Privacy Policy

This policy applies to personal information we handle as a controller — that is, information we decide the purpose and means of processing for. It covers our website, our checkout and order process, our support channels, and the account and licensing system behind the desktop application.

It also covers the AI service that powers the application, because that service now runs on our servers as part of your plan. Section 6 explains exactly what passes through them, what we keep, and what stays on your computer.

Stonic AI is a sole proprietorship operated by Usman Ahmad (“Inventor Usman”) from Punjab, Multan Road, Vehari, Pakistan. For the purposes of the EU and UK General Data Protection Regulation, Usman Ahmad is the data controller for the information described in this policy. You can reach us at any time at [email protected] or through our official WhatsApp channel.

3.1 Information you give us

When you buy a licence or contact us, we collect the details needed to complete and support that purchase: your name, email address, WhatsApp or phone number, the plan purchased, the payment method you used, and the payment confirmation or screenshot you send us. Where a payment is confirmed by hand, that confirmation may include a transaction reference, the paying account name and the amount and date of the transfer.

If you pay by card, your card details go to Polar and never to us. What comes back to us is the order record — your email address, the amount, the currency and Polar’s order and customer references — which we use to activate your access and to keep the sale in our accounts. See section 9 for what Polar does with your data.

When you first set up the desktop application, it sends us the name, age and WhatsApp number you enter, the character you pick, and your answers to the short setup questions. We use them to support you, to understand who Stonic is for, and to improve the setup.

If you write to us for support, sign up for updates, submit feedback about the app, or request an invoice, we also collect the content of those messages and anything you choose to include in them.

3.2 Information we collect automatically

When you browse the website we collect standard technical and usage information: your IP address and the approximate city or country derived from it, browser and device type, operating system, referring page, the pages you view, and how long you spend on them. We also detect your country in order to display prices in the appropriate currency. When you use the desktop application, we process the licence and activation data needed to verify your entitlement: your account identifier, an identifier for each computer you sign in on, the application version and operating system, and the number of devices activated. The application also tells us which character you are currently using and whether you chose it yourself — only the type of character, never a name you gave it or instructions you wrote for it.

3.3 Information from other sources

We may receive limited information from the advertising and analytics platforms described in section 7 — for example, that a visit originated from a particular advertisement — and from payment or messaging platforms when you contact or pay us through them. If you sign in with Google, Google shares your name, email address and profile picture with us.

3.4 Application usage measurement

Each time the desktop application starts, it records that it was opened. That record contains your account email address, an anonymous identifier for the installation, the version of the application, your operating system, the time it opened, and how long the session lasted. It contains nothing else. We use it only to understand how many people use Stonic AI and whether customers keep using it after purchase.

This measurement does not record what you do inside the application. No prompt or command text, no voice or audio, no screen content, no file or folder names, and no conversation history is ever included in it. The record is stored on our own infrastructure and is not shared with any advertising or analytics company. There is currently no separate switch for it inside the application; if you object to it, write to us and we will delete the records linked to your account. The separate, brief usage summaries we keep on a Stonic plan are described in section 6.2.

3.5 The support assistant on this website

The website offers an AI support assistant that answers questions about the product from our published pages. When you send it a message, that message and the assistant’s reply are sent to Anthropic, the provider of the underlying AI model, so that a reply can be generated. We also keep a copy of the conversation, together with the page you started it on, the approximate country the request came from, your browser’s user-agent string, and a one-way cryptographic hash of your IP address. We store the hash rather than the address itself so that we can prevent abuse of the service without holding a record of where you connected from.

We use these conversations for one purpose: to understand what visitors ask and to improve the answers the assistant gives. They are not used for advertising and are not sold or shared with anyone beyond the providers listed in section 9. Anthropic processes the message in order to return a reply and does not use it to train its models.

The assistant is not a place for personal or sensitive information. It is instructed never to ask for payment details, passwords, identity documents or one-time codes, and you should not enter them. If a question concerns your own order or account, the assistant will direct you to a member of our team, who can verify your identity properly. Using the assistant is entirely optional — every page also offers email and WhatsApp.

