Archived version · 2026-09-18

Stillowe — Privacy Policy core paragraphs

Status: 第 3 稿，§8 于 2026-09-18 按第 65–69 场重写。 §3 / §11 / §12 于 2026-09-18 按 Phase 29 推送事实重写。 §1 / §3 / §7 于 2026-09-18 校准（举报范围、四条读取路径、转发帖进入 Orb 上下文）。 §9 / §10 于 2026-09-18 补日志留存与报告去向。 Source of truth is docs/DATA_DECLARATION.md (sixth edition plus Phase 26/27 additions). Every sentence below states something the code or the database does today. If a sentence and the code disagree, the sentence is wrong and is deleted; the code is not changed to fit the sentence.

Use: these paragraphs replace the corresponding template sections of the Termly-generated policy. Do not soften them into company voice. First person plural, plain. No "may", "reasonable efforts" or "from time to time" unless the uncertainty is real.

Before publishing: re-run the recon questions in docs/legal/PRIVACY_CORE_RECON.md once more against the launch build; if any answer moved, the sentence moves.

1. Where your words live, layer by layer

Stillowe keeps different kinds of things in different places, and you should always be able to tell which place you are in.

Moments are readable on purpose. A Moment is shared with a group, not said to one person; once it is out, screenshots exist and secrecy is no longer something cryptography can give. What protects a Moment is a visibility rule enforced in the database, which can be withdrawn instantly — encryption cannot be withdrawn once a key has been handed out. Moments never feed the community feed, recommendations, tags, or your Orb.

Stranger messages are readable on purpose. That layer is where spam, advertising and harassment arrive, and we must be able to verify a report and recognise mass-mailed text. If you later become friends, your conversation moves into an encrypted chat; the original stranger messages stay as they were and are not encrypted retroactively.

Your Orb's conversations are readable on purpose. Encrypting them would kill its memory and its ability to follow you across devices. What limits the exposure is not encryption but three rules: nothing here trains a model (section 2), nothing here targets advertising (section 4), and no person reads it except through the four paths in section 7, every one of which leaves a record.

Just chat passes through our servers only long enough to obtain a reply. It has no table and no file. The only traces it leaves on our side are a cost-metering record with no text in it, and an anonymous daily tally of crisis-word matches with no account attached. One exception, stated plainly: if Just chat is used to seek child sexual content, plan violence, commit fraud, or break the law, that message is recorded together with your account. Nothing else is ever kept.

When your Orb searches the web. Your Orb can look things up. When it does, the search query it forms — not your conversation — is sent to Brave Search. We do not log the query or the results.

Posts you show your Orb. If you send a community post to your Orb, the post's title and its author's name become part of that conversation, like anything else you say to it. Not the post's body, and not its pictures.

Photos you send your Orb. They are stored in a private bucket only you and our servers can read, and the ones attached to a message are sent to the model provider so your Orb can see them. Photos in Just chat are sent the same way and stored nowhere.

Calls with your Orb. When you call your Orb, your voice streams directly from your phone to the speech-recognition provider (OpenAI). It never passes through our servers and is never written to disk anywhere we control. Only the recognised text reaches us, stored as an ordinary message in that conversation. We keep no audio; there is nothing to play back.

Three properties are separate and cannot be inferred from one another: whether we can read something, whether it is used for training, and whether it is used for advertising.

2. We do not train on anything you say

We do not have a model of our own, and nothing on Stillowe is used to train one — not community posts, not your conversations with your Orb, not chats, not Moments. There is no "help improve our service" setting, because there is nothing to switch: the setting itself would be a label stuck on you, and we do not keep labels on people.

If we ever build a model of our own, whether and how any Stillowe data could be involved would be a new decision, announced as one before it happens. This policy does not pre-authorise it.

3. Encryption, and what it costs you

Chat conversations with friends and Circle group chats are end-to-end encrypted. The keys exist only on your phone — in the app, and in one small extension of it whose only job is the lock-screen preview described in section 12. "Encrypted" here means one specific thing: we cannot read these messages, even if we wanted to, even if we were ordered to. Disk encryption at our database provider does not count — we could still read that — so we do not call it encryption in this document.

