STH Voice is operated from Pakistan and this policy applies to sthvoice.com and to the dashboard behind it. It is written in plain terms rather than legal ones, and it describes what the software genuinely does today.

An account needs a name, an email address and a password. The password is never stored. What is stored is a bcrypt hash of it, which cannot be turned back into the password by us or by anyone who obtains a copy of the database.

When you create a project we store the script you paste, the settings you chose, and the audio and video the system produces from them. When you submit a payment we store the package, the amount, the method, the transaction reference you type, and the screenshot or receipt you attach.

We record the time an account was last active. We do not run advertising trackers, we do not sell anything to data brokers, and there is no third party analytics script on the site.

Your script and settings exist so the system can build your video and so you can build it again later without retyping anything. Payment records exist because an administrator confirms every payment by hand before a package opens, and because both sides need a record of what was paid.

Your email address is used to sign you in and to reach you about your account. It is not used for marketing unless you ask for that.

Finished videos are kept for a limited window and then deleted automatically. The current window is set in the admin panel and is seven days by default. Working files created during a render are removed as soon as that render finishes.

Your project and its settings are kept after the video is deleted, so you can generate it again. Payment records are kept for as long as we are required to keep financial records.

Ask us to delete your account and we remove it along with the projects, files and sessions attached to it.

Your projects and payment records are visible to you and to the administrators of this installation. Every route that serves a file checks that the person asking owns it, and a request for something belonging to somebody else is answered as though it does not exist.

Files are never placed in a public folder. They are served through handlers that check who is asking, are sent as downloads, and are marked so a browser will not execute them as part of this site.

Google reCAPTCHA runs on the sign in and sign up forms to tell people from automated traffic. Google receives the information their script collects and their privacy policy applies to it.

Stock footage providers are contacted when a scene cannot be filled from the library. They receive the search terms for that scene and nothing that identifies you.

Payments happen outside this website, through Easypaisa or JazzCash. We never see your wallet credentials. We only see the reference you type and the screenshot you choose to attach.

Passwords are hashed with bcrypt at a deliberately slow cost. Sessions are checked against the database on every request rather than trusted from a token, so removing an account's access takes effect immediately instead of whenever a token would have expired.

The site is served over HTTPS. The database is not reachable from the internet. No security is perfect and we do not claim otherwise; we claim only that these specific measures are in place.

You can see and change your account details in the dashboard, and you can change your password there at any time. You can ask for a copy of what we hold about you, or ask for it to be deleted, by messaging support.

If you would like something in this policy explained or corrected, tell us. We would rather fix the document than argue about it.