Privacy Policy

Stealtify is a client that runs on your device. It is designed to keep your data on your device and under your control.

Last updated:

Applies to the Stealtify Android app (com.stealtify.app).

1. Short version

  • No analytics, no tracking, no ads, no third-party telemetry SDKs.
  • We do not operate the proxy servers you connect to and do not receive your traffic.
  • Everything you configure — proxies, rules, credentials — stays on your device.

2. What stays on your device

  • Proxy server configurations, groups, app and domain rules, and app settings — in a local on-device database.
  • Secrets — passwords, UUIDs, private keys — in the Android Keystore, not in plaintext.
  • Connection logs, if you enable logging — kept in memory only and cleared when the app restarts.
  • Traffic statistics — computed and shown locally; not uploaded anywhere.

3. What leaves your device

  • Your proxied traffic — goes to the proxy servers you configure. Those servers are operated by you or your provider — their handling of your traffic is governed by their privacy policy, not this one.
  • Subscription updates — if you add a subscription URL, the app fetches the server list from that URL. The request may include a device identifier (the X-Hwid header) and a User-Agent; both are configurable and can be anonymised. The subscription server is chosen by you.
  • App update checks — the app periodically contacts update.stealtify.app to check for a newer version. This is a standard HTTPS request: it reveals your IP address and the app's User-Agent to that server, as any web request would. No account or personal data is sent.
  • Configuration transfer to another device — the app can move a whole configuration — proxies, groups and domain rules, including passwords and private keys — from a phone to a TV box over the local network. Phone app rules are not carried over. Separately from that, a single server can be shared: the app shows a QR code and a proxy link, and both carry that server's credentials.

The encryption key travels optically — inside the QR code on the television screen, not over the network; only AES-GCM ciphertext goes over the wire. The server on the box is one-shot: it accepts a single connection and shuts down when you leave the screen, the key is valid for no more than five minutes, and a request without the right key is dropped. The transfer runs outside HTTP and so does not use the certificate pinning in network_security_config. Treat proxy QR codes as secrets: they hold your credentials.

4. What is not collected

  • No names, no email addresses — other than when you email support yourself — no phone numbers, no accounts.
  • No browsing history, no DNS query contents, no traffic payloads.
  • No advertising identifiers, no cross-app tracking.

5. Data you export

The backup feature writes your configuration, including secrets, to an encrypted .stbackup file in a location you choose. Treat that file as sensitive and store it securely — the app never uploads it.

6. Permissions

Each permission — VPN, camera for QR codes, notifications, file access, network state — is used only for the stated feature. The full breakdown is in the user guide shipped with the app.

7. Children

Stealtify is a general networking tool and is not directed at children.

8. Changes

Material changes to data handling are noted in the release notes.

9. Contact

Questions about privacy: support@stealtify.app

This page reproduces the document shipped with the application. In case of any discrepancy, the file included in the distribution prevails.