STL Comms, exposed

STL Comms, also called Sua Tech Lab and STL Chat, is a browser chat app aimed at sim racers. On 9 October 2026 the Reddit account u/CarlosEduardoAraujo posted it to r/DiscordAlternatives as a privacy-first replacement for Discord, built because Discord had turned off screen sharing and live streams. The same text was posted twice to r/vibecoding that morning. Both of those copies were removed.

This page goes through that post, the legal pages, the company site, and the JavaScript the chat app sends to every visitor. Some of the technical claims match the code. Several of the strong ones do not.

On this page

• The launch post
• Twenty years, three weeks, and a HostGator 404
• The privacy claims
• 60 FPS, a Raspberry Pi, and movie night
• A Discord layout that still says Discord
• SuaInternet.COM, the coin, and the filler text
• Who you pay, and who the seller is
• Why the streams were blocked
• Timeline
• Sources
• Corrections

The launch post

Posted 9 October 2026, 02:39 UTC, by u/CarlosEduardoAraujo. Title: "Discord blocked live streams, so we decided to build our own platform (100% focused on privacy and performance)."

At SuaInternet.COM, we've been developing infrastructure solutions and web systems for over 20 years. Instead of looking for temporary workarounds or hopping between apps, we decided to get our hands dirty and build STL Comms.

Our goal was to create a communication architecture that is ridiculously lightweight, fast, and gives privacy back to the users.

Source: the Reddit post linked above. The post then lists four features: 60 FPS streaming with audio mixed at 128 kbps, "zero-leak" direct messages, "zero server overhead" on a Raspberry Pi 4, and an interface with no pop-ups and no data mining.

Twenty years, three weeks, and a HostGator 404

The name SuaInternet.COM is old. The chat product is not.

The current legal entity attached to the email tatiara@suainternet.com is not a 20-year infrastructure company. Receita Federal data republished by Casa dos Dados (snapshot 13 September 2026) shows:

• CNPJ 58.092.462/0001-66, legal name "58.092.462 Tatiara de Araujo".
• Opened 13 November 2024. Opted into MEI, the individual micro-business regime, the same day.
• Share capital R$ 5,000.
• Main activity: computer training (CNAE 8599-6/03). Secondary activities include unspecified telecom services and computer retail.
• City: Alvorada do Norte, Goiás.

A closed firm, Suainternet.Com Ltda, CNPJ 05.796.869/0001-08, is listed in company directories under the name Carlos Eduardo de Araujo at an address on Avenida Bernardo Sayão in that same town. This page does not treat every Brazilian named Carlos Eduardo de Araujo as the same person. The chain that is public and specific is the Reddit account, the NIC.br contact durao@suainternet.com, the YouTube channel the company site links (@carloseduardoaraujo), and the Discord user "Carlos Eduardo de Araujo" who owns the invite on the company portfolio.

suainternet.com.br is a different registrant: Tax Consultoria e Representações Ltda, CNPJ 59.190.635/0001-41, registered in April 2025. It is not the operator named on the chat terms. Several other Brazilian ISPs also trade as "Sua Internet", including a telecom company in Palmas, Tocantins. Those companies are not the subject of this page.

The chat's own terms say the service is "mantida e operada pela empresa SuaInternet.COM" (maintained and operated by the company SuaInternet.COM). They do not give a CNPJ, a street address, or a support email. The company contact page says the office is in Simolândia, Goiás. The MEI registration says Alvorada do Norte. The two towns are about 4 km apart by road (route distance). The pages do not explain the difference.

The privacy claims

Zero-Leak Privacy in DMs: Isolated database architecture. Direct messages are strictly accessible only by the two users in the conversation. Not even the server administrator or the technical team can read the content.

The browser code does not do this.

Direct messages are sent to the operator's server as ordinary socket events. In /js/app.js the send path is socket.emit('dm:send', { recipientId, text, attachment, replyToId }). The message text leaves the browser as the text field. There is no encryption step before that send anywhere in the shipped scripts.

The phrase "ZERO-LEAK" does appear in that file. It is a comment on the delete button:

Direct Messages: STRICT ZERO-LEAK ACCESS - ONLY the author can delete their DM. Super-admins or server owners have ZERO permission to delete someone else's DM.

That rule hides a button. It does not stop the server, which already received the text, from storing it or logging it. The people who run the server are the technical team. An "isolated database" is an access-control story. It is not end-to-end encryption, and the client does not implement end-to-end encryption.

