Archived version · 2026-10-15

PRIVACY POLICY

Last updated October 15, 2026

This Privacy Notice for nullova LLC ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://stillowe.com or any website of ours that links to this Privacy Notice

• Download and use our mobile application (Stillowe), or any other application of ours that links to this Privacy Notice

• Use Stillowe. Stillowe is a social app for iPhone. It has a public feed where members share posts, an AI companion called Orb that members can talk to, and private chat between friends. Private chat is end-to-end encrypted; we cannot read it.

• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at ops@stillowe.com.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions, for example your racial or ethnic origins, sexual orientation, and religious beliefs. We do not process sensitive personal information.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by visiting mailto:ops@stillowe.com, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. Where your words live, layer by layer
3. The notes you keep about other people are yours
4. What we never collect
5. Notifications on your phone
6. HOW DO WE PROCESS YOUR INFORMATION?
7. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
8. Legal requests
9. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
10. Advertising: what we will and will not use
11. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
12. HOW DO WE HANDLE YOUR SOCIAL LOGINS?
13. HOW LONG DO WE KEEP YOUR INFORMATION?
14. HOW DO WE KEEP YOUR INFORMATION SAFE?
15. Where your data is, and where we are
16. DO WE COLLECT INFORMATION FROM MINORS?
17. WHAT ARE YOUR PRIVACY RIGHTS?
18. CONTROLS FOR DO-NOT-TRACK FEATURES
19. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
20. DO WE MAKE UPDATES TO THIS NOTICE?
21. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
22. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• names

• email addresses

• usernames

• contact or authentication data

• profile photos and bios

• posts, photos and videos you publish

• voice audio you record for dictation or orb calls

Sensitive Information. We do not process sensitive information.

Payment Data. All payment data is handled and stored by Apple In-App Purchase. You may find their privacy notice link(s) here: https://www.apple.com/legal/privacy/.

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Facebook, X, or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called "HOW DO WE HANDLE YOUR SOCIAL LOGINS?" below.

Application Data. If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:

• Mobile Device Access. We may request access or permission to certain features from your mobile device, including your mobile device's microphone, camera, storage, face id (on-device only; we never receive biometric data), and other features. If you wish to change our access or permissions, you may do so in your device's settings.

• Mobile Device Data. We automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information and system configuration information, device and application identification numbers, browser type and version, hardware model Internet service provider and/or mobile carrier, and Internet Protocol (IP) address (or proxy server). If you are using our application(s), we may also collect information about the phone network associated with your mobile device, your mobile device’s operating system or platform, the type of mobile device you use, your mobile device’s unique device ID, and information about the features of our application(s) you accessed.

• Push Notifications. We may request to send you push notifications regarding your account or certain features of the application(s). If you wish to opt out from receiving these types of communications, you may turn them off in your device's settings.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. You can find out more about this in our Cookie Notice: https://stillowe.com/cookies.

The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).

• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.

Google API

Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

2. Where your words live, layer by layer

Stillowe keeps different kinds of things in different places, and you should always be able to tell which place you are in.

Moments are readable on purpose. A Moment is shared with a group, not said to one person; once it is out, screenshots exist and secrecy is no longer something cryptography can give. What protects a Moment is a visibility rule enforced in the database, which can be withdrawn instantly — encryption cannot be withdrawn once a key has been handed out. Moments never feed the community feed, recommendations, tags, or your Orb.

Stranger messages are readable on purpose. That layer is where spam, advertising and harassment arrive, and we must be able to verify a report and recognise mass-mailed text. If you later become friends, your conversation moves into an encrypted chat; the original stranger messages stay as they were and are not encrypted retroactively.

Your Orb's conversations are readable on purpose. Encrypting them would kill its memory and its ability to follow you across devices. What limits the exposure is not encryption but three rules: nothing here trains a model (section 11), nothing here targets advertising (section 10), and no person reads it except through the four paths in section 11, every one of which leaves a record.

Just chat passes through our servers only long enough to obtain a reply. It has no table and no file. The only traces it leaves on our side are a cost-metering record with no text in it, and an anonymous daily tally of crisis-word matches with no account attached. One exception, stated plainly: if Just chat is used to seek child sexual content, plan violence, commit fraud, or break the law, that message is recorded together with your account. Nothing else is ever kept.

When your Orb searches the web. Your Orb can look things up. When it does, the search query it forms — not your conversation — is sent to Brave Search. We do not log the query or the results.

Posts you show your Orb. If you open a conversation from a community post or forward one to your Orb, its title, author's name, up to 4,000 characters of its text, and a description of its media become part of the context sent to the model provider. This can be your post or someone else's post you can see. This path sends a description of the media, not the post's photos or video files themselves.

