Privacy Policy

Who we are

Fog and Iron Labs LLC ("Fog and Iron") operates Still from the United States. For the account tools available today, sign in, open You, and use Download my data or Delete this account. For other privacy requests, email support@fogandiron.com.

Accounts

You create an account using one of the sign-in methods shown in the app. We store your user id, name, email, whether the email is verified, a profile image if the sign-in provider sends one, session tokens, and (for email sign-in) a hashed password — never the password itself. Password-reset links go only to that email and expire in one hour.

Product suggestions

Still may offer a public form for product-improvement ideas. If that inbox is connected, we receive the idea and any optional reply email you choose to provide. We use that information to review or follow up on the idea, not to enroll you in reminder or marketing messages. Please do not include passwords, payment information, private health details, or emergency requests in a suggestion.

What we collect

Information you give us: display name, check-in hour and time zone, optional daily notes and mood, people you name in a private circle (name and relation), an optional emergency card (name, blood type, allergies, medications, conditions, notes), optional circle delivery details, recipient and safety-consent choices, and optional reminder choices.

Information we create: whether you tended each day, Still+ entitlement and billing status, invitation and notice status, and the account data needed to keep your private ritual available across devices.

Information from devices: IP address and user agent on a session, approximate time zone, and whether the app is installed on a Home Screen. We do not collect precise GPS, contacts, photos, or the contents of other apps.

How we use it

To run the ritual, keep you signed in, show the in-app check-in prompt you choose, detect clear crisis language so we can show resources, provide features you request, send eligible notices through confirmed channels, improve reliability, and comply with law. We do not use your notes or circle names for advertising, sell personal information, or “share” it for cross-context behavioral advertising as those terms are used in California law.

Payments

Stripe handles Still+ checkout and card details when live billing is active. Still does not receive or store the full card number. We retain subscription identifiers, status, price interval, and dates needed to provide and manage the paid entitlement.

Processors

Hosting and database providers store the account and ritual. The sign-in service receives what it needs to authenticate you. Resend, our transactional-email provider, receives the account email and password-reset link only when the account holder requests recovery. If the product-suggestion inbox is connected, it receives the submitted idea and optional reply email for review. When used and active, Stripe processes billing, Resend processes email, Twilio processes text and calls, and xAI processes the single companion request you initiate. The relevant provider receives only what is needed for that service under its own terms.

SMS program

Still+ may send transactional circle invitations, tests, missed-light notices, or consented check-ins by SMS. The account holder must record permission and the recipient must confirm before ordinary notices begin. Message frequency varies. Message and data rates may apply. Reply STOP to stop or HELP for help. Consent is not a condition of purchase.

Mobile information

When text or call delivery is enabled, we use a recipient’s mobile number to provide the requested transactional service, manage consent, prevent duplicate delivery, and honor opt-outs. We will not share mobile information with third parties or affiliates for marketing or promotional purposes. Text-message originator opt-in data and consent will not be shared with third parties except aggregators and providers needed to deliver the service.

Opt in and opt out

Still does not send promotional messages. Password-reset email is sent only when an account owner asks for recovery. An optional owner email check-in reminder requires a separate recorded choice for the verified account email and can be turned off in You. Circle recipients confirm their delivery method and can stop notices through the management link; text recipients can also reply STOP.

Your writing

Notes stay on your account and are never included in circle notices. If you request the optional daily companion, today's note, mood, prompt, and display name are sent to the configured AI provider to create that response. Crisis resources may appear if your writing matches clear self-harm language. That is not diagnosis or monitoring.

Data export in the installed app

When you tap Copy my data export, Still copies your account data as JSON to your device’s clipboard. You can paste it into a document you control. Your device and other apps may be able to access clipboard contents, so clear the clipboard after using your export if you share your device.

Cookies and sign-in

We use a session cookie on the website or a session token in the installed app to keep you signed in. It is necessary to run the account. We do not use advertising cookies or sell analytics to data brokers.

Your rights

You can access and download a copy of your ritual from You (Download my data). You can correct profile fields in You. You can start from nothing, which wipes ritual data on the account. You can delete the account.

If you are in the EEA, UK, or a similar regime, we process this data to perform the ritual you asked for and as needed for security and law. You may have rights to access, correct, delete, restrict, port, or object, and to complain to a supervisory authority.

Deleting your account

In Still: sign in → You → Delete this account. That permanently removes your light, circle, emergency card, invites, notice log, Still+ row on this service, sessions, and sign-in. It cannot be undone.

Still first attempts to cancel an active subscription. If that cannot be confirmed, deletion stops rather than leaving unknown billing. Provider records already required for transaction, consent, fraud, tax, or legal compliance may remain under the provider’s retention rules. We may keep a minimal deletion record when required to prevent abuse or comply with law.

Children

Still is not directed at children under 13. We do not knowingly collect personal information from children under 13 (COPPA). If we learn we have, we will delete it. Do not put a child’s contact in a circle.

How long

Ritual data stays while the account does. Free logs are kept for 30 days of lights; Still+ keeps a year. After deletion, we remove service copies as described above.

Security and transfers

Data is stored with our hosting and database providers, which may process it in the United States. No method of transmission is perfectly secure. You are responsible for the email and devices on the account.

Changes

If we change this policy in a material way, we will update the date above and, when required, notify the email on the account.

Questions

Use You in the app. Still is not a medical device or emergency service. In danger, call your local number. In the United States, call or text 988.