Privacy Policy

Effective October 20, 2026

In short: the app works without an account and sends neither your presentations nor usage data to us. Downloading the app from this website requires a stemlet.app account: we receive the email and name your sign-in service provides, plus the country, institution, and role you enter, and use them to manage accounts and to count users. Deleting your account erases them at once.

This policy covers the stemlet presentation editor (the macOS and Windows apps, the MCP server and command-line tools they provide, and the AI plugins that connect them), the website stemlet.app, and stemlet.app accounts. The controller is Dongkyu Kim, the individual developer of stemlet ("we").

1. What we collect (stemlet.app accounts)

• From your sign-in service (Google, Microsoft, GitHub, or ORCID; required): the service's user ID for you, your email (ORCID provides none), and your name.
• You enter: country, institution, and role (required); field and a description of an "other" role (optional).
• Generated as you use it: sign-up, last sign-in, and download times; the platform and version downloaded; the policy version you agreed to and when.
• A cookie that keeps you signed in (see 7).

The app itself has no account and sends no name, email, presentations, usage, or crash data to us; it contains no analytics or advertising trackers.

2. Purposes

Managing accounts (keeping you signed in, answering requests, preventing abuse); providing downloads; and user statistics by country, institution, role, and field, used and published only as aggregate counts that identify no one. Never for advertising or marketing.

3. Retention and deletion

Until you delete your account under My account → "계정 지우기" (delete account), which immediately erases the account, its sign-in links, sessions, and download records; they may remain in the database's point-in-time recovery (Cloudflare D1) for up to 30 days. The sign-in cookie expires after 30 days.

4. Sharing

We do not share or sell personal information, except where the law requires disclosure through due process.

5. Processors and international transfer

The website and the account database run on Cloudflare, Inc. (USA; privacyquestions@cloudflare.com). The database is stored in Cloudflare's Asia-Pacific data centers and requests are handled at the Cloudflare data center nearest you; all items in section 1 are transferred over HTTPS when you sign up, sign in, edit your information, or download, and kept as in section 3. If you object, do not sign up, or delete your account (you then cannot download from this website). You sign in on your chosen service's own pages; we receive only the result, and that service's own policy applies to it. When you search for your institution, our server sends the search words (and the chosen country) to the public ROR (Research Organization Registry) API, without saying who searched.

6. Your rights

You may access, correct, or delete your information or ask us to stop processing it at any time: view and edit it under My account, delete it (withdrawing consent) with "delete account", and send other requests to the contact below.

7. Cookies

One cookie keeps you signed in (30 days, not readable by scripts), and one lasts ten minutes during sign-in. No analytics or advertising cookies. Blocking cookies prevents signing in.

8. Security

All traffic is encrypted (HTTPS), sign-in tokens are stored only as one-way hashes, and only the operator, using two-factor authentication, can access account data.

9. Children

People under 14 may not sign up; such accounts are deleted when we learn of them.

10. What the app stores on your computer

Only on your computer, inaccessible to us: the presentation files (.stlt) you save, wherever you choose; and, in the app's data folder (macOS ~/Library/Application Support/stemlet, Windows %APPDATA%\stemlet), the autosave and copies of it kept aside, recently opened files, app settings (tool dock layout, comment author name, chosen AI model and so on), your templates, data files linked to plots, AI conversation history, and review records for files an AI edited outside the app. It stays until you delete it; deleting the data folder removes all of it (your saved presentation files remain).

11. What the app sends online

Update checks to download.stemlet.app (the server sees your IP address, the app version, and the operating system — no presentation, file, or account information); DOI lookups to doi.org and Crossref (api.crossref.org) when you use that feature; and links you click, which open in your browser. Otherwise the app stays offline, and HTML files it exports open offline.

12. AI features

stemlet does not run AI models itself. Its in-app AI runs the Claude Code (Anthropic) or Codex (OpenAI) program you installed and signed in to, on your computer; that program sends your request and the presentation content it needs (slide text and objects, slide images, files you attach) to that company under its own terms and privacy policy (Anthropic, OpenAI). We do not receive it. AI apps you connect through stemlet's MCP server or plugin talk directly with stemlet on your computer, under their own policies, not through us.

13. Contact

Privacy officer: Dongkyu Kim (individual developer), support@stemlet.app.

14. Changes

Changes are announced on this page 7 days before they take effect (30 days for changes to your disadvantage); if a change needs your consent, you are asked at your next sign-in.