Photos you send your Orb. They are stored in a private bucket only you and our servers can read, and the ones attached to a message are sent to the model provider so your Orb can see them. Photos in Just chat are sent the same way and stored nowhere.

Calls with your Orb. When you call your Orb, your voice streams directly from your phone to OpenAI for speech recognition. It never passes through our servers and is never written to disk anywhere we control. The transcript reaches our servers; we use Anthropic for transcript correction and for your Orb's replies. In a saved conversation, the resulting text is stored as an ordinary message. Just chat keeps no conversation history. We keep no audio; there is nothing to play back.

Dictation in the input box. This uses Apple's speech recognizer, separately from an Orb call. The app requires recognition on your phone when the chosen recognizer supports it. Otherwise Apple may process the audio on its servers. The recognised words enter the input box; this dictation path does not send them to Anthropic for correction.

Three properties are separate and cannot be inferred from one another: whether we can read something, whether it is used for training, and whether it is used for advertising.

3. The notes you keep about other people are yours

The name you give a friend, the people you have blocked, the people you have stopped requests from, and the per-friend settings you choose are records of how you see a relationship. They belong to you, the person who wrote them — not to the person they describe.

Three consequences follow. We state them plainly because they are a judgement we made, not a legal accident:

1. When you export your data, it includes everything you wrote about others.
2. When you export your data, it does not include anything others wrote about you: not the name a friend calls you, not who has blocked you, not who has stopped your requests. Those are their records.
3. When you delete your account, everything you wrote about others is deleted with it.

Nobody can see what you have written about them. This is enforced in the database — the other person's account has no permission to the row — not merely hidden in the interface.

Blocking someone removes their ability to reach you. It does not delete your chat history with them, and it does not delete the name you gave them. If someone defrauded you and the record vanished, you could not even report it.

4. What we never collect

We do not show other members read receipts, "seen by" lists or recent-visitor lists. We keep per-account conversation read timestamps for friend chats, Circles and stranger conversations so that we can track your unread messages. These are unread-tracking records, not a public list of readers. We also count how many times a post was opened — an anonymous tally with no record of who — and show that number only to the post's author.

Your Today watch history stays on your phone and is never sent to us.

Photos are re-encoded before upload at every entry point so that camera metadata (including location) is stripped; if stripping fails, the photo is not sent. Videos posted to the community are re-encoded on your phone with metadata tracks removed.

5. Notifications on your phone

Push notifications travel through Apple. To send one, we keep your phone's notification token (section 13 says for how long) and hand each notification to Apple's push service, which delivers it. What Apple sees is whatever is inside the notification, so here is what we put inside:

• Chat. For a message from a friend: who sent it, when, a link to their picture, and — if the message is short enough — its encrypted text. Apple receives ciphertext; your phone can decrypt it on-device so the friend's first line may show on your lock screen (below). For a Circle message: the Circle and the sender, never the text. Friends you have muted do not notify; a muted Circle can still notify when you are mentioned.
• Strangers. The name and the fact that they wrote. Never the message. The first message can notify; once you have replied, later messages can notify too.
• Comments, mentions and responses. A comment or reply notification can include the first 120 characters of the comment. Post mentions and responses say who mentioned you or responded to your post, without the post's body. Some of these notifications are grouped into a digest after a quiet spell. Comments remain subject to the post's visibility, blocking and removal rules; they are not visible to everyone.
• Requests and invitations. A friend request or its acceptance says who sent or accepted it; a Circle invitation says who invited you and names the Circle. It does not include a private message.
• Your Orb. Your Orb's name, that it replied, and where. Never what it said.

Likes, saves and follows never push. They appear only inside the app.

Put plainly: encryption keeps the words of a Chat from Apple, not the fact of it. Apple's push service sees who messaged whom and when, the same way we do.

The lock-screen preview. To show you the first line of a friend's message without opening the app, a small extension of Stillowe decrypts it on your phone using the app's keys from a shared local store that becomes available after your first unlock. It shows at most 140 characters and keeps nothing — no cache, no file, no change to your keys. It may download the sender's picture for this preview. It does tell iOS who the conversation is with, so the notification can carry their picture; iOS may use that for its own suggestions, on your phone. What iOS itself retains of a notification it has shown is Apple's to say, not ours.

Turning them off. There are two switches, and they do different things. The one in iOS settings stops your phone from showing anything. The ones in Stillowe — Chat, Today, Orb — stop our server from queueing that kind at all, so nothing is handed to Apple in the first place. A notification already queued when you flip a switch may still go out.

6. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.

• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.

• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.

• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.

• To fulfill and manage your orders. We may process your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services.

• To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user.

• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.

