Privacy Policy

Connection details (hosts, ports, usernames, passwords, file paths, and tokens), saved queries, dashboards, AI provider keys you add, and your preferences are stored locally on your device. Stroke connects to your databases directly from your machine. Nothing is proxied through our servers, and we never receive your credentials, schemas, queries, or query results.

If you connect the built-in AI chat to your own AI provider, or connect an MCP client such as Claude or Cursor to Stroke, data flows directly between your machine and that provider, under its terms, not ours.

• License activation and checks. Your license key, a device identifier, and the device's hostname, used to enforce the 2-device limit and to free a slot when you deactivate a device.
• Your free trial. The device identifier and the date the 17-day trial started, so the trial runs once per device.
• Anonymous usage analytics. A random device identifier, the operating system, the app version, how many times the app launched each day, and how often features were used, counted from a fixed list of feature names. These counts never include database names, schemas, queries, or results.
• The free AI tier, if you use it. Your messages are sent through our servers to the AI model that answers them (see section 07). We don't store your messages or the replies. We count requests per device and per IP address each day to keep the free tier fair. Operational logs can briefly hold a short fragment of a reply while we diagnose a failure. Anything you put in a message, including schema or data you choose to share, goes to the model to get an answer.

When you sign in with GitHub or Google, we receive and store:

• Your name, email address, and avatar from the provider you chose. We never see your password.
• If you later sign in with the other provider using the same verified email, both sign-ins are linked to one account.
• Session data: a cookie that keeps you signed in, plus your IP address and browser user agent, kept for session security.
• License records: your license key, plan, and the devices it's active on.
• Payment records: the status and amount of payments, kept for accounting. Checkout happens on Dodo Payments; card details never reach our servers.
• Team licenses: the email domain a Team purchase covers. When you sign in, we check your email's domain to see whether a Team license covers you.

Two optional features add a little more, only if you use them:

• The weekly giveaway records your entry for that week. If you win, we email you, and your first name and last initial may be shown on the site as last week's winner. See the giveaway rules.
• Reviews you submit are published on the site with the name and title you give, once approved.

When you create an account, your name and email are added to Plunk, the service we use to send email. We use it for messages about your purchases (a confirmation, or a notice if a payment fails), for giveaway results, and for occasional product updates. You can stop product updates at any time by unsubscribing from one, or by emailing support@stroke.click.

• Collect your database credentials, schemas, queries, or query results.
• Sell personal data, or share it with anyone for advertising.
• Run ads, or load advertising trackers on the site or in the app.

A session cookie keeps you signed in. It's essential to the site and doesn't need consent. Your theme choice in the dashboard and your cookie choice are remembered in your browser's local storage, not in cookies.

We use privacy-friendly product analytics (PostHog) on the website to learn which pages are useful, only after you accept through the cookie banner. If you decline, no analytics cookies are set and nothing is tracked, and the site works the same either way. You can change your choice by clearing this site's storage. We never use advertising cookies.

A small number of providers process data on our behalf, each for one job:

• Cloudflare hosts the website, the database, and the licensing API, and runs the free AI tier's models (Workers AI). Requests to stroke.click pass through Cloudflare's network.
• Groq, Cerebras, and OpenRouter answer free AI tier requests when Cloudflare's daily allocation runs out.
• Dodo Payments processes checkout as merchant of record and handles billing details under its own privacy policy.
• GitHub and Google provide sign-in. Installers are served from GitHub Releases, so downloading Stroke is a request to GitHub.
• Plunk sends our email.
• PostHog provides website analytics, loaded through a same-origin proxy and only after you opt in.

Account and license records are kept while your account exists, and payment records as long as accounting rules require. Device activations are removed when you deactivate a device. Usage counts and free AI request counts are kept as daily totals. If you delete your account, we delete your personal data, keeping only what payment regulations oblige us to retain.

Your database credentials never reach us, so they can't leak from us. Everything between the app, the website, and our servers travels over HTTPS, payments are handled entirely by Dodo Payments, and access to our systems is limited to the people who run Stroke. The app's source is public, so anyone can check what it sends.

You can view and update your account details from your dashboard, and ask for a copy of your data, a correction, or deletion at any time by emailing support@stroke.click. Laws like the GDPR and the CCPA give some people these rights formally; we honor them for everyone.

Stroke is a tool for professionals and isn't directed at children under 16. We don't knowingly collect data from them; if you believe a child has created an account, email us and we'll delete it.

If what we collect changes, we'll update this page and the date at the top, and call out the change in the release notes before it ships. The terms that govern the service are in the Terms of Service.