Privacy Policy

Last updated:

STILLPOINT ("we," "us," "our") provides a wellness application that personalizes daily content based on Traditional Chinese Medicine principles, integrating local weather data, sunrise and sunset times, and seasonal food recommendations. This Privacy Policy describes what information we collect, how we use it, and your rights and choices.

Important: This policy applies to the STILLPOINT mobile and web applications and any related services. By using STILLPOINT, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Account Information

When you create an account with STILLPOINT, we collect:

• Email address — used for account authentication, password recovery, and essential service communications.
• Password — stored securely using industry-standard encryption. We never have access to your plaintext password.
• Account preferences — settings you configure within the app, including notification preferences and personalization options.

Profile Information (Optional)

You may choose to provide additional information to personalize your experience:

• Age or date of birth — used to provide age-appropriate content and wellness recommendations.
• Gender — used to tailor certain wellness recommendations based on Traditional Chinese Medicine principles.
• Health interests or goals — information you provide to help us customize content to your wellness journey.
• Dietary preferences or restrictions — used to filter meal suggestions and recipes.

Location Information

To provide localized content (weather, sunrise/sunset, seasonal produce), we may collect:

• Precise GPS location — collected only if you grant permission. Used to display accurate local weather conditions and nearby seasonal foods. You can revoke this permission at any time through your device settings or app preferences.
• Approximate location via IP address — if GPS is not available or permitted, we may use your IP address to determine your approximate location (city/region level). This provides less precise but still useful localized content.
• Manually entered location — you may choose to manually enter a location instead of sharing device location.

Usage Information

We automatically collect certain information about how you use the application:

• Device information — device type, operating system, browser type, and version.
• Usage data — pages or features accessed, time spent on the application, navigation paths, and interaction with content.
• Log data — IP address, access times, error logs, and performance metrics.
• Cookies and similar technologies — we use essential cookies for authentication and session management. See our Cookie Policy below for details.

How We Use Your Information

We use the information we collect for the following purposes:

Legal Bases for Processing (GDPR)

For users in the European Union, United Kingdom, and other regions covered by similar regulations, we process your personal data based on the following legal grounds:

• Consent — We rely on your explicit consent for processing precise GPS location, optional profile information (age, gender, health interests), and marketing communications. You may withdraw consent at any time through app settings.
• Contract performance — We process your email address and account information to provide the services you've requested by creating an account.
• Legitimate interests — We process usage data and approximate location (via IP) for legitimate business interests, including improving our services, ensuring security, and providing localized content. These interests do not override your fundamental rights and freedoms.
• Legal obligation — We may process data when required by law, such as responding to valid legal requests or protecting rights and safety.

How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information only in the following limited circumstances:

Service Providers

We work with trusted third-party service providers who assist us in operating the application:

• Supabase — provides authentication, database, and backend infrastructure. Your email and encrypted password are stored securely on Supabase servers. Supabase Privacy Policy
• Open-Meteo — provides weather forecasting and geocoding services. We share only the coordinates needed to retrieve weather data. No personal information is shared. Open-Meteo Terms
• IP Geolocation Service — (e.g., ipapi.co) processes your IP address to provide approximate location when GPS is unavailable. This data is processed in real-time and not stored beyond the immediate request.
• Hosting Provider — (e.g., Vercel, Netlify, or Cloudflare) hosts the application and processes basic server logs including IP addresses and access times for security and performance purposes.

All service providers are contractually obligated to protect your data and use it only for the specific purposes we've authorized.

Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal processes (subpoenas, court orders)
• Government or regulatory requests
• Necessary actions to protect our rights, property, or safety, or that of our users or the public
• Investigation of potential violations of our Terms of Service

Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

Data Retention

We retain your information for as long as necessary to provide our services and fulfill the purposes described in this policy:

• Account data — retained until you delete your account. After deletion, your data is removed from active systems within 30 days, with backup copies deleted within 90 days.
• Location data — precise GPS coordinates may be cached locally on your device for convenience but are not permanently stored on our servers unless you explicitly opt in. IP-based location is processed in real-time and not retained.
• Usage logs — typically retained for 90 days for security and troubleshooting purposes, then anonymized or deleted.
• Legal holds — data may be retained longer if required by law or necessary for legal proceedings.

