Privacy Policy

STILL ("STILL," "we," "us," or "our") is a personalized mental training and meditation application that generates AI-guided audio sessions. For privacy inquiries, contact us at privacy@stillmode.app.

2.1 Account information

When you register, we collect your email address and, optionally, your first name. This is necessary to create and maintain your account.

2.2 Session data

We store the meditation sessions you generate, including: the program you selected, the check-in responses you provide (emotions, physical sensations, personal context), the generated script, and the resulting audio file.

2.3 Session memory

If session memory is enabled on your account, we also generate and store a short written note (a few sentences) summarising the theme you appear to be working through, derived from the context you write during check-in. This note is created automatically, is never shown to anyone but you, and is used only to give continuity to your own later sessions and to the reminder emails we send you. We do not create a note from context that our safety filters flag as describing self-harm or crisis. You can see exactly what is stored, choose before every session whether to use it, switch memory off, or erase all stored notes at any time from Account.

2.4 Voice recordings (Voice Cloning feature) — sensitive data

This is biometric-adjacent data and is treated with heightened care. When you use the Voice Cloning feature, you record a short audio sample. This sample is transmitted to a specialized voice-synthesis provider to create a mathematical voice model. We do not retain the original audio. We retain only the resulting voice identifier, which is used exclusively to narrate your own sessions. You can revoke this at any time (see Section 8).

2.5 Usage data

Completion status, playback progress, favorites, and streak counts. Used to improve your experience and surface relevant sessions.

2.6 Payment data

Payments are processed by an external PCI-DSS-compliant payment provider. We do not see, store, or have access to your credit card or banking information. We receive only subscription status and payment confirmation.

2.7 Technical data

Standard server logs: IP address, browser type, device type, timestamps. Used for security, debugging, and performance monitoring. Retained for up to 90 days.

We use your data to:

• Generate personalized AI meditation sessions tailored to your responses
• Narrate sessions using your cloned voice, if you enable that feature
• Maintain your session history, favorites, and streak
• Process subscription payments
• Send transactional emails (account confirmation, receipts, critical updates)
• Detect abuse and improve service quality

We do not sell your personal data. We use advertising-measurement tools (see Section 12) that receive hashed, non-content identifiers only — never your session content or your voice data. We do not share your individual session content with anyone except the technical providers strictly required to deliver it to you.

To deliver the Service, we work with a small number of established infrastructure providers, each selected for security, privacy, and regulatory compliance. Each one receives only what it needs for its part of the Service, and everything travels encrypted (HTTPS). None of them receives your data for advertising.

• Database and file storage — keeps your account, your sessions (what you wrote, the script and the audio) and your session memory notes in private storage, encrypted in transit and at rest.
• Session writing — a language-model provider receives what you write, your first name (unless you turn off “Your name in sessions” in Account) and your recent session memory notes, and returns the script, the title and the closing line. It also screens what you write for safety and suggests which program fits it. Under its business terms, it does not use this data to train its models.
• Voice — a voice-synthesis provider receives the finished script, which can include your first name and a few of your own words, and turns it into audio. If you record your voice, it receives that recording and keeps the voice model made from it until you delete it (see Section 8).
• Hosting — runs the app. Everything you send to STILL, including what you write, passes through it, encrypted.
• Email delivery — sends our emails. Reminder emails can quote a line you wrote, or your session memory note, back to you. They go only to you.
• Polar — payments, as merchant of record. It receives your email address and your payment details, never what you write.
• Meta Platforms — advertising measurement. We share hashed identifiers (such as a hashed version of your email, your IP address, and browser/click identifiers) so we can measure whether our ads led to a sign-up and improve our campaigns. When you create a session, Meta is told that you created a session, not which kind, and never what you write or your voice data.

Each provider processes data under its own data processing terms. If you use STILL and need the names of these providers for a data-protection request, write to privacy@stillmode.app.

Meditation scripts and audio sessions are created using generative AI. You retain the right to listen to, replay, and personally use sessions generated for your account. You may not redistribute, resell, or commercially exploit AI-generated session content without prior written consent from STILL. The underlying AI models, prompts, pipelines, and audio infrastructure remain the exclusive property of STILL and its technology providers.

Voice recordings and the mathematical voice models derived from them may be considered biometric data under laws such as the Illinois Biometric Information Privacy Act (BIPA), Texas CUBI, and similar statutes worldwide.

By using the Voice Cloning feature, you:

• Confirm you are the person being recorded and own the rights to your voice
• Consent to your voice audio being transmitted to our voice-synthesis provider for processing
• Acknowledge that the provider creates and stores a mathematical voice model (not the original audio)
• Confirm you are at least 18 years old
• Understand you can request deletion of your voice model at any time

Your voice data will never be used to train public or shared AI models without your explicit, separate, opt-in consent.