This has a real cost, and you should know it before you rely on it:

If you lose your only phone and have not moved your account to a new one, your Chat history is gone for good. We cannot recover it. All we have is ciphertext we cannot read.

Moving to a new phone is done from the old phone to the new one directly. We do not keep an encrypted backup in the cloud, on purpose: a backup we hold is a copy we could be pressed for, and we would rather there be no grey area about what we hold.

One account is active on one phone at a time. Signing in on a new phone signs the old one out; we email your account address that this happened, with the time and nothing about the place. Chat history already on the old phone stays on that phone.

This cost applies only to Chat. Your Orb's memory, your Moments, your community posts and your settings live on our servers and follow you to a new phone.

Because content is encrypted, reporting a Chat message means your phone sends us the plaintext of the message you are reporting and of up to the twenty messages before it, from both sides of the conversation, so that whoever reads the report can see what it was a reply to. That is the only way we can see any of it. What happens to that copy afterwards is in section 8.

Two limits, stated plainly. Photos and videos inside messages are not yet end-to-end encrypted; the text is. And encryption needs both phones to have registered their keys: if you message a friend who has never opened a version of Stillowe that supports encryption, or a Circle where any member has not, that message is sent and stored unencrypted, and we can read it. Messages sent before both sides had keys stay unencrypted; they are not encrypted later.

4. Advertising: what we will and will not use

Stillowe shows no ads today, and there is no third-party ad network or analytics script in the app. We write this section now so it is already a promise when there are ads.

When we do show ads, the system will be our own: an advertiser submits a creative, we review it, we store it, our server decides where it appears, and your phone displays an image. No outside code runs in the app.

The only signals that will ever decide which ad you see are community-layer signals: the tags you engage with, your public interactions (likes, saves, comments) and who you follow.

The following will never be used for advertising, and the advertising system is denied access to them at the database-permission level, not by promise alone: your conversations with your Orb; your Chat (which is encrypted anyway); messages from strangers; your Moments, comments, likes, relationship settings and the names you give your friends; your browsing history (which never leaves your phone); and Just chat (which does not exist).

What we sell is "appearing in the context of an interest", not "who you are".

5. The notes you keep about other people are yours

The name you give a friend, the people you have blocked, the people you have stopped requests from, and the per-friend settings you choose are records of how you see a relationship. They belong to you, the person who wrote them — not to the person they describe.

Three consequences follow. We state them plainly because they are a judgement we made, not a legal accident:

1. When you export your data, it includes everything you wrote about others.
2. When you export your data, it does not include anything others wrote about you: not the name a friend calls you, not who has blocked you, not who has stopped your requests. Those are their records.
3. When you delete your account, everything you wrote about others is deleted with it.

Nobody can see what you have written about them. This is enforced in the database — the other person's account has no permission to the row — not merely hidden in the interface.

Blocking someone removes their ability to reach you. It does not delete your chat history with them, and it does not delete the name you gave them. If someone defrauded you and the record vanished, you could not even report it.

6. What we never collect

We keep no read receipts, "seen by" lists, recent-visitor lists, or any record of who looked at what. We do count how many times a post was opened — an anonymous tally with no record of who — and show that number only to the post's author. This is not a display choice; the data is not collected. A record of who looked, even one visible only to you, changes how people behave.

Your Today watch history stays on your phone and is never sent to us.

Photos are re-encoded before upload at every entry point so that camera metadata (including location) is stripped; if stripping fails, the photo is not sent. Videos posted to the community are re-encoded on your phone with metadata tracks removed.

