In crisis? Tap here for immediate support · you are not alone
stillwater

Privacy Notice

Last updated: 16 May 2026

1. Who we are

This service ("stillwater", "we", "us") is operated by Curtis David Maughan, an individual sole trader based in the United Kingdom. For the purposes of UK GDPR, Curtis David Maughan is the data controller of personal data collected through this service. You can contact us at curtis.maughan94@gmail.com.

2. Personal data we collect

  • Account data: email address, login credentials, display name.
  • Content you create: mood entries, journal entries, breathing/session history, companion chat messages and preferences.
  • Support communications: messages you send us by email or in-app.
  • Usage and device data: IP address, browser type, device identifiers, pages visited, feature interactions, error logs.
  • Billing identifiers: a customer ID and subscription ID returned by our payments provider (Paddle). We do not store full card numbers.

3. Why we use it and our legal basis

  • To provide the service (account, journaling, AI companion, subscription access) — performance of a contract.
  • To process payments and manage subscriptions — performance of a contract.
  • To keep the service secure and prevent fraud or abuse — legitimate interests.
  • To debug, improve and develop new features — legitimate interests.
  • To respond to your support requests — legitimate interests.
  • To meet legal, tax and accounting obligations — legal obligation.
  • To send optional product updates, where applicable — consent, which you can withdraw at any time.

4. Who we share it with

We share personal data only with the following categories of recipient:

  • Paddle.com Market Ltd — our Merchant of Record and payments provider, which handles checkout, billing, tax, invoicing and subscription management.
  • Hosting and infrastructure providers that run our database, file storage, authentication and serverless functions.
  • AI model providers that process your companion chat messages to generate replies. Messages are sent only as needed to produce a response.
  • Email and customer support tools we use to reply to you.
  • Professional advisers (legal, accounting) where reasonably required.
  • Authorities or third parties where we are required to do so by law, or to protect our rights, property or safety, or those of our users.

We do not sell your personal data.

5. International transfers

Some of our service providers are located outside the United Kingdom and the European Economic Area. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.

6. How long we keep it

We keep personal data for as long as your account is active and for a reasonable period afterwards to comply with our legal, tax and accounting obligations, resolve disputes and enforce our agreements. When data is no longer needed, we delete or anonymise it. You can delete your account at any time by contacting us.

7. Your rights

Under UK and EU data protection law you have the right to:

  • Access the personal data we hold about you;
  • Have inaccurate data corrected;
  • Request erasure of your data;
  • Restrict or object to how we use it;
  • Receive a copy in a portable format;
  • Withdraw any consent you have given;
  • Complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

To exercise any of these rights, email curtis.maughan94@gmail.com. We will respond within one month.

8. Security

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls, and authentication. No system can be guaranteed perfectly secure, but we take security seriously and review our practices regularly.

9. Cookies and similar technologies

We use a small number of strictly necessary cookies and similar storage to keep you signed in, remember your preferences and keep the service secure. Our payments provider, Paddle, may set its own cookies during checkout. We do not use third-party advertising cookies.

10. Children

The service is not intended for children under 16. If you believe a child has provided personal data, please contact us so we can delete it.

11. Changes

We may update this notice from time to time. The "last updated" date above shows when it was last revised. Material changes will be communicated in-app or by email.

See also our Terms & Conditions and Refund Policy.