Privacy Policy

Stram is run by Stram.

We're the data controller for the personal information described here. To ask a question or use any of your rights, contact us using the details at the end of this page.

• Account details: your email address and, if you sign in with Google, Discord, or GitHub, your account ID, name, and profile picture from that service. We never see your Google, Discord, or GitHub password.
• Email accounts: if you use an email and password, the password is stored only as a secure one-way hash by our sign-in provider. Nobody at Stram can read it.
• Profile content: your username, bio, photos, banner, background, music, cursor, fonts and effects, link embed (SEO) settings, and social links.
• Workspace content: your AI chats, projects, and files you upload. Private uploads are stored encrypted.
• Messages: direct messages and voice notes you send to other Stram users.
• Purchases: whether you bought Stram Pro, when, and the amount. Card details are handled by Stripe and never reach our servers.
• Usage and security data: profile view counts, how many AI messages you've sent in the last 24 hours, and basic technical logs (like errors). For sign-in protection we keep one-way hashes of IP addresses and emails for up to 24 hours.

• To provide Stram (contract): creating your account, signing you in, showing your profile, running the AI chat, processing Pro purchases, and showing your analytics.
• To keep Stram safe (legitimate interest): blocking bots and password-guessing, enforcing message limits, and fixing errors.
• To meet legal duties (legal obligation): keeping purchase records for tax and accounting.
• With your consent: connecting other apps (like Google Drive or GitHub) and anything else we ask you to agree to. You can withdraw consent at any time.

A public profile, and everything on it, can be seen by anyone with the link, may appear on the Stram homepage, and can be found by search engines like Google. If you make your profile private, only you can see it, and it's hidden from suggestions, the homepage and search engines.

We use a small number of service providers to run Stram. They may only use your data to provide their service to us:

• Supabase: database, file storage, and email-and-password sign-in.
• Vercel: website hosting.
• Cloudflare (Turnstile): the invisible "are you human?" check on sign-in, sign-up and password reset.
• Stripe: payments for Stram Pro.
• AI model providers (such as Groq, NVIDIA and Hugging Face): the text of your chats, and files you ask the AI to read, are sent to them to generate answers.
• Google Fonts: if a profile uses a custom font, visitors' browsers load it from Google.
• Apps you connect (such as Google Drive or GitHub): only when you ask Stram to use them.

Some of these providers are in the United States. Where data leaves the EU, it's protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. We may also share information if the law requires it, or to protect people from harm.

Stram only uses cookies that are needed for the site to work, like keeping you signed in and protecting forms. We don't use advertising or tracking cookies. See the Cookie Policy for the full list.

Connections are encrypted (HTTPS). Sign-in cookies are signed so they can't be faked and can't be read by page scripts. Sign-in requires a 6-digit code from your email, bots are blocked, and repeated wrong attempts are stopped automatically. Each account can only ever see its own data.

• Your account, profile and workspace: while your account exists.
• Sign-in protection records and the AI message counter: 24 hours.
• Purchase records: as long as tax law requires (usually up to 10 years), kept by Stripe.
• When you delete your account, everything else is deleted straight away.

You can, at any time:

• See and download your data: Profile → Account → Privacy → Download my data.
• Correct it: edit your profile and account details in the app.
• Delete it: Profile → Account → Privacy → Delete account. This permanently removes your account and data.
• Object to or restrict how we use it, or withdraw consent you gave.
• Complain to your data protection authority (in Italy, the Garante per la protezione dei dati personali).

You must be at least 14 years old (or older, if your country requires it) to use Stram. We don't knowingly collect data from younger children. If you think a child has made an account, contact us and we'll delete it.

We'll update this page if anything changes, and tell you in the app if the change is important.

Message us on TikTok at @stram.lol. We reply within 30 days, usually much sooner.