Security
Security and trust
What Stet does with your data, stated plainly. Facts, not badges.
Where your data lives
Stet runs in three places, and each one keeps your records somewhere different.
The demo
This tab only
Fictional data, held in memory. Reload the page and it starts again.
A device workspace
This browser only
The real app with no account. Your records are kept only in this browser's storage (IndexedDB). Clearing the site data removes them, so export a Stet file to keep a copy.
Use it on this device onlyAn account
Google Cloud Firestore
Records live in Google Cloud Firestore, Europe multi-region (eur3), and only your account can read them. Sign-in is handled by Firebase Authentication.
The facts
What is stored
Your account (email, name, sign-in method), the records you create, a short directory entry about the account, and the support requests you send. Nothing else.
Who can read it
Only your account. Database security rules reject every request that is not yours, and they are tested on every change.
What the operator sees
A short directory entry for each account (a fingerprint and a hint of the email address, sign-in methods, dates, record counts, app version) and the support requests you send. Never what your workspace holds: the security rules refuse the operator's console all of it, and every action it takes on an account is on a record the account can read.
Encrypted in transit and at rest
All traffic uses HTTPS. The providers encrypt stored data by default.
No trackers
No advertising, no analytics cookies, no third-party scripts beyond Google sign-in when you choose it.
Take it with you
Export everything as one file, import it back, or delete your account and data in one flow.
On your device
A copy is kept in your browser, so an open tab keeps working when the network drops. Signing out does not remove it, so on a shared computer use a private window.
Found a problem?
Tell us before anyone else is affected.