# Privacy and security

Stuff keeps files available to the people and assistants you authorize. Start with a private space and give each assistant only the access its task needs.

This is a practical explanation of current product behavior, checked **October 1, 2026**. The [Privacy policy](https://stuff.ac/privacy), [Terms](https://stuff.ac/terms), and [account-deletion instructions](https://stuff.ac/delete-account) contain the service's formal policies.

## Understand your controls

- [Assistant data and access](https://stuff.ac/file/182ad79e-64a6-4979-912a-542456e2b58b): permissions, what an assistant receives, and revocation.
- [Sharing and discovery](https://stuff.ac/file/4b8c3c90-869a-4c47-996a-dddeb677fe75): private access, public links, and Explore.
- [Storage, retention, and deletion](https://stuff.ac/file/cac5e6e6-b96a-4aaa-9943-bbde2350d1a3): providers, version history, deletion, and reporting a problem.
- [Illustrated connection guides](https://stuff.ac/file/552c90a8-384e-4263-b71d-84c30beb2df1): connect and test with harmless example files.

## A sensible starting setup

1. Put a small set of working files in one private space.
2. Connect each assistant separately, scoped to that space. Start read-only; enable edits for tasks that need them.
3. Keep organization and sharing disabled until needed. These permissions include actions with wider consequences, such as changing access and deleting files.
4. Review changes in file history and keep your own copy of irreplaceable material.
5. Revoke connections you no longer use. [See the demonstrated revocation test](https://stuff.ac/file/e7263199-8d02-4e17-848b-866b6d44b827).

## Be clear about the limits

Stuff uses HTTPS and its providers' storage protections. It is **not an end-to-end encrypted or zero-knowledge vault**: the service must process content to preview it, scan supported uploads, and respond to authorized requests. These docs make no SOC 2 or other certification claim.

Stuff's privacy policy says it does not sell personal information or use files to train its own AI models. That statement does not determine how a connected AI provider handles retrieved content. Check that provider's plan, privacy settings, and policies before connecting sensitive material.

Public links can be copied and read by automated tools. Removing access cannot erase copies already made elsewhere.

For support or a suspected security problem, contact [ash@elegancelabs.com](mailto:ash@elegancelabs.com). Send a short description and relevant item links; never send passwords, sign-in codes, or API keys.

[Back to Stuff Docs](https://stuff.ac/file/796c5b58-3744-4dd1-b625-3065b6a12b06)