7. When a person at Stillowe can read your Orb conversation

Your conversations with your Orb are readable by our systems. A person can read them in exactly four situations, and each of the last three writes an access-log entry — which cannot be edited or deleted — before a single word is shown:

1. You hand them over. When you report something or send feedback and attach a conversation excerpt, the excerpt you attached is read by a person.
2. A crisis flag. If a message you send to your Orb matches signs that you may be at risk of harming yourself, it is flagged automatically. A person can open it only through a path that logs the access first and then returns the flagged message with a bounded amount of surrounding context. The purpose is to check whether your Orb responded well and to improve how it responds — not real-time intervention. The flag records which conversation and when, not the words; it is attached to a moment, not to you; it is hard-deleted after thirty days; and it never becomes a label on your account and never affects recommendations, feeds or advertising.
3. An abuse flag. If a message to your Orb seeks child sexual content, plans violence against someone, attempts fraud, or breaks the law, it is flagged together with your account and the message that triggered it, and reviewed by a person under the rules published at [link: rules]. This is the one kind of flag that attaches to you. If the reviewer confirms it, it ends posting on your account permanently and, where the law requires, leads to a report; the triggering message is kept for one year, then blanked. If the reviewer finds the flag was wrong, the message is blanked on the spot and the flag records only that a false alarm happened.
4. A legal hold. Material we may be required to preserve is copied into a locked store, as described in section 8, and can be read by a person only through the same logged path.

There is no fifth path. We do not sample conversations, spot-check them, or read them "to see how the product is being used".

Just chat is screened for crisis signs so that a request for help is never blocked by a daily limit, but it is never crisis-flagged and never stored. The abuse rule is the one exception, stated in section 1: a Just chat message that seeks child sexual content, plans violence, attempts fraud, or breaks the law is recorded with your account and handled under path 3.

8. Deletion, and how long things linger

Messages. Deleting a message deletes your copy from our servers — a real delete, not a hidden flag. The other person's copy remains theirs: a conversation is a shared record, and nobody owns the other person's memory of it. Unsending is possible for two minutes after sending — the limit is enforced by our server, not by your phone — and always leaves a visible "message was unsent" marker on both sides.

Moments. Deleting a Moment deletes it, its comments, its likes and its media files. Moments and comments cannot be edited. Choosing "last 3 days" visibility hides older Moments from others but does not delete them; switching back restores them instantly.

Orb memory. Deleting something your Orb remembers deletes it from our servers.

Your account. When you ask to delete your account, we mark it for deletion and sign you out everywhere. For seven days you can sign back in and choose to keep it — the request may not have come from you. After seven days an automated process removes your data: first your records, then your media files, then the account itself. Copies in our database backups are cleared as those backups rotate, within a further seven days. Uploaded media files are not in those backups and are unrecoverable as soon as they are deleted.

What outlives your account, and for how long. Five things do, and we would rather list them than let you find out:

• Report evidence. When someone reports a message, the report carries a copy of that message and up to the twenty messages before it — from both sides of the conversation — with any attachments, so that we can judge it. That copy belongs to the report, not to the conversation: deleting a message, or either account, does not delete it. We delete it ninety days after the report is handled, and no later than one hundred and eighty days after it was filed, whether or not anyone got to it.
• Legal holds. Material we may be required to preserve — child sexual abuse material, or a credible, specific threat to a person — is copied into a separate locked store together with the account details. Within ninety days we either report it or release it; a released hold is deleted the next day. If we report it, we keep the copy for one year from the report, and longer only if law enforcement asks.
• Abuse findings. Our abuse filter may flag a message in an Orb conversation. If a person then confirms the finding — the kind that ends posting permanently — we keep the message that triggered it for one year, then blank it. If the flag turns out to be wrong, the message is blanked the moment we say so. The finding itself, which records only what kind and when, stays.
• Your request to join. If you asked to come in through the door, we keep the email address and the note you wrote. If we let you in, that record is deleted with your account. If we did not, or never decided, we delete the address and the note after thirty days (ninety days for a request left undecided) and keep only the fact that a request existed.
• Moderation records. If we ever removed something of yours, restricted your account, or decided on a hold or a request, the record of what we did, under which rule, when, and to which item stays after your account is gone. It is a record of decisions. Until September 2026 it also carried copies of the content involved; we have removed those and it no longer does.

Safety markers. When our systems flag an Orb conversation for a crisis review, the flag records which conversation and when — not the words — and is deleted after thirty days, or with your account, whichever comes first.