The privacy policy (updated "Setembro de 2026") is more honest about text, and then drifts:

• It says text messages are stored so other members can read them.
• It says voice and video are not recorded on the server. The client is consistent with that part for the media itself. See the next section.
• It says collection is limited to what the service needs, then describes "gravação atômica protegida contra corrupção em disco rígido" (atomic writes protected against hard-disk corruption). That is a description of files on a disk the operator controls.
• It says personal data will not be sold. The sentence after that promise is "Isso é sagrado para nós" ("That is sacred to us").
• The contact section tells users to raise privacy requests "pelo canal oficial do Discord ou pelo e-mail da organização" (through the official Discord channel or the organization's email). The email address is not printed on the privacy page or the terms page. The company site does publish suporte@suainternet.com.

A policy that sends privacy questions to Discord is a strange document for a product whose advertisement is that Discord cannot be trusted with communications.

Other privacy limits that the code does show:

• Creating a server or opening a DM requires Google sign-in. The privacy policy says Google provides the full name, the email address, and the profile photo. That part matches the login flow, which posts a Google credential to /api/auth/google.
• Voice calls use a full mesh of RTCPeerConnections. The only ICE servers configured are Google STUN servers (stun.l.google.com, stun1.l.google.com, stun2.l.google.com). Each person in the call learns the other's network address. Google's STUN servers are asked to help discover it. The privacy policy does not mention this.
• The Pro checkout tells the buyer to send an exact Nano amount because "a fração final identifica sua conta na blockchain de forma exclusiva" (the final fraction uniquely identifies your account on the blockchain). A public ledger then carries an identifier the operator ties to the Google account. That sits next to a marketing line about giving privacy back.

On 9 October 2026, GET /api/auth/config returned "devMode": false. The HTML still ships a hidden form labeled "Modo Demonstração / Dev", with the instruction "Configure GOOGLE_CLIENT_ID no .env para ativar OAuth real do Google" and a button "Entrar com Conta Simulada" (sign in with a simulated account). A simulated login posted to the live server was refused with HTTP 403 and the message "Autenticação de desenvolvimento bloqueada em produção. O acesso é estritamente exclusivo via Google OAuth." The demo door was closed on the server that day. The form is still in the page every visitor downloads.

No third-party advertising tracker turned up in the HTML or in the three application scripts reviewed. "No background data mining" is fair if it means no ad pixel. It is not a description of the Google account, the stored chat, or the payment identifier.

60 FPS, a Raspberry Pi, and movie night

60 FPS Streaming with Web Audio Mixing: We solved the movie night and gameplay streaming problem. The screen share natively pulls system or tab audio at 128 kbps. You no longer need extensions like Teleparty, Rave, Syncplay, or SharePlay to watch content perfectly synced with someone else.

Zero Server Overhead: All audio processing (mixing, AI noise suppression via RNNoise) is done client-side directly in the browser. The server acts purely as a WebRTC signaling relay. It's so efficient that the backend runs flawlessly on a Raspberry Pi 4.

What the client actually does, in /js/webrtc.js:

• Screen-share audio is capped at 128 kbps, and microphone audio at 64 kbps, by rewriting the Opus line in the SDP. The 128 kbps figure is real. It is a cap, not a measurement of quality.
• The default noise suppressor is the browser's own, suppressionMode: 'browser'. RNNoise is an optional mode that loads a third-party WebAssembly build (@sapphi-red/web-noise-suppressor) from /vendor/rnnoise/. The launch post describes RNNoise as the architecture. The default is the browser.
• Screen share calls getDisplayMedia with a frame rate of { ideal: 60, max: 60 }. Browsers treat that as a preference. The page meta description and the share button both advertise "60 FPS" as a property of the platform.
• The default preset is 1080p at 6 Mbps. A comment in the file says that default is "optimized for AMD RX 580 / RX 6600". The 4K mode is a separate preset, 4k_ultra, at 20 Mbps and 60 fps. The Pro modal sells this as "Transmissão 4K 60 FPS • 20 Mbps".
• There is no TURN server. If the direct path between two browsers fails, which is common on mobile networks and some home routers, the call has no relay to fall back on. "Flawlessly" is not a property of STUN-only WebRTC.
• The file header calls the mesh an "Enterprise Multi-Stream Engine" and claims "Instant 0ms Screen Share start/stop". A mesh sends every stream from each participant to every other participant. One person sharing a screen to a few friends can work. Several people publishing 20 Mbps at once multiply that upload by the number of viewers. The server is out of the media path. The viewers' connections are not free.

Nothing in the client, the terms, or either website shows a Raspberry Pi, a self-host guide, or a source download. The terms say the code of Sua Tech Lab, SuaInternet.COM, and Full Throttle eSports is the exclusive property of the developers. A Pi story that outsiders cannot build or inspect is a slogan.