We use personal information to operate our business and to deliver what you have asked for. Specifically, we use it to process your order, verify your payment and prevent fraud; to issue, activate and manage your licence and enforce its device limit; to provide support and to keep continuity in a conversation across sessions; to send transactional messages such as order confirmations, invoices, download links and update notices; to keep proper business, accounting and tax records; to understand how the website and application are used so that we can improve them; to measure the effectiveness of our advertising; and to protect the security and integrity of our systems and to comply with legal obligations.

We do not use your personal information to train artificial-intelligence models, and we do not sell it or rent it to anyone.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases. We process order, licensing and support data because it is necessary to perform our contract with you. We process security, fraud-prevention, analytics and product-improvement data on the basis of our legitimate interests in running and protecting a viable business, balanced against your rights. We use website analytics and advertising measurement (section 7) on the same basis, and you can object to them at any time with the opt-out controls described there. We rely on your consent for marketing email, which you may withdraw at any time. And we process certain records because we are legally obliged to, for example for accounting and tax purposes.

This section changed when the AI service moved onto our own servers. It is written to be exact, because a privacy policy that flatters the product is worse than no policy at all.

6.1 What stays on your computer

Your files, folders and applications stay on your machine. When Stonic opens a document, finds a file or creates a folder for you, it does so on your computer, and we do not upload, copy or index your files. Your local chat history, settings and Stonic’s memory (section 6.6) also stay on your computer.

Two things do leave it, because the AI cannot answer without them. When you ask Stonic to read a file, or attach one, the part it needs is sent to the AI model with your request. And when Stonic looks at your screen — to answer a question about what is in front of you, to carry out something you asked, or through Awareness (section 6.5) — it takes a screenshot and sends it to the AI model in the same way. As with the rest of your content (section 6.2), we do not keep these files or screenshots.

6.2 What passes through our servers

Your prompts, commands and voice input travel from your computer to our gateway, and from there to the AI model that answers them. This is what your plan pays for, and it is the only way the service can work without you holding an account with an AI provider yourself.

We do not keep recordings of that content. Voice audio is never stored, and our logs record identifiers, counts and errors only. What we do keep is the measurement: how much you used, when, and against which plan, because that is what your allowance is counted from.

We also keep a brief note of what Stonic was asked to do, so that we can see what people actually use it for and where it lets them down. As a request passes through, the gateway sets aside a shortened copy of what you asked — typed, or spoken and turned into text — together with the tools Stonic used and the first part of its answer. Email addresses, phone numbers, card and bank account numbers and API keys are removed first, folder paths are cut down to the file name, and web links to the name of the site. These notes are deleted automatically, normally within 48 hours and never later than seven days.

Before they are deleted, an AI model turns each session into a short summary: what the task was, whether it worked, and where Stonic struggled. We keep that summary against your account. Only the business owner and authorised staff can read these summaries. They are not used for advertising, not shared with anyone except the AI model provider that writes them, and not used to train models, and you can ask us to delete yours at any time (section 13). The app’s own background requests — Awareness deciding whether to speak (section 6.5), and Memory learning and recalling (section 6.6) — are left out of these notes. If Stonic speaks and you answer, that conversation is treated like any other.

The models that generate the answers are operated by third parties on our account, not yours. They process what we send in order to produce a response. We do not permit that content to be used to train their models.

6.3 What we store because you asked us to

Some things are saved on purpose, because they would be useless otherwise. When you create a task that runs on a schedule, or set one up from your phone, it is stored on your account so that it can run when you are away from your computer and so that you can see it on your phone. You can view and delete these at any time, and deleting your account removes them. Stonic’s memory of your conversations is different: it is kept on your computer, as section 6.6 explains.

6.4 The record that the app was opened

The application also sends the record described in section 3.4 — that it was opened, by which account, on what version, and for how long. That record carries no part of your working content.

