Privacy
Privacy Policy
Private by design. Here's exactly what that means.
Last updated: [CONFIRM date on publication]
1. Who we are
Still ("Still", "we", "us") is a private communication tool for committed couples, operated by Qualia Labs Ltd ("the controller"), a company registered in England & Wales, company number [CONFIRM on incorporation], registered address [CONFIRM on incorporation]. We are the data controller for the personal data described here. Our ICO registration number is [CONFIRM: register at ico.org.uk].
Questions, or to exercise your rights: privacy@stilljustus.com.
2. The data we collect
- Account data: your first name, email address, and a securely hashed password — or, if you choose “Continue with Google”, the name and email address Google confirms plus a Google account identifier instead of a password. Google only confirms your Google account; nothing you write in Still is ever shared with Google. Optionally, your pronouns, used only so Still’s reflections and your common ground refer to you correctly; if you don’t share them, Still uses your name and neutral wording rather than guessing.
- What you write: the entries, reflections, Vault items, Mirror sessions, Check-ins and Love Jar moments you save. Much of this is, by its nature, information about your relationship, feelings and wellbeing: see “Special category data” below.
- Pairing data: if you connect with a partner, the link between your two accounts (never the content each of you writes privately).
- Safety screening: your answers to two optional safety questions at sign-up, used only to keep you safe and switch off couple features where appropriate.
- Preferences & consent: your notification and marketing choices, and a record of the consent you gave and when.
- Billing data: your subscription plan and status, your trial end date, and a customer reference issued by our payment provider (Stripe). Your card details go directly to Stripe. We never see or store them.
- Technical data: a session token to keep you signed in, and standard server logs. We do not use third-party analytics, advertising, or tracking cookies.
What we deliberately never receive: anything you write and throw away in the Rant Room. It stays on your device and is never sent to us, including voice, which is transcribed on your device, not in the cloud. If you throw it away, it never existed as far as Still is concerned.
3. Special category data & your explicit consent
What you write may reveal information about your health, sex life, or beliefs: "special category data" under UK GDPR Article 9. We process it only with your explicit consent, which you give by ticking the required box at sign-up, and which you can withdraw at any time by deleting the relevant content or your account. We ask you not to record others' special category data without their knowledge.
4. Why we process it, and our lawful bases
- To provide Still (create your account, save your writing, generate reflections and common ground): performance of our contract with you, and your explicit consent for special category data.
- To keep you safe (safety screening, routing to support): your explicit consent and our legitimate interest in user safety.
- To send service emails (partner linking, password reset, activity nudges): performance of our contract.
- To send marketing emails (only if you opt in): your consent, withdrawable any time via the unsubscribe link or your account settings.
5. Who we share it with (processors)
We do not sell your data and do not share it for advertising. We use a small number of processors under contract, only to run Still:
- Anthropic (maker of Claude): processes the text you submit, to generate reflections, summaries and common ground. Under Anthropic’s Commercial Terms of Service, your inputs and outputs are not used to train Anthropic’s models, and are retained only for a limited period to provide and secure the service (content may be kept longer only where required for safety or legal compliance). Anthropic acts as our data processor under a Data Processing Addendum. [ACTION: execute the outstanding Data Processing Agreements: Resend, Stripe, Cloudflare R2, before launch; Anthropic and Railway are in force]
- Resend: sends our transactional and (if you opt in) marketing email.
- Railway: hosts the application and database in the European Union (Netherlands). Your writing is stored in the EU.
- Stripe: handles payment for subscriptions. Your card details are collected by and stored with Stripe, never by us. Stripe processes payment data under its own legal responsibilities as well as on our behalf. [CONFIRM controller/processor wording for Stripe with solicitor]
- Your browser’s push service (Apple, Google or Mozilla): delivers push notifications, only if you enable them on a device.
- Cloudflare R2: stores encrypted database backups.
Some processors may process data outside the UK/EEA (for example in the United States). Where they do, transfers are protected by the UK International Data Transfer Agreement/Addendum or the EU Standard Contractual Clauses, incorporated into each processor’s data processing agreement.
6. How long we keep it
We keep your account and what you have written until you delete it or close your account. You can permanently delete individual items, or your whole account, at any time from Account settings. Deletion is immediate and irreversible in the live system. Encrypted backups are retained for up to 30 days, after which deleted data ages out of them. Thrown-away rants are never stored at all. Records of payments you have made are held by Stripe, which retains them for as long as its own legal obligations (such as financial-record keeping) require.
7. Your rights
Under UK GDPR you can: access your data (download everything from Account settings), correct it, delete it, restrict or object to processing, withdraw consent, and receive your data in a portable format. To exercise any right, use the in-app tools or email privacy@stilljustus.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
8. Security
Passwords are hashed with bcrypt; sessions expire and can be revoked; traffic is encrypted in transit; the admin surface is access-controlled and sensitive admin actions are logged. Your private entries are never shown to your partner, only the neutral common ground you both choose to generate. No system is perfectly secure, but protecting what you write is the core of how Still is built.
Can our staff read what you write? Our tools are built so the answer is no in day-to-day reality: no admin screen shows your writing, only account details like your name, email, and subscription status. And no one can quietly open your account: the only way in is a password reset, which signs you out of every device and is recorded in an audit log, so you would know. What you write does live on our servers so Still can work, and the small team who keep those servers running touch them only when operating the service requires it, with sensitive actions logged. We’d rather tell you exactly how it works than make an absolute promise no service like ours could truly keep.
9. Children
Still is for adults. You must be 18 or older to create an account.
10. Changes
We'll update this policy as Still evolves and will tell you about material changes. Continued use after an update means you accept the revised policy.