founders@stewdio.ai with questions.