6.5 Awareness

From version 3.1.10, the desktop application includes Awareness: Stonic keeps a sense of what you are doing on your computer and may speak first, as the character you chose, instead of waiting to be asked. Awareness is switched on by default. You can turn it off, and back on, at any time with the Awareness switch in the application’s title bar or in Settings. While it is off, nothing described in this section happens.

While it is on, the application notices which app and window are in front, how long you have been working, whether you have stepped away, and whether a calling or meeting app is using your microphone. From time to time it also looks at your screen by taking a screenshot. From version 3.1.11 it may also look at you through your webcam; that has its own switch and is described in section 6.7.

To decide whether there is anything worth saying, a short description of that context — and, occasionally, the screenshot and the webcam photos — is sent to the AI model: through our gateway if you are on a Stonic plan, where it uses a small part of your plan’s allowance, or directly to OpenRouter with your own key if you run Stonic on your own API keys. When Stonic does speak, it listens for your reply for a short time, exactly as if you had started the conversation yourself.

Awareness stays quiet while you are on a call. It does not pass on the title of, or take a screenshot of, a window it recognises as private browsing or a password manager. It keeps a short record of your day and its own notes on your computer so that it has some continuity; that record is trimmed automatically, and parts of it are included in the description sent to the model.

6.6 Stonic Memory on your computer

From version 3.1.10, the desktop application also keeps its own memory. Your conversations with Stonic, and the facts it learns from them, are saved in a database file on your computer, with backup copies kept on the same computer. To turn a conversation into memories, and to answer when you ask what it remembers, the relevant text is sent to the AI model in the same way as any other request you make.

You stay in control of it. The Memory page in the application shows what Stonic remembers and lets you edit an item or tell Stonic to forget it, pause memory altogether, stop Stonic learning from conversations on its own, and export what it holds.

6.7 Your camera

From version 3.1.11, Stonic can look through your computer’s webcam. It does so in two situations. When you ask it to during a voice conversation — for example by saying “look at me” — it takes one photo. And while Awareness is on (section 6.5), it takes up to three photos, about a second apart, when it is deciding whether to speak. These are still photos: Stonic does not record or stream video, and the camera is switched off again as soon as the photos are taken.

This is controlled by the Camera switch in Settings, which is switched on by default. Turn it off and Stonic does not open your camera for either purpose. Settings also lets you choose which camera is used, and take a test photo to see exactly what Stonic sees.

The photos are sent to the AI model together with the request they belong to, so that it can answer you or decide what to say: through our gateway if you are on a Stonic plan, or directly to the AI provider with your own key if you run Stonic on your own API keys. They are not saved on your computer, and, as with the rest of your content (section 6.2), we do not store them.

6.8 Face Lock

From version 3.1.11, the desktop application for Windows includes Face Lock, an optional lock that is off by default. If you turn it on, the application uses your webcam to recognise your face before it opens. Setting it up turns what the camera sees into a face print — a set of numbers that describes your face, not a picture — and keeps it in an encrypted file on your computer, together with your passcode in a form that cannot be read back. Each time you unlock, what the camera sees is compared with that face print on your computer.

No image of your face is saved, and neither the images nor the face print are sent to us or to anyone else; Face Lock works entirely on your computer. Turning Face Lock off deletes the face print and the passcode from it.

6.9 Calling your computer from your phone

With Stonic Remote you can call the character on your computer from your phone. The call audio travels between your phone and your computer — directly where possible, or otherwise through an encrypted relay operated by Cloudflare. We do not record calls. On your computer, what you say on the call is handled like any other voice conversation (section 6.2).

We use a small number of cookies and similar technologies. Essential cookies and local storage keep your session and checkout working and remember your detected country so prices display correctly; the site cannot function properly without them. Analytics cookies, set by Google Analytics 4, tell us in aggregate which pages are visited and how the site performs. Advertising cookies, set by the Meta Pixel and the TikTok Pixel, let us measure whether our advertising is working and reach people with relevant campaigns.

