Privacy Policy

Who is responsible

Controller

To be provided

Address

To be provided

Privacy contact

[email protected]

This is the party that decides why and how your personal data is processed.

What is encrypted, and what isn't

The content of Notes, Contacts, Calendar, Photos, Drive and Mail is compressed and encrypted in your browser before it is sent to us, with a key derived from your password. We store only the encrypted result. We can't open it, and neither can anyone who gets a copy of our database or disks.

We can still see information needed to run the service:

• Drive: the folder tree, sizes and upload times of your items.
• Photos: capture dates and sizes. Duplicate detection uses a keyed tag, not the picture.
• Calendar: which month an event falls in, so we can load the right month.
• Mail: the folder, size, time and address of each message; the sender and recipient addresses are known to the mail server when mail is delivered.
• Notes and Contacts: that they exist, how many, and their sizes.

Mail is zero-access at rest: each incoming message is encrypted to a key only you hold the moment it arrives. It is not end-to-end encrypted with other providers. When someone on Gmail writes to you, or you write to them, our server handles the plaintext message for a moment to deliver or encrypt it, and the other provider handles it under its own rules.

Sign-in is not zero-knowledge: your password reaches our server over HTTPS when you sign in, and we check it against an argon2id hash. Your encryption key is derived separately in your browser and never sent to us.

If you lose your password and your encryption recovery key, your encrypted data can't be recovered by anyone, including us. That is the cost of us not being able to read it.

What we collect

• Account: your email address, display name, and a password hash (argon2id). We never store your password.
• Security: passkey public keys, your authenticator-app secret (encrypted on our server), hashes of recovery codes, and the devices you chose to trust.
• Sessions: when you sign in, a hash of your session token, the time, your IP address and browser details (user agent), so you can see and revoke your sessions.
• Security log: sign-in attempts and security changes, each with time, IP address and user agent. For failed attempts that aren't tied to an account, the email address typed is kept. This lets us rate-limit guessing and show you what happened on your account.
• Mail sending: when you send mail we record that you sent it and how many recipients, to enforce limits that stop a hijacked account being used for spam.
• Server logs: our web server logs requests, including your IP address, for 14 days. System logs for the app are kept 7 days.

We don't use analytics, advertising or tracking scripts, we don't load third-party fonts or widgets, and we don't build profiles or sell data.

Why we use it, and the legal basis

• To provide the account and services you asked for: contract.
• To keep accounts and the service secure and to stop abuse: our legitimate interest, which is also yours.
• To meet legal obligations that apply to us.

We don't use your data to decide anything about you automatically.

Cookies

We use only cookies the service needs to work. There are no consent banners because there is nothing to consent to.

__Host-sh_session

Keeps you signed in. Up to 30 days, or less if you set a shorter idle limit.

__Host-sh_2fa

Holds the sign-in step between your password and your second step. 5 minutes.

__Host-sh_device

Remembers a device you chose to trust. 30 days.

sh_theme

Remembers light or dark. A preference, not an identifier.

Your browser also keeps an encryption key for this site in its local storage, locked so scripts can't export it, so you don't retype your password on every page. It is cleared when you sign out.

Who else handles your data

• Cloudflare sits in front of the website and ends the HTTPS connection, so it can see your requests, including the password you type when you sign in. The content of your vault is already encrypted by your browser before it gets there, so Cloudflare sees it only as ciphertext.
• Our server host stores the encrypted data and runs the service. It sees only what we see: ciphertext and the metadata above.
• Other mail providers receive the mail you send to them, and send mail to you. We pass messages to their servers directly.

We don't give your data to anyone else, except where the law requires it. We can only hand over what we have: metadata and ciphertext, not your content.

How long we keep it

• Content you store: until you delete it or your account.
• Sessions: until they expire or you sign out; at most 30 days.
• Security log: while your account exists. We don't yet delete old entries automatically.
• Web server logs 14 days; app logs 7 days.
• Backups: we don't keep routine backups of user data at the moment. Deleted data is removed from live storage, and that also means we can't restore data you delete or lose. We'll update this page if that changes.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or stop how we use it, and move it to another service. You can also object to processing based on our legitimate interest.

You can manage most of this yourself: change your name and password, review and revoke sessions and trusted devices, and delete or export your own content inside each service.

There is no button to delete a whole account yet. Write to [email protected] from the account's address and we'll do it by hand and confirm. Deleting the account removes your encrypted content, mailbox and security data.

Complaints

To be provided

You have the right to complain to a data protection authority, for example where you live or work.

Children

Stillhold isn't meant for children under 16. If you think a child has an account, tell us and we'll remove it.

Changes

If we change this policy in a way that matters, we'll tell signed-in users before it applies. The date at the top shows the latest version.