Privacy Policy

StillMind is operated by Prioritised OÜ (Registration number: 16530243, VAT ID: EE102588297), located at Sepapaja tn 6, 15551 Tallinn, Harju County, Estonia.

This Privacy Policy applies to the StillMind mobile application (iOS and Android) and the StillMind website (getstillmind.com). When we refer to "the service" or "StillMind," we mean all platforms collectively.

1. Information Collection

Account & Contact Data

We collect email addresses, usernames, encrypted passwords, names, and contact information when provided by users.

Payment Handling

StillMind does not process or store payment-card or bank details. All purchases are handled through Apple App Store or Google Play Billing.

Technical Information

We collect device type, operating system, browser information, device identifiers, IP addresses, usage patterns, feature interactions, and performance metrics. This is processed by Sentry (stability, diagnostics and performance), Firebase (authentication, sync and app analytics) and Amplitude (product analytics).

Diagnostics and session replay

To find and fix faults, our diagnostics provider Sentry records a replay of app screens for a sample of sessions, and for sessions where an error occurs. A replay reconstructs what appeared on screen. It does not record your microphone or camera.

Text and images are masked before a replay leaves your device, so the content of journal entries, reflections and other written text is not legible in a recording. Replays are linked to your account identifier and IP address, and are stored by Sentry on servers in the European Union.

Location Data

StillMind does not request or collect precise location. Our analytics providers may derive coarse city- or country-level region from IP addresses.

Meditation & Mood Data

Users can log mindfulness sessions, reflections, mood ratings, and goals. We do not collect medical records, diagnoses, or biometric measurements such as heart rate.

Apple Health and Health Connect

With your permission, StillMind writes the length of a completed session to Apple Health on iOS or Health Connect on Android as mindful minutes, and reads mindful minutes back from it. Mindfulness is the only health data type we access. It is exchanged with the health store on your device, is not uploaded to our servers, and is not shared with our analytics or diagnostics providers. You can revoke this permission at any time in your device's health settings.

AI Insights

With your explicit opt-in, we process your Meditation & Mood Data using cloud-hosted large-language-model (LLM) services. Users can disable this feature in Settings at any time.

2. Data Usage

We use collected information for:

• Service provision and personalization
• Customer support and communications
• Analytics and feature improvement
• Legal compliance and fraud prevention
• Marketing communications (with consent)

3. Legal Basis (GDPR)

For EEA users, we process data under these grounds:

• Explicit user consent
• Contract performance
• Legitimate business interests
• Legal obligations
• Protection of vital interests

4. Data Sharing and Disclosure

Service Providers

We share data with the service providers that help us run StillMind:

• Google Firebase: account authentication, data sync, file storage, and push notifications
• Railway: hosting for our application servers
• Netlify: hosting for our website
• Sentry: crash reporting, performance monitoring, and session replay
• Amplitude: product analytics
• Customer.io: email and in-app lifecycle messaging
• RevenueCat: subscription management
• PostHog: website analytics and website session replay
• Anthropic: generating meditation guidance and analysing journal entries
• ElevenLabs: synthesising the spoken voice for guided sessions

What each provider receives differs. Our analytics, diagnostics, messaging and subscription providers receive account identifiers such as your user id and email address, along with usage and device data. They do not receive the content of your journal entries or reflections.

All providers are bound by data protection agreements.

AI Processing

When AI features are enabled, StillMind processes your entry text and meditation preferences to generate insights and guidance. Where your device supports on-device processing, this happens locally and the text does not leave your device. Otherwise it is sent over an encrypted connection to our servers and processed by Anthropic, and the spoken audio for guided sessions is synthesised by ElevenLabs.

We send only the text needed for the request, and no more of your account details than the request requires. You can turn AI features off in Settings at any time.

Legal Requirements

We may disclose information when required by law, to enforce our terms, or to protect rights and safety.

Business Transfers

In the event of a merger, acquisition, or asset sale, user data may be transferred with advance notice to users.

5. Data Security

We implement industry-standard security measures including encryption at rest and in transit, secure authentication, regular security audits, and access controls. However, no system is completely secure, and we cannot guarantee absolute security.

Your journal entries and reflections are encrypted on your device before they are stored in Firebase, so the stored copy is not readable without your key. This is why StillMind issues you a recovery code when encryption is set up: it is the only way to restore access to your entries on a new device, and we cannot recover it for you.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Upon account deletion, we remove or anonymize your data within 90 days, except where retention is required by law.

7. Your Rights

Depending on your location, you have rights to:

• Access: Request copies of your personal data
• Correction: Update inaccurate information
• Deletion: Request removal of your data
• Data Portability: Receive your data in a portable format
• Withdraw Consent: Revoke previously given consent
• Object to Processing: Object to certain data processing activities
• Lodge Complaints: File complaints with data protection authorities

To exercise your rights, contact us at contact@getstillmind.com.

8. Children's Privacy

StillMind is not intended for users under 18. We do not knowingly collect information from children. If we learn we have collected data from a child, we will delete it promptly.

9. International Data Transfers

Sentry, Customer.io and PostHog process and store their data in the European Union. Our other providers may process data in countries outside your residence. Where that happens we ensure appropriate safeguards are in place, including standard contractual clauses and compliance with applicable data protection laws.

10. Cookies and Tracking

We use essential cookies for authentication and preferences. On our website, analytics cookies are set by PostHog once you accept them in the consent banner. PostHog records page views and events, scroll and mouse-position heatmaps, and a replay of website sessions. Content typed into form fields is masked in those recordings. PostHog stores this data in the European Union.

You can decline analytics cookies in the consent banner, and control cookies through your browser settings.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or in-app notification. Continued use after changes constitutes acceptance.