We also count visits ourselves. The website keeps a random visitor ID in your browser’s local storage and, once per visit, sends us the page you arrived on, the website or campaign link that referred you, and whether you are on a phone, tablet or computer. Our hosting provider adds your country, worked out from your connection. We do not record your IP address, name or email with it, and we use it only in aggregate — for example, how many people visited from search on a given day. Clearing your browser’s site data removes the ID.

Our Meta and TikTok integrations also send the same measurement events from our server — through Meta’s Conversions API and TikTok’s Events API — as well as from your browser, so that a single action, such as a purchase, is not counted twice. Those events can include your IP address, browser details, your country, the click and browser identifiers these platforms set when you arrive from one of their ads, and, if you are signed in, a hashed version of your Stonic account ID. Where they include contact or billing details, such as your email address or the name, city and postal code you enter for a card payment, those are hashed before transmission. We do not send Meta or TikTok your raw email address, name or phone number. When you upload a payment receipt, we keep that moment’s connection details (IP address, browser details and those identifiers) for up to eight days, so the purchase can be reported once our team confirms it.

You can block or delete cookies through your browser settings, and you can use the advertising and analytics opt-out tools those platforms provide. Blocking essential cookies may prevent parts of the site from working.

We share personal information only in the limited circumstances set out here. We share it with the service providers listed in section 9, who process it on our behalf and under our instructions. We share it where we are legally required to — in response to a valid legal request, or to establish, exercise or defend legal claims. We share it where necessary to prevent fraud or to protect the rights, safety or property of Stonic AI, our customers or the public. And if the business is ever sold, merged or reorganised, customer information may transfer as part of that transaction, in which case we will tell you and the acquirer will remain bound by this policy.

We do not sell personal information, we do not share it for cross-context behavioural advertising beyond the measurement described in section 7 — which you can opt out of, as section 14 explains — and we do not give it to third-party marketing firms for their own use.

We keep our vendor list short and use established providers. Each acts as a processor for us and is bound by contractual confidentiality and data-protection obligations.

• Polar Software, Inc. — our authorised reseller and Merchant of Record for card payments. When you pay by card, Polar receives your email address, billing country, IP address and card details in order to take the payment, calculate and remit tax, issue your receipt, and handle billing enquiries and refunds. Because Polar is the seller of record for those transactions it acts as an independent controller of that data under its own privacy terms, not merely as our processor. We never see or store your card number. Payments made directly to us — JazzCash, bank transfer, USDT, Binance Pay, Redot Pay — do not involve Polar.
• Netlify — hosting for the website and the serverless functions that handle orders, licensing and email.
• Supabase — the managed database and authentication system that stores customer, order and licence records.
• Resend — delivery of transactional and onboarding email, such as order confirmations and download links.
• Google Cloud — hosting for the gateway that carries AI requests on a Stonic plan (section 6.2).
• Cloudflare — delivery and protection of the website, hosting of application downloads and updates, and the encrypted relay used for phone calls when a direct connection is not possible (section 6.9).
• Google Analytics 4 — aggregate website analytics. If you sign in with Google, Google also provides that sign-in.
• TikTok — advertising measurement through the TikTok Pixel and Events API (section 7).
• Meta (Facebook and WhatsApp) — advertising measurement through the Meta Pixel and Conversions API, and WhatsApp as our primary sales and support channel. Messages you exchange with us on WhatsApp are also subject to Meta’s own privacy terms.
• AI model providers — the models behind the assistant itself. Your prompts, commands and voice input are sent to them through our gateway so that a response can be generated, on our account rather than yours. They process that content to answer the request and are not permitted to use it to train their models. Which providers we use may change; the protections described in section 6.2 apply in every case.
• Anthropic — the AI models behind two further features. When a payment screenshot is submitted for order verification, an automated vision model reads the amount, method, date and reference from the image so the record can be entered accurately. And when you use the support assistant on this website, your messages are sent to Anthropic so a reply can be generated (see section 3.5). In both cases the content is processed for that purpose only and is not used to train models.
• AnyDesk — used only if you request live remote setup assistance. Sessions start solely with your explicit permission, are attended by you throughout, and are not recorded or continued after the setup is complete.