Your Rights and Choices

You have control over your personal information. Depending on your location, you may have the following rights:

All Users

• Access and update — view and edit your account information and preferences within the app settings.
• Delete account — request deletion of your account and associated data by contacting us or using in-app account deletion (when available).
• Opt out of communications — unsubscribe from marketing emails using the link in any email we send, or adjust preferences in your account settings.
• Location controls — manage GPS permissions through your device settings or app preferences. Disable IP-based location through Location Settings in the app.
• Cookie preferences — manage cookie settings (essential cookies required for functionality cannot be disabled).

GDPR Rights (EU/UK/EEA Users)

Under the General Data Protection Regulation, you have additional rights:

• Right to access — request a copy of all personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your data under certain circumstances.
• Right to restrict processing — limit how we use your data in certain situations.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — withdraw consent for processing at any time (without affecting prior processing).
• Right to lodge a complaint — file a complaint with your local data protection authority.

California Privacy Rights (CCPA/CPRA)

California residents have specific rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know — request disclosure of categories and specific pieces of personal information collected, sources, purposes, and third parties with whom it's shared.
• Right to delete — request deletion of personal information (subject to certain exceptions).
• Right to correct — request correction of inaccurate personal information.
• Right to opt out — we do not sell or share personal information for cross-context behavioral advertising. If this changes, we will provide an opt-out mechanism.
• Right to limit use of sensitive personal information — precise geolocation is considered sensitive. We use it only to provide features you request and do not use it for other purposes.
• Right to non-discrimination — you may exercise your privacy rights without receiving discriminatory treatment.

Other U.S. State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights to access, delete, correct, and opt out of certain processing activities.

Children's Privacy

STILLPOINT is not intended for use by children under the age of 13 (or 16 in certain jurisdictions, including the EU). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. We will take steps to delete such information from our systems.

Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption — data in transit is protected using TLS/SSL encryption. Passwords are hashed using industry-standard algorithms.
• Access controls — strict internal access policies ensure only authorized personnel can access personal data.
• Regular security assessments — we conduct ongoing security reviews and updates.
• Secure infrastructure — our service providers maintain SOC 2 Type II compliance and industry-standard security certifications.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information using commercially acceptable means, we cannot guarantee absolute security.

International Data Transfers

STILLPOINT operates globally, and your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from those in your country.

When we transfer personal data from the EU/UK/EEA to other countries, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Data Processing Agreements with service providers that meet GDPR requirements
• Adequacy decisions where applicable

Cookies and Similar Technologies

We use cookies and similar tracking technologies to maintain your session and improve your experience:

Essential Cookies

Required for authentication and core functionality. These cannot be disabled without preventing the service from working properly.

• Session cookies — keep you logged in during your visit
• Authentication tokens — verify your identity securely
• Preference cookies — remember your settings and choices

Analytics Cookies (If Enabled)

Help us understand how users interact with the application. These are aggregated and anonymized. You may opt out through app settings.

Local Storage

We use browser local storage to cache certain preferences and data (such as last known location) to improve performance. This data remains on your device and can be cleared through your browser settings.

Third-Party Links

Our application may contain links to third-party websites or services. We are not responsible for the privacy practices or content of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Updating the "Last updated" date at the top of this policy
• Posting a prominent notice within the application
• Sending an email notification (for significant changes)

Your continued use of STILLPOINT after any changes indicates your acceptance of the updated policy. We encourage you to review this policy periodically.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, our data practices, or for any other support needs please contact us:

This Privacy Policy is effective as of the date listed above and governs your use of the STILLPOINT application.