The short version
There is no account, no cloud, and no copy of your data held by this project. Chats, characters, prompts, settings, backups and API keys stay on machines you control.
The software sends the project exactly one thing: a small, allowlisted usage summary, described below, which contains nothing you wrote and nothing that identifies you.
What stays on your machine
Everything SillyTavern holds: chats, characters, personas, prompts, world info, images, extensions and settings.
Everything the manager holds: backup archives, data profiles, the administrator password hash, session tokens, logs, usage metrics, and any Cloudflare refresh token.
The data folder is kept outside the application folder, so replacing the application never touches it. Nothing in it is transmitted to the project.
What is sent to the project
Once per installation: a random installation identifier, generated on your machine and connected to nothing else.
With each batch: the platform (Windows, Linux, macOS, Termux, Docker or unknown) and the application version.
For each model request SillyTavern makes: the timestamp, provider name, completion API format, model name, endpoint hostname, whether streaming was used, the maximum token setting, input, output and total token counts, cache read and write tokens, reasoning tokens, the HTTP status, and the duration in milliseconds.
That is the complete list. The allowlist is in the source code, under packages/instrumentation and packages/telemetry, and you can read it.
What is never sent
Prompts, messages, chats, character cards, personas, world info, model responses, request bodies and response bodies.
API keys, authorization headers, cookies, session tokens and passwords.
File names, file paths, folder contents, backup archives and anything inside them.
IP addresses, URL query strings, the host names of your own machines, user names, e-mail addresses, and anything else that identifies you.
How it is sent, and how to stop it
Events are appended to a local outbox file and sent asynchronously, signed with a key belonging to that installation. A receiver that is down never blocks SillyTavern; the outbox is trimmed and its entries expire after 90 days.
To stop the sending completely, set STM_TELEMETRY_ENDPOINT to an empty value in your .env file or environment and restart the manager. Nothing leaves the machine after that.
It is free software: you can also read the collection code, change it, and run your own build.
Cloudflare sign-in and R2 backups
If you connect Cloudflare, the sign-in is a standard OAuth authorization with PKCE against Cloudflare's own servers. The project never sees your Cloudflare password.
Only the refresh token is stored, in a file on your machine readable by your user alone. Access tokens and Worker keys are short-lived and live in memory.
Backups are uploaded from your machine to a bucket in your own Cloudflare account. They pass through no server of this project. What Cloudflare stores and logs is covered by Cloudflare's own privacy policy.
Disconnecting removes this installation's Worker key and revokes the sign-in. You can also revoke it yourself in your Cloudflare profile, under Manage OAuth authorizations. The bucket and its contents remain yours.
The sign-in relay at stm.phamloc.top
Cloudflare only returns a browser to an address registered on the OAuth client, matched exactly, and a manager can be open on any address. So the registered address is a static page on this site, which forwards the browser back to the manager that started the sign-in.
That page stores nothing, sets no cookie and runs no analytics. The authorization code it forwards is useless without the PKCE verifier, which never leaves your manager.
It forwards on its own only to loopback, private-network, .local, trycloudflare.com and ModelScope addresses. Anywhere else, it shows the destination and waits for a click, so it cannot be used as a silent redirect to another site.
The website
The pages at stm.phamloc.top are static files served from Cloudflare's network. There is no account, no login, no tracking pixel, no advertising and no third-party analytics script.
Cloudflare, as the host, processes request metadata such as IP address and user agent in order to serve and protect the site, under its own privacy policy.
Your language and theme choice, if you change them, are remembered in your own browser and sent nowhere. Pages may link to GitHub and npm; following a link puts you on their sites, under their policies.
Your choices and your rights
Because the project holds no personal data about you, there is usually nothing to access, correct, export or erase. If you believe an installation identifier or a telemetry record relates to you, write to the issue tracker and it will be deleted.
You can switch telemetry off with the setting above, disconnect Cloudflare at any time, and delete the data folder to remove everything the software ever wrote.
Changes to this notice
This notice changes when what the software sends changes. The version in force always ships with the software and is published at stm.phamloc.top/privacy, carrying the date it took effect.