We operate from Pakistan and our providers operate globally, so your information may be stored or processed in countries other than your own, including the United States and the European Union. Those countries may not provide the same level of data protection as your home country.

Where we transfer information out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards — in practice, the Standard Contractual Clauses or the equivalent UK transfer mechanism offered by our providers, together with the technical and organisational measures described in section 12. You may contact us for more detail about the safeguards applied to a particular transfer.

We keep personal information only for as long as we need it for the purposes described in this policy. We retain order and licence records for as long as your licence or plan remains valid, and afterwards for as long as is necessary to meet accounting, tax and legal-defence obligations. Support conversations are retained while they remain useful for continuity of service. The short task summaries described in section 6.2 are kept while your account exists, unless you ask us to delete them. Conversations with the website’s support assistant are deleted automatically 180 days after they take place. Website analytics and advertising data are retained according to the default retention periods of the platforms concerned. Our own visit records hold no contact details and are kept while they remain useful for understanding our traffic.

When information is no longer needed we delete it or anonymise it so that it can no longer be linked to you.

We use encrypted connections across the site and its interfaces, restrict administrative access to the business owner and a small number of authorised staff, apply row-level access controls in our database, keep payment credentials and API keys in server-side environment variables rather than in the browser, and hash any contact details sent to advertising platforms. Access to customer records is limited to what is needed to fulfil and support orders.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority as required by law.

Depending on where you live, you may have the right to access the personal information we hold about you; to have inaccurate information corrected; to have your information deleted; to restrict or object to certain processing, including processing based on legitimate interests; to receive your information in a portable, machine-readable format; and to withdraw consent at any time without affecting processing already carried out.

To exercise any of these rights, write to [email protected] from the address associated with your purchase, or message us on WhatsApp. We will respond within thirty days, or sooner where the law requires it. We may need to verify your identity before acting, and we will tell you if a request cannot be fully met — for example where we must retain a record to meet a legal obligation. Exercising these rights is free of charge and will never disadvantage you.

Please note that deleting your account information may prevent us from verifying and supporting your licence in future.

If you are a California resident, the California Consumer Privacy Act as amended gives you the right to know what personal information we collect and how we use and disclose it, to request its deletion or correction, to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising those rights.

In the past twelve months we have collected the categories of information described in section 3 — identifiers, commercial information relating to your purchase, internet activity, and approximate location — for the purposes described in section 4, and disclosed them to the service providers listed in section 9. We do not sell personal information for money, and we do not knowingly collect or sell the personal information of anyone under eighteen.

The advertising measurement described in section 7 may, however, amount to “sharing” for cross-context behavioural advertising as the CPRA defines it. You can opt out of it at any time by writing to [email protected] with “Do Not Sell or Share” in the subject line, by blocking advertising cookies in your browser, or through the advertising controls Meta provides in your own account. To make any other request under this section, contact us at the same address.

We may email you about new versions, new generations and upgrade offers relating to the product you bought. Every such message includes an unsubscribe link, and you can also ask us to stop at any time by replying or writing to [email protected]. Opting out of marketing does not stop essential transactional messages such as order confirmations, access and download details, and important service notices, which we need to send in order to fulfil our contract with you.

Stonic AI is intended for adults aged 18 or over (see section 2 of our Terms). The Services are not directed at anyone under 18, and we do not knowingly collect personal information from them. If you believe someone under 18 has provided us with personal information, contact us at [email protected] and we will delete it promptly.

We may update this policy to reflect changes in our practices, our providers or the law. When we do, we will revise the “Effective” date at the top of this page, and where a change materially affects your rights we will take reasonable steps to bring it to your attention through the website or our support channels. Continuing to use the Services after a change takes effect means you accept the updated policy.

If you have a question, a request or a concern about how we handle your information, write to [email protected]. We take privacy complaints seriously and will always try to resolve them with you directly and promptly.

If you are in the European Economic Area or the United Kingdom and you remain unsatisfied, you also have the right to lodge a complaint with your local data-protection supervisory authority. We would appreciate the chance to address your concern first.