Push notifications. Your phone's notification token is stored while you are signed in. We remove it when you sign out; if your phone was offline at that moment, it is removed when Apple next tells us the token is dead, or when your account is deleted. Our record of each notification, sent or not, including its text, is kept for seven days, then cleared.

9. Where your data is, and where we are

Your data is stored in the United States (Virginia, AWS us-east-1, via Supabase). Production traffic never passes through China: your phone connects to servers in the United States, which connect to our database in the United States, which call our model providers from the United States.

Our server logs — who connected, from which IP address, to which path, and what went wrong — are kept by Vercel in the United States for thirty days and then gone. Since September 2026 they carry no account identifiers: an IP and a path, not a name or an ID. Database logs at Supabase follow the same country and a shorter default.

The company that runs Stillowe, nullova LLC, is registered in Wyoming. The people who operate it live and work in mainland China. In practice this means development, deployment and administrative access to our systems happen from mainland China.

We tell you this because you have a right to know it and to decide accordingly, not because a form required it. Our technical answer to it is the encryption in section 3: for your Chat, it does not matter where we are, because ciphertext is ciphertext. For everything else, what protects you is the set of rules in this policy — no training, no targeting, and no reading except as in section 7 — and those are promises, not cryptography.

10. Legal requests

If we are legally compelled to hand over data, this is what we are able to hand over, layer by layer:

• Chat (friends and Circles): metadata and ciphertext only. Who spoke to whom, and when, we know. What was said, we do not, and cannot produce.
• Messages from strangers: readable. Who, when and what — we can produce all of it, and will if lawfully required.
• Moments, comments, likes, relationship settings and the names you give friends: readable; the same.
• Your conversations with your Orb, and community content: readable; the same.

We list the whole picture because listing half of it would be selective honesty.

Where the law requires us to report, we report: child sexual abuse material to the National Center for Missing and Exploited Children, and a credible, specific and imminent threat to another person to the relevant authorities. A report carries the account, the material and its immediate context. We record that we did it, and we keep the reported copy for one year, as section 8 describes. We do not report anything else, and we do not report on request without legal process.

11. Who else touches your data

We run no third-party analytics and no ad network. The processors we cannot avoid, and what each one sees:

The subscription records we keep are limited to the transaction and product identifiers, environment, dates and status needed to honour your subscription; we do not store the raw signed receipt.

If we change a model provider, this table changes the same day.

12. Notifications on your phone

Push notifications travel through Apple. To send one, we keep your phone's notification token (section 8 says for how long) and hand each notification to Apple's push service, which delivers it. What Apple sees is whatever is inside the notification, so here is what we put inside:

• Chat. For a message from a friend: who sent it, when, a link to their picture, and — if the message is short enough — its encrypted text. Apple sees ciphertext, not words; your phone decrypts it on the lock screen (below). For a Circle message: the Circle and the sender, never the text. Friends you have muted do not notify.
• Strangers. The name and the fact that they wrote. Never the message.
• Comments and mentions. The first 120 characters of the comment. It is visible to everyone inside Stillowe anyway.
• Your Orb. Your Orb's name, that it replied, and where. Never what it said.

Put plainly: encryption keeps the words of a Chat from Apple, not the fact of it. Apple's push service sees who messaged whom and when, the same way we do.

The lock-screen preview. To show you the first line of a friend's message without opening the app, a small extension of Stillowe decrypts it on your phone with the same keys the app holds, from a keychain that opens after your first unlock. It shows at most 140 characters and keeps nothing — no cache, no file, no change to your keys. It does tell iOS who the conversation is with, so the notification can carry their picture; iOS may use that for its own suggestions, on your phone. What iOS itself retains of a notification it has shown is Apple's to say, not ours.

Turning them off. There are two switches, and they do different things. The one in iOS settings stops your phone from showing anything. The ones in Stillowe — Chat, Today, Orb — stop our server from queueing that kind at all, so nothing is handed to Apple in the first place. A notification already queued when you flip a switch may still go out.