Privacy Policy

Who we are

Cekura, Inc. operates Stewdio. This policy covers our website, applications, and Stewdio plugin. For privacy questions or requests, contact founders@stewdio.ai.

Information we collect

• Account information: your name, email address, profile image, sign-in information, and organization memberships and roles.
• Your work: the Files, compositions, Canvas scripts, and assets you create, import, or edit, together with information needed to save and synchronize them.
• Billing information: subscription status, billing contacts, invoices, and payment references. Stripe processes payment details when you use checkout or the billing portal.
• Website demos: prompts, generated animations, your chosen display name, and an email address if you choose to provide one for product updates.
• Usage and technical information: browser and device information, page visits, download clicks, request logs, and network information used to operate and protect the service.
• Communications: information you send us when asking for support or contacting the team.

How we use information

We use information to provide Stewdio, sign you in, save and synchronize your work, manage organizations and subscriptions, respond to requests, understand website use, and investigate errors or abuse. We also use it to meet legal obligations and send service communications or product updates you request.

Where a legal basis is required, we rely on performing our agreement with you, legitimate interests in operating and protecting the service, legal obligations, or your consent, as appropriate to the activity. You can ask us about the basis for a particular use or withdraw consent by contacting us.

Connected AI clients and public demos

When you connect Stewdio to an AI client, the client can request your File content and receive tool results, and can make changes within the access you authorize. Information sent to that client is also subject to its provider’s privacy policy and your settings with that provider. Disconnect the integration through the client when you no longer want to use it.

The website’s animation demo sends prompts and related generation or repair information to Anthropic. If you publish an animation to the website’s shared board, the animation, its displayed prompt, and your display name are public. The optional email collected with your display name is not included in public board results. Avoid including confidential information in anything you publish.

Service providers and other disclosures

We use providers including Cloudflare for hosting and storage, WorkOS for identity and organization management, Stripe for billing, Anthropic for the website’s AI demo, and Google for website analytics and fonts. They receive information needed for the services they provide. Your organization’s administrators may also receive membership and billing information needed to manage that organization.

Canvas scripts run in an isolated frame on stewdiousercontent.com, a domain we operate separately from stewdio.ai. The frame receives only the script and File content needed to draw it and can’t access your account or sign-in. Depending on a File’s content, it can load public code libraries from esm.sh, jsDelivr, unpkg, and threejs.org, and fonts from Google Fonts. These requests omit credentials but send connection information to those services.

We may disclose information when required by law, to protect people or the service, or in connection with a merger, acquisition, or transfer of business assets, subject to applicable legal protections.

Cookies and browser storage

Stewdio uses cookies and browser storage for sign-in, preferences, local File data, and the website demo’s visitor session. The production website also loads Google Analytics to measure visits and download clicks; it can use cookies and similar identifiers. Google Fonts requests send connection information to Google.

You can manage cookies and site storage in your browser and use Google’s Analytics opt-out browser add-on. Blocking or clearing storage can affect sign-in, local preferences, and unsynced work. The opt-out add-on applies to Google Analytics, not essential service storage.

How long we keep information

• Accounts and Files: we keep account information and saved Files while you use the service. Deleting a File removes it from normal access immediately; we erase its stored content, assets, thumbnails, and application recovery copies within 30 days. For account deletion, contact us; we aim to complete verified requests within 30 days and will explain any information we need to retain.
• Published demos and product emails: published animations, prompts, and display names remain on the website until removed. We keep optional product-update email addresses until you unsubscribe. Contact us to request removal; we aim to complete verified requests within 30 days.
• Temporary uploads: unfinished upload objects are set to expire one day after upload. Storage-provider cleanup can take additional time. Assets saved in a File follow the File retention period above.
• Routine hosting logs: logs stored in Cloudflare Workers Logs expire within seven days. Records needed to investigate a specific security incident may be kept until that investigation and any related dispute are resolved.
• Other records: support correspondence is kept as needed to handle your request; analytics follows the provider’s configured retention cycle. Necessary billing and accounting records are kept for the applicable recordkeeping period. Contact us for the retention details of a particular record.

Provider-managed recovery history can remain after live data is erased and expires under the provider’s recovery cycle. We reapply deletions if we restore data. We retain minimal identifiers and deletion records to prevent deleted information from returning and to preserve necessary billing references; these records do not contain your File content. Account deletion does not automatically delete another person’s work or an organization’s records. We will work with you to resolve shared content and administration responsibilities.

Server deletion does not erase copies you saved or exported to your devices, or copies held by independent recipients. Connected AI clients apply their own retention policies to information they receive.

Security and international processing

We use access controls and other safeguards to protect information, but no storage or transmission system is completely secure. Our providers may process information in countries other than your own. Contact us for information about processing locations and the safeguards that apply to your information.

Your choices and rights

You can update profile information in Stewdio and choose which AI clients you connect. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information, object to or restrict its use, withdraw consent, or complain to a data protection authority.

Send requests to founders@stewdio.ai using the email associated with your account. We may need to verify your identity before handling a request. To stop optional product emails, contact us at the same address. If you believe a child has provided personal information to us, please contact us so we can investigate.

Changes and contact

We may update this policy as the service changes. We will post the revised policy here with an updated date and provide additional notice when required. Visit Support or email founders@stewdio.ai with questions.