Privacy Policy

1. Who we are

Stumen is operated by Sparkbay LLC, a Georgia limited liability company, doing business as Stumen. We are based in the United States. If you have a question about anything on this page, email kazi@stumen.com.

2. What we collect

About you and your organisation:

• your name
• your email address
• your organisation's name
• whether you signed up as an Owner or a Receiver

What happens on the platform. Stumen exists to keep this record, so an Owner can show who had access to a document and who opened it:

• who shared a document, who requested access, who approved or declined it, and who opened it — each with a timestamp
• sign-in events
• a hashed IP address on activity entries. We store the hash, not the address. Hashing an IP address is not the same as anonymising it, so we are not going to claim that it is
• the IP address you accept these terms from, stored as it is, so there is a record of the acceptance itself

Your IP address is also sent to Cloudflare when you use the signup or sign-in form, for the bot check. We do not keep it for that.

3. Google Drive

If you connect Google Drive, Stumen asks for read-only access. We store two things about each file you choose to share:

• its Google Drive file ID
• its filename

We do not copy, download, or store the contents of your files. They stay in your Google Drive. When a Receiver you have approved opens a document, it is passed through a viewer that checks their session first — the file's own Drive URL never appears in the page — and the page is watermarked with their email address and the time they opened it.

In plain terms:

• Drive data is used only to show the files you choose to the Receivers you approve
• never for advertising
• never sold
• never used to train AI models
• not read by a human, except where we have to for a security investigation, or where you have asked us to

4. Why we collect it

• to run the service
• to keep the activity record Owners rely on
• to review new signups and approve or decline them
• to send account emails — approval, rejection, and password resets

That is the whole list. We do not build a profile of you.

5. Who else handles it

• Supabase — database and sign-in
• Vercel — hosting
• Resend — account emails
• Google — Drive access, if you connect it
• Cloudflare — the bot check on the signup and sign-in forms

Each one gets only what it needs to do its job.

6. What we don't do

• We do not sell your personal information.
• We do not share it for advertising.
• We use no tracking or advertising cookies. The only cookies Stumen sets are the ones that keep you signed in.

7. How long we keep it

We keep your details while your account is active.

When you delete your account, or ask us to, we remove your name, your email address, and the rest of your personal details.

Activity records stay. They are the point of the service — an Owner needs to be able to show who opened what, and that record would be worth nothing if the people in it could erase themselves. Your entries remain, with you marked as a deleted user instead of named. Those entries cannot be edited or deleted through Stumen; the database refuses it. The one exception is a beta reset, below.

8. Deleting your account

Go to Settings and choose Delete my account. Or email kazi@stumen.com and we will do it for you.

9. Beta

This is a free public beta. We may reset the database, which would delete documents, accounts, and activity records. Keep your own copy of anything you would miss.

10. Age

Stumen is for people aged 18 and over. If you are under 18, please do not use it. We do not knowingly collect information from children.

11. Changes

If we change this policy, we will update the date and version at the top of this page. If the change is a significant one, we will email account holders.

12. Contact