• Account data: retained while your account is active
• Sessions: a session you haven’t saved is deleted 30 days after it was made, together with its audio, its script and what you wrote for it. Saved sessions are kept until you unsave them or delete your account
• Session memory notes: used only for sessions created in the following 45 days, and erased immediately when you erase them or delete your account
• Voice model: retained until you request deletion
• Payment records: retained for 7 years where required by tax and accounting law
• Server logs: retained for up to 90 days for security and debugging
• After account deletion: all personal data is permanently deleted within 30 days, except data we are legally required to retain (e.g., payment records)

Regardless of where you live, you have the right to:

• Access: request a copy of the personal data we hold about you
• Correction: update inaccurate or incomplete data
• Deletion: delete your account and all associated personal data
• Portability: export your session history in a structured format
• Voice deletion: remove your cloned voice model from our systems and our voice-synthesis provider
• Withdraw consent: disable voice cloning or any other optional processing at any time from Settings
• Object: object to processing for direct-marketing or advertising-measurement purposes
• Restrict processing: request that we temporarily limit how we process your data while a dispute is resolved
• Complain: lodge a complaint with your local data-protection authority

To exercise any right, email privacy@stillmode.app. We will respond within 30 days. There is no charge for exercising these rights.

8.1 Rights under GDPR (European Economic Area and United Kingdom)

If you are located in the EEA or UK, you benefit from the rights set out in articles 15–22 of the GDPR, which are summarized above. Our lawful basis for processing is: (a) contract — necessary to deliver the Service you requested; (b) consent — for voice cloning and optional features; (c) legitimate interest — for security, fraud prevention, and product improvement.

8.2 Rights under CCPA / CPRA (California residents)

California residents have the right to know what personal information is collected, used, shared, or sold; the right to delete personal information; the right to correct inaccurate information; the right to opt out of the sale or sharing of personal information; and the right to non-discrimination for exercising these rights. STILL does not sell personal information.

8.3 Rights under other jurisdictions

Similar rights exist under the laws of Brazil (LGPD), Canada (PIPEDA), Colombia (Ley 1581 / Decreto 1377), Mexico (LFPDPPP), Argentina (Ley 25.326), and other jurisdictions. We extend the equivalent set of rights to all users globally.

Using the Voice Cloning feature constitutes your explicit, informed, opt-in consent to the processing of your voice audio as described in this policy. You confirm that:

• You are the person speaking in the recording
• You are at least 18 years of age
• You consent to your voice being processed by our voice-synthesis provider
• You understand the original audio is not stored by STILL
• You understand this consent can be withdrawn at any time from Settings or via email

STILL is operated from and uses infrastructure in multiple countries. If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with cross-border transfer restrictions, your personal data may be transferred to countries whose data-protection laws may differ from yours. For such transfers, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission and equivalent mechanisms. A copy of these clauses is available on request.

We apply industry-standard security practices: HTTPS encryption in transit, encryption at rest for sensitive data, role-based access controls for the small number of STILL team members who need access, regular credential rotation, and private storage with time-limited signed URLs for audio files.

Despite these measures, no system is perfectly secure. In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours of becoming aware, as required by applicable law.

STILL uses strictly necessary cookies for authentication (to keep you signed in) and basic service delivery. We also use the Meta Pixel and Meta’s Conversions API to measure the performance of our advertising: when you visit our site or create an account, a limited set of event and identifier data — a hashed version of your email, your IP address, your user agent, and Meta click identifiers (such as the _fbp / _fbc cookies) — is shared with Meta so we can attribute sign-ups to our ads and optimize our campaigns. We do not share your session content or your voice data for advertising, and we do not use this to build a profile of your in-app activity. You can limit this through your device or browser ad settings and through your Meta ad preferences. We honor Do Not Track signals where technically feasible.

STILL is not directed at children under 18. We do not knowingly collect personal data from minors. Voice Cloning is strictly restricted to users 18 years and over. If you believe a minor has registered, contact us at privacy@stillmode.app and we will promptly remove the account.

STILL provides general wellness and mental-training content. Sessions are not a substitute for professional medical, psychological, psychiatric, or therapeutic advice, diagnosis, or treatment. If you are experiencing a mental-health crisis, suicidal ideation, or any serious psychological disturbance, please contact a qualified healthcare provider or your local emergency services immediately.

We may update this policy as the Service evolves. We will notify you of material changes by email or in-app notification at least 14 days before they take effect. Your continued use of STILL after the effective date constitutes acceptance.

For any privacy question, request, or complaint:

Email: privacy@stillmode.app
Response time: within 30 days