Privacy Notice

Last updated: 22 June 2026

Plain-English summary: we collect only what we need to run the app, we never sell your data, your private content stays yours, and you can delete your account at any time by emailing us.

What Stillwater can see, in plain English

Your email and account ID, so we can sign you in and contact you.
Your billing data through Stripe — a customer ID, plan, and invoice history. We never see your card.
Nothing else. Your journal entries, AI conversations, mood check-ins, reflections, and personal insights stay on your account. Stillwater staff cannot read them — the database itself refuses to return that content to operator tools.
If you joined through work, your organisation sees only anonymous activity counts for groups of 5 or more. Never your name, never your content, never your individual activity.
Encrypted backups exist for disaster recovery only. They are never opened for support, analytics, or any other purpose.

1. Who we are

This service (“stillwater”, “we”, “us”) is operated by Curtis David Maughan, an individual sole trader based in the United Kingdom. For the purposes of UK GDPR, Curtis David Maughan is the data controller of personal data collected through this service. You can contact us at curtis.maughan94@gmail.com.

2. Personal data we collect

Account data: email address, login credentials, display name.
Content you create: mood entries, journal entries, breathing/session history, stillwater guide chat messages and preferences.
Support communications: messages you send us by email or in-app.
Usage and device data: IP address, browser type, device identifiers, pages visited, feature interactions, error logs.
Billing identifiers: a customer ID and subscription ID returned by our payments provider. We do not store full card numbers.

3. How AI conversations are handled

When you message the stillwater guide, your message and a short context of the recent conversation are sent to an AI model provider via the Lovable AI Gateway so a reply can be generated. We do not use your conversations to train third-party AI models, and we do not sell or share them for advertising.

Conversations are stored against your account so you can come back to them. You can delete individual chats from within the app, and you can request deletion of all conversation history by emailing us.

The stillwater guide uses safety filters that block harmful content and redirect to professional and emergency resources where appropriate. The stillwater guide is not a therapist, doctor, or crisis service.

4. Why we use your data and our legal basis

To provide the service (account, journaling, stillwater guide, subscription access) — performance of a contract.
To process payments and manage subscriptions — performance of a contract.
To keep the service secure and prevent fraud or abuse — legitimate interests.
To debug, improve and develop new features — legitimate interests.
To respond to your support requests — legitimate interests.
To meet legal, tax and accounting obligations — legal obligation.
To send optional product updates, where applicable — consent, which you can withdraw at any time.

5. We do not sell your personal data

We do not sell, rent or trade your personal data to advertisers, data brokers or anyone else. We only share data with the service providers listed below, and only as needed to run the app.

6. Who we share it with

Our payments provider — handles checkout, billing, tax and subscription management.
Hosting and infrastructure providers that run our database, file storage, authentication and serverless functions.
AI model providers that process your stillwater guide chat messages to generate replies. Messages are sent only as needed to produce a response.
Email and customer support tools we use to reply to you.
Professional advisers (legal, accounting) where reasonably required.
Authorities or third parties where we are required to do so by law, or to protect our rights, property or safety, or those of our users.

7. Deleting your account and data

You can permanently delete your stillwater account at any time by emailing curtis.maughan94@gmail.com from the address registered to your account. We will:

Cancel any active subscription so you are not billed again;
Delete your account, mood entries, journal entries, AI conversation history and personalization settings within 30 days;
Retain a minimal record of the transaction (invoices, payment IDs) only where required to comply with tax, accounting and anti-fraud obligations.

8. International transfers

Some of our service providers are located outside the United Kingdom and the European Economic Area. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.

9. How long we keep it

We keep personal data for as long as your account is active and for a reasonable period afterwards to comply with our legal, tax and accounting obligations, resolve disputes and enforce our agreements. When data is no longer needed, we delete or anonymise it.

10. Your rights

Under UK and EU data protection law you have the right to:

Access the personal data we hold about you;
Have inaccurate data corrected;
Request erasure of your data;
Restrict or object to how we use it;
Receive a copy in a portable format;
Withdraw any consent you have given;
Complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

To exercise any of these rights, email curtis.maughan94@gmail.com. We will respond within one month.

11. Security

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls, and authentication. No system can be guaranteed perfectly secure, but we take security seriously and review our practices regularly.

12. Cookies and similar technologies

We use a small number of strictly necessary cookies and similar storage to keep you signed in, remember your preferences and keep the service secure. Our payments provider may set its own cookies during checkout. We do not use third-party advertising cookies.

13. Children

The service is not intended for children under 16. If you believe a child has provided personal data, please contact us so we can delete it.

14. Changes

We may update this notice from time to time. The “last updated” date above shows when it was last revised. Material changes will be communicated in-app or by email.