The server is also not "zero overhead" for the rest of the product. Chat history, file uploads (the Pro plan allows 50 MB), Google accounts, and the Nano payment watcher all sit on that Express server. Signaling for the calls sits there too. Media can bypass it. The application does not.

A screen share is not Teleparty. Everyone watches the sharer's pixels, late by whatever the network adds, and only the sharer controls playback. Many film and music sites paint a black rectangle into a capture because of DRM. The post presents this as the movie-night problem, solved.

"Telemetria MoTeC" is in the meta description, the Pro pitch, and the manifest. In the client, a MoTeC file is an attachment whose name ends in .ld or .ldx. The free plan refuses those uploads and tells the user to buy Pro. There is no parser. The voice screen has a button, "+Simular Piloto FTE", that draws an animated canvas and labels it with the names of real Formula 1 drivers, including "Charles Leclerc (MoTeC Telemetria)". The numbers on that canvas are a sine wave.

An admin panel in the same HTML, titled "Modo Degustação", turns the 4K preset on for every user for a weekend and puts a sponsor strip on top. Preset sponsors wired into the form are "MP7 Borrachas Cabo Frio", "SuaInternet.COM", and "Sua Tech Lab". The last two both link to https://suainternet.com. 4K, in this app, is a flag an administrator can hand out.

A Discord layout that still says Discord

The interface is a server rail, a channel list, direct messages, and an event wizard. The colors are Discord's: blurple #5865f2, and the dark surfaces #1e1f22, #2b2d31, and #313338. Local settings are stored under fte_discord_nick, fte_discord_color, and fte_discord_custom_status.

The HTML comments name the source. Delete dialogs are marked "Discord-Style". The event modals are marked "IMAGEM 1 DISCORD" and "IMAGEM 2 DISCORD". One comment says the event form is "Fiel à Imagem 2" (faithful to image 2).

The webhook tab still contains Discord's own Portuguese help sentence:

Webhooks são uma forma simples de postar mensagens de outros apps e sites dentro do Discord usando a magia da internet.

In English: "Webhooks are a simple way to post messages from other apps and sites into Discord using the magic of the internet." That sentence is about Discord. It was left in a product sold as the way off Discord.

On 24 April 2026 the same Reddit account, in r/LeMansUltimateWEC, recruited drivers for "a Brazilian sim racing team called Full Throttle eSports" and told them to join its Discord. The company portfolio still offers "Criação de Discord" as a case study. The "Ver Case Study" link goes to discord.gg/W66NHZ36T8, a permanent invite to a server named Full Throttle eSports. On 9 October 2026 that invite reported about 85 members. The inviter's display name is Carlos Eduardo de Araujo. The case-study text says the Discord server was built with "as melhores práticas de SEO" (SEO best practices).

SuaInternet.COM, the coin, and the filler text

suainternet.com is a WordPress site. The visible pitch on 9 October 2026:

• "Agência líder em soluções de Inteligência Artificial e desenvolvimento web de alta performance." Leader in what ranking is not said.
• A counter row: "50+ Projetos", "100% Satisfação", "24/7 Suporte".
• "Junte-se a mais de 50 empresas que já transformaram seus negócios com a SuaInternet.COM."
• A drawing labeled "Google PageSpeed Insights" with a score of 98, LCP 0.9s, INP 38ms, CLS 0.00. The page does not link a PageSpeed report.
• A service grid that offers AWS, Azure, and GCP architecture, big data, machine learning "sob medida", and cyber security.

The portfolio page has three cards, not fifty.

1. "Otimização de Site de Notícias", with the figures "+40% conversão" and "10.000 usuários", linking to speedracing.com.br.
2. The Discord server above, with "+25% produtividade" and "+50 colaboradores".
3. "Ecossistema Web3 & Automobilismo Virtual." The text says SuaInternet built, for the startup Full Throttle eSports, a share-tokenization system called Full Throttle Coin (FTC) on Polygon, with a supply of 1,000,000, plus a sim-racing shop and a way to charge for live streams. The stat printed next to it is "100% Transparência".

The case-study link for the coin goes to /nossa-jornada-full-throttle-esports/. The visible page says the team was integrated with Polygon, that smart contracts validate results, and that "operações e tokens" are recorded on Polygonscan for public audit. It also says the visual identity was planned with "ferramentas avançadas de renderização (como Skia/PDF)". There is no contract address, no transaction, and no Polygonscan link. A search on 9 October 2026 did not find a Full Throttle Coin, or an FTC contract, tied to Full Throttle eSports or SuaInternet. Absence from a search is not proof a token was never deployed. The page does not show the audit it describes.

The same writeup, as stored for that page and returned by the public WordPress API, still contains the placeholder "Lorem Ipsum has been the industry's standard dummy text ever since the 1500s," twice. The theme on the public URL leaves those two sentences out. The placeholder is still in the stored page.

