Privacy Policy

StealthFleet. Effective date: November 1, 2026. Version 1.0.

1. Who is responsible

The data controller for the servers named in this policy is Stealth LLC (privacy contact: contact@stealth.lc). For the data StealthFleet keeps on your own PC, you are.

2. What stays on your PC

The application keeps all of its working data in one folder on your machine, %LOCALAPPDATA%\StealthFleet. That folder holds:

• your proxy profiles, including proxy usernames and passwords;
• your mailboxes and their passwords, OAuth tokens or IMAP credentials;
• the accounts the software registers, with their passwords, two-factor secrets, backup codes, bank PINs and game session tokens;
• the API keys you enter for third-party services;
• your licence key, this machine's device key and, if enrolled, its StealthPanel credential;
• run logs, action logs and any failure screenshots, which can show the exit IP of your proxy;
• the browser profile folders themselves (cookies, cache, local storage of each identity).

None of this is sent to us. Encryption of the configuration files and the credential vault at rest is available in Settings and is off by default; the recovery key is yours and we never hold it. Export files you create (farm-manager imports, hand-off files) are written to your PC and contain credentials; where they go after that is up to you.

3. What leaves your PC, and to whom

3.1 The licence server. While the software runs it talks to our licence server at broker.stealthfleet.dev: on activation, every few minutes to renew its lease, when a browser session starts or ends, when it draws a batch of attempt credits, and once per launch for the browser engine credential. Each request carries your licence key, a signature from this machine's device key, and a fingerprint of the machine. The fingerprint is a set of salted hashes of hardware identifiers (such as a disk serial or a network adapter address); the identifiers themselves never leave the machine and cannot be recovered from the hashes. The request also lists the opaque ids of the browser sessions you currently hold. Like any server, ours sees the IP address the request comes from and uses it for rate limiting. We keep, per licence: the paired machine fingerprints, lease and session records, attempt-credit grants and refusals, and the server's own logs. These are kept for 7 years (section 8).

3.2 The usage report. Riding the same lease request, the software sends a usage report made of exactly four fields: the app version; per finished run, the counts of attempts, successes and failures by class and the average time per attempt; the engine tier (pro or free); and for a crash, the step name and error class. It is built from an allow-list: nothing else is read, so it cannot contain a credential, a mailbox address, an account name, a proxy, an IP address, a file path, a URL, a screenshot or page content. The report is keyed by your licence id and a short machine id and is deleted on our side after 90 days.

3.3 The update check. About every ten minutes the software fetches a small signed manifest from updates.stealthfleet.dev to learn whether a newer version exists. The request carries no body and no identifier beyond what any HTTP request carries (your IP address and a browser-style user agent). The installer itself is downloaded only when you click Install, and is verified against the signed manifest before it runs.

3.4 The browser engine. The anti-detect browser engine is licensed from a third party. On first launch the software downloads it directly from that vendor, and on each launch the engine validates its credential with the vendor's server. The vendor therefore sees your IP address and the engine credential our licence server issued for that launch, which identifies our account with them, not you. We do not send the vendor your licence key or anything from your data folder.

3.5 StealthPanel, only if you enrol. Nothing connects to StealthPanel (panel.stealth.lc) until you enrol a PC with a one-time code in Settings. Once enrolled, the PC keeps an outbound connection that sends a heartbeat (profile labels, opaque session ids, state words, start times, seat counts) and, if you turn on the remote view, the pages of the local app you open there, with passwords, secrets, proxy credentials and file paths removed before they leave the PC. The routes that reveal a secret are never relayed. If you also turn on "Send accounts through StealthPanel" (off by default) and pin a receiving machine's key, a hand-off you start is encrypted on this PC to that machine's key; the panel relays it and cannot read it, and learns only that a transfer happened, between which machines, and its size and account count. Switching control off in Settings, or leaving the panel, ends all of this; leaving deletes the enrolment credential. StealthPanel's own privacy terms apply to your Discord login there.

