Privacy notice

Last updated: October 2, 2026.

Steno is an evidence ledger for human work and agent usage, operated by Jannik Jung. This notice covers the Steno website, application, and connected plugins, including the ChatGPT and Codex integration. Jannik Jung is the data controller; contact details are in our imprint and below.

What we store

Account information includes your name, email address, avatar, sign-in provider identifiers, sessions, organization memberships, roles, invitations, and connected-agent authorizations. Sign-in normally uses GitHub or Google. Pre-provisioned reviewer accounts can use a password; Steno stores its hash, not the plain-text password. Authentication uses session cookies; your chosen theme may be stored on your device.

Work records include time entries, descriptions, evidence links and excerpts, routing hints, spaces, projects, assignments, work items, outcomes, rates, budgets, statements, and audit history. Agent-usage records can include the provider and model, session and event identifiers, session titles, host labels, timestamps, time zones, duration, token counts, source references, coverage notes, pricing, cost estimates, and links between sessions and work items. These records may identify you or other people mentioned in the information you submit.

Steno receives the information you or your connected agent explicitly send. Steno does not itself read your repositories, Slack, calendar, or full ChatGPT/Codex conversation history. Do not include passwords, API keys, payment-card details, government identifiers, or sensitive health information in work records or plugin requests. Sign-in credentials belong only in the sign-in flow.

For website subscriptions, Steno stores billing references, plan, seat count, status, and billing-period information. Stripe handles checkout and payment details; Steno does not store full payment-card numbers or security codes. If you contact support, we receive your email address and the information you send.

How we use it

We use account information to sign you in and enforce permissions; work and usage records to provide tracking, review, cost estimates, reports, and statements; and connection information to carry out the actions you authorize. Invitations and support details let us communicate with you. Billing information maintains subscription access. Technical logs and analytics help us diagnose errors, protect the service, and understand which features are used. We do not sell your personal data or run third-party advertising.

Who receives data

Cloudflare provides hosting and database storage on its global network, request security, operational logs, website performance measurement, and invitation-email delivery. PostHog processes product analytics in its EU-hosted service. GitHub or Google handles the sign-in you choose. Stripe processes website subscriptions and payments under its privacy policy. Data sent over the network is encrypted in transit using HTTPS; this does not mean records are encrypted against access by Steno or its service providers.

Within an organization, access follows roles and project assignments. Members can see the client/project directory and their own work; managers, admins, and owners can review the organization record and billing details. Connected hosts such as ChatGPT, Codex, or Claude receive tool results within the permissions you grant. Their handling of those results is governed by their own privacy policies. Revoking a connection does not erase copies a host has already received.

Exporting, printing, or sharing a statement sends its contents outside Steno. Anyone holding a share link can read the selected statement and its issuer/recipient details without signing in until you revoke the link. These details can include business and contact names, an email address, and an address line. Redactions apply to the shared view. The page asks search engines not to index it, but treat its link as a secret. Revocation cannot remove previously downloaded copies.

Analytics and technical information

PostHog collects page views, clicks, feature-use events, and browser errors. Automatic events can include page URLs, referrers, browser/device information, timestamps, and text or attributes of clicked interface elements. Signed-in activity is associated with an account identifier; server events may also include organization or record identifiers and action metadata. These identifiers are pseudonymous, not a promise of anonymity. We do not enable session recordings. PostHog's browser SDK uses memory-only storage and honors Do Not Track; that setting does not stop server-side operational or product events.

Cloudflare processes request information such as IP addresses, URLs, browser information, timing, and errors to deliver and secure the site. Its website analytics also measures page performance. If you have questions about analytics or want data associated with your account removed, contact us below.

Plugin event subscriptions

When event delivery is enabled and you request a watch through a connected host, Steno stores the subscription's filters, callback address, signing secret, expiration and queued delivery metadata. Notifications contain record identifiers and change status, not entry descriptions or evidence. The host can retrieve further details using your authorized connection. Delivery may pass through Steno's private callback transport. Unsubscribing or revoking the connection stops delivery and removes its subscription and queued notifications; expired subscriptions are cleaned up by the delivery service.

How long we keep it

• Account and personal work records have no automatic age-based expiry. We keep them while the account exists, unless removed through an available deletion action. Successful account deletion removes the personal ledger, usage records, sessions, and credentials from the live application database.
• Shared organization records and their audit history remain for the life of the organization unless deleted through its available controls. They have no fixed automatic expiry. Leaving or deleting your account does not delete that shared history. On account deletion, a retained identity is replaced with “Former member.” Descriptions or evidence submitted to a shared ledger may still identify contributors.
• Event subscriptions expire within 24 hours unless renewed. The delivery service removes expired subscriptions and queued notifications on its next cleanup run. Revocation or unsubscribe also removes them. Duplicate-request records used for safe retries become eligible for cleanup after 24 hours and are removed when subsequent qualifying reports run; this is not a guaranteed 24-hour deletion deadline.
• Cloudflare D1 recovery history can retain deleted database data for up to 30 days. Cloudflare Workers logs are retained for up to 7 days. These provider-managed windows are separate from live-account deletion; see Cloudflare's database recovery and log retention documentation.
• Account deletion does not automatically delete PostHog events. Steno has no separate automatic purge for those events; removal requires a separate deletion in PostHog. PostHog's documented query window is one year on Free and seven years on paid plans, but that window is not a deletion guarantee. You can request deletion of analytics associated with your account by contacting us. See PostHog's retention explanation.
• Stripe may retain payment records after a Steno account is closed for its legal, accounting, and fraud-prevention obligations, under its own retention policy. Copies held by connected hosts, statement recipients, or your organization follow their policies. Support correspondence is handled separately from account deletion. Contact us to request its deletion; we may need to retain information while an associated request, dispute, or legal retention obligation remains unresolved.

Your controls

Export the data available to your role as JSON from the account menu at any time. Organization managers can also produce client-safe CSV and shared statements. Account deletion is available from a standalone personal organization after shared memberships are left or transferred; it removes that personal record and account from the live database when deletion succeeds, subject to the retention details above. If you previously contributed to a shared ledger, Steno removes your credentials and profile details but retains a “Former member” attribution where needed to preserve that organization's billing history. Revoke your own connected agents on the “Agents” page; owners and admins can also revoke grants bound to their organization.

Contact

For access, correction, export, deletion, or an objection to processing, contact Jannik Jung at support@steno.ink. We may need to verify your identity before acting on a request. Rights and exceptions depend on applicable law; you may also contact your data-protection authority. Please do not send passwords, access tokens, or sensitive work evidence by email.