WordPress's default Sample Page is still published at /sample-page/. The description given to search engines is the stock text, including "Hi there! I'm a bike messenger by day, aspiring actor by night." The content stored for the page, which the same API returns, continues with the fictional "XYZ Doohickey Company" of Gotham City, founded in 1971, and ends by telling the owner to delete the page and write a real one. The theme at that URL prints the blog, so a visitor does not see the Gotham paragraph in the body. The page is still published, and the snippet is still the demo.

The chat footer claims a copyright for "Sua Tech Lab - Full Throttle eSports (FTE)". The public lobby id in the client is fte-esports. The coin page is the longest public description of that organization. It names a token and a public audit, and it publishes neither.

Who you pay, and who the seller is

Full Throttle Pro is R$ 9.90 a month or R$ 99.90 a year. The yearly tab says "2 MESES GRÁTIS". Twelve times R$ 9.90 is R$ 118.80, so the yearly price is about two months off the monthly price. That arithmetic holds.

The only checkout in the app is Nano (XNO). The modal says confirmation is "em menos de 1 segundo", the fee is "R$ 0,00", and the payment is "descentralizado e seguro sem intermediários bancários". Nano transfers cannot be reversed by a bank. The terms of service, governed by Brazilian law and citing the Marco Civil and the LGPD, do not mention refunds, the seven-day withdrawal right for online purchases, an invoice, a CNPJ, or a postal address. The seller on the screen is "Sua Tech Lab" and a Nano address the app fills in at checkout.

The same admin panel can grant Pro for 30 days, 365 days, or 9999 days, labeled "Vitalício / Permanente", by typing an email. That button is in the HTML everyone receives. Whether the server honors it depends on a role check this review did not bypass. It does show that "Pro" is a flag the operator can set by hand.

Why the streams were blocked

The launch post says Discord cut off screen sharing and live streams "overnight", and that people were left hanging for pair programming, meetings, and movie night. It does not say why the block exists.

In August 2026 Brazil's data-protection authority, the ANPD, ordered Discord to suspend live video features in Brazil. The order followed the death of a 13-year-old during a livestream on the platform on 22 July 2026, in Mato Grosso do Sul. Discord has said it complied on 17 August 2026. In late September the ANPD's enforcement office refused to restore the features and said Discord had not technically shown that the block covered the whole service and could not be routed around. News reports described the suspended features as live broadcasts, video calls, and screen sharing. On 21 September Discord also removed third-party apps that had been used to get around the suspension.

STL Comms shipped into that gap. Screen sharing is the feature on the share button, in the meta description, and in the Reddit post. The client joins a voice channel and starts a screen share with no login check in the browser code. A guest nickname is stored locally under fte_discord_nick. Direct messages do require Google. A search of the shipped pages and scripts found no age question and no age gate. The terms forbid illegal content, including child sexual abuse material, and they say the service is provided "as is" while the operator will "strive" for 100 percent uptime.

Building a screen-share app is legal. Selling it as a neutral fix for a block the post does not explain is a choice about what to tell the reader.

Timeline

Sources

Primary pages and files fetched on 9 October 2026:

• https://chat.suatechlab.com.br/ and the files it loads: app.js, webrtc.js, privacy.html, terms.html, manifest.json.
• /api/auth/config on the chat host.
• https://suatechlab.com.br/ (HostGator 404).
• https://suainternet.com/, /portfolio/, /contato/, /servicos/, /nossa-jornada-full-throttle-esports/, /sample-page/.
• RDAP for suatechlab.com.br and RDAP for suainternet.com.br.
• RDAP for suainternet.com.
• Casa dos Dados, CNPJ 58.092.462/0001-66, a mirror of Receita Federal data.
• Reddit launch post. Text and timestamps taken from a public Reddit archive the same day, because reddit.com blocked a direct fetch.
• Discord invite metadata for the server named in the portfolio: discord.gg/W66NHZ36T8.

On the ANPD order, contemporary reporting:

• Valor Econômico, 25 September 2026.
• Estadão / TecMundo, 21 September 2026.
• Campo Grande News, 25 September 2026.

Corrections

This page is not affiliated with Sua Tech Lab, Full Throttle eSports, or SuaInternet.COM. It will be updated if a primary document contradicts a statement here. The useful kind of correction is a link to a filing, a contract address, a source tree, or a copy of the page as it stood.

Hardware that is not visible from outside, including whether any process has ever run on a Raspberry Pi, is described only as "not shown by the public app." The closed CNPJ entries are taken from public mirrors of the federal company registry, not from a certificate ordered from Receita Federal for this page.