3.6 The buyer mailbox portal, only if you deliver a mailbox. When you deliver an account to a buyer through the portal, the software moves that one mailbox's OAuth refresh token to our portal server, sealed with a key held on that server, so the buyer can read the mailbox from a private link while your PC is off. The mailbox password, its recovery address and its IMAP credential stay on your PC. The portal is read-only: it never sends mail. A buyer who opens the link gets one session cookie scoped to that mailbox; the portal loads no third-party assets and sets no tracking. We keep, per delivered mailbox: the sealed token, the hash of the link, when it was opened, and the server's access logs. The portal is hosted in Germany (Hetzner, EU), and these records are kept for 7 years (section 8).

4. Transfers you start yourself

These go to services you chose and configured, not to us. Most of them run through the proxy you assigned, so the service sees the proxy's exit IP, not yours.

• Account registration and login. The browser the software drives sends what any browser sends to the service you are registering on, through your proxy, using the mailbox and identity you assigned.
• Your mailbox providers. To read verification codes the software signs in to each mailbox with the credentials you gave it, over IMAP or the provider's API. If you buy mailboxes through the app, your vendor API token is sent to that vendor, through the proxy you pick.
• Farm-manager exports. An export to a farm manager's API uses your own API key for that service and sends it the accounts you selected. Other exports are files written on your PC.
• The ban check. If you run it, one public high-scores lookup per account, by character name, goes through a proxy you assigned, never directly from your PC. The name is not written to any log.
• Proxy checks. Before a launch the software may make a tiny request through the proxy to a public "what is my IP" service (so the service sees the proxy's exit IP, not yours) to derive the timezone and locale that match it, and a connectivity probe through the proxy. The offline geolocation database it uses for this is downloaded once from a public mirror, directly, and that mirror sees your IP address. Recording of exit IPs in your local records is a separate setting, off by default.

5. Buying a licence

Licences are issued through the product Discord, and payment is arranged there. To issue and support your licence we keep, on the licence record: your Discord user id, tier, browser and daily attempt limits, issue date, expiry, and any staff note. A staff audit log records licence actions (who acted, which Discord user and licence). We store no username, email address or payment details. The licensing bot also sends a licence summary (licence id, Discord id, tier, status, expiry, machines used and allowed) to StealthPanel. Your Discord activity on our servers is governed by Discord's privacy policy.

6. This website

stealthfleet.dev is a static site hosted on Cloudflare Pages. It sets no cookies, runs no analytics (Cloudflare Web Analytics is not used) and loads nothing from third parties; fonts are served from this domain. Cloudflare is the host and processor, and sees the request logs that any web host sees.

7. What we never do

• Read, collect or transmit your proxy credentials, mailbox credentials, account passwords, two-factor secrets, backup codes, bank PINs or session tokens, except in the two transfers you start in sections 3.5 and 3.6, which are encrypted to a key we do not hold (3.5) or sealed on a server we run for you (3.6).
• Collect raw hardware serial numbers or network adapter addresses, screenshots, page content, file paths, or the addresses of the mailboxes and accounts you work with.
• Sell personal data, or use it for advertising.

8. Retention

9. Your rights

You can ask us what we hold about your licence, ask for it to be corrected or deleted, and object to how it is used, by contacting contact@stealth.lc. We will answer within 30 days. Deleting the licence records ends the licence. If you are in the European Economic Area or the United Kingdom, the GDPR gives you these rights by law, and our legal basis for processing is the contract with you (sections 3.1, 3.5, 3.6 and 5) and our legitimate interest in keeping the Service working and secure (3.2, 3.3 and server logs).

10. Children

The Service is not for anyone under 18 and we do not knowingly keep data about them.

11. Changes

We will post any change to this policy here with a new effective date and announce it on the product Discord. A change that widens what leaves your PC will ship in a new version of the software and be named in its release notes.

12. Contact

contact@stealth.lc, or the StealthFleet Discord linked from the home page.