• To comply with our legal obligations. We may process your information to comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.

• To run Orb, the AI companion. Orb reads what you say to it in order to reply, and keeps a memory of your conversations with it so it can carry them forward. That memory is yours: you can see it, edit it and delete it.

• To translate posts. Public posts are translated into the language you read. Private chat is never translated by us because we cannot read it.

7. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We run no third-party analytics and no ad network. The processors we cannot avoid, and what each one sees:

Apple and Google sign-in. If you choose either on your phone, we receive your email address, or an Apple relay address if you choose Hide My Email, and store it as your account email. Apple can also send your name on your first sign-in; the app does not save that name. Supabase is the session we use, and the app adds no separate store for provider access tokens.

Google's temporary credential: the Google SDK briefly stores the Google credential in the device Keychain during sign-in; we clear it immediately and never use it as a session. If the app stops before that cleanup finishes, the credential remains until the native sign-in plugin next loads and clears it.

The subscription records we keep are limited to the transaction and product identifiers, environment, dates and status needed to honour your subscription; we do not store the raw signed receipt.

If we change a model provider, this table changes the same day.

8. Legal requests

If we are legally compelled to hand over data, this is what we are able to hand over, layer by layer:

• Chat (friends and Circles): metadata and ciphertext only. Who spoke to whom, and when, we know. What was said, we do not, and cannot produce.
• Messages from strangers: readable. Who, when and what — we can produce all of it, and will if lawfully required.
• Moments, comments, likes, relationship settings and the names you give friends: readable; the same.
• Your conversations with your Orb, and community content: readable; the same.

We list the whole picture because listing half of it would be selective honesty.

Where the law requires us to report, we report: child sexual abuse material to the National Center for Missing and Exploited Children, and a credible, specific and imminent threat to another person to the relevant authorities. A report carries the account, the material and its immediate context. We record that we did it, and we keep the reported copy for one year, as section 13 describes. We do not report anything else, and we do not report on request without legal process.

9. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice: https://stillowe.com/cookies.

10. Advertising: what we will and will not use

Stillowe shows no ads today, and there is no third-party ad network or analytics script in the app. We write this section now so it is already a promise when there are ads.

When we do show ads, the system will be our own: an advertiser submits a creative, we review it, we store it, our server decides where it appears, and your phone displays an image. No outside code runs in the app.

The only signals that will ever decide which ad you see are community-layer signals: the tags you engage with, your public interactions (likes, saves, comments) and who you follow.

The following will never be used for advertising, and the advertising system is denied access to them at the database-permission level, not by promise alone: your conversations with your Orb; your Chat (which is encrypted anyway); messages from strangers; your Moments, comments, likes, relationship settings and the names you give your friends; your browsing history (which never leaves your phone); and Just chat (which does not exist).

What we sell is "appearing in the context of an interest", not "who you are".

11. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

We do not have a model of our own, and nothing on Stillowe is used to train one — not community posts, not your conversations with your Orb, not chats, not Moments. There is no "help improve our service" setting, because there is nothing to switch: the setting itself would be a label stuck on you, and we do not keep labels on people.

Anthropic, our model provider, is contractually barred from training models on the content we send it under its Commercial Terms of Service.

If we ever build a model of our own, whether and how any Stillowe data could be involved would be a new decision, announced as one before it happens. This policy does not pre-authorise it.

Your conversations with your Orb are readable by our systems. A person can read them in exactly four situations, and each of the last three writes an access-log entry — which cannot be edited or deleted — before a single word is shown:

1. You hand them over. When you report something or send feedback and attach a conversation excerpt, the excerpt you attached is read by a person.
2. A crisis flag. If a message you send to your Orb matches signs that you may be at risk of harming yourself, it is flagged automatically. A person can open it only through a path that logs the access first and then returns the flagged message with a bounded amount of surrounding context. The purpose is to check whether your Orb responded well and to improve how it responds — not real-time intervention. The flag records which conversation and when, not the words; it is attached to a moment, not to you; it is hard-deleted after thirty days; and it never becomes a label on your account and never affects recommendations, feeds or advertising.
3. An abuse flag. If a message to your Orb seeks child sexual content, plans violence against someone, attempts fraud, or breaks the law, it is flagged together with your account and the message that triggered it, and reviewed by a person under the rules published at rules. This is the one kind of flag that attaches to you. If the reviewer confirms it, it ends posting on your account permanently and, where the law requires, leads to a report; the triggering message is kept for one year, then blanked. If the reviewer finds the flag was wrong, the message is blanked on the spot and the flag records only that a false alarm happened.
4. A legal hold. Material we may be required to preserve is copied into a locked store, as described in section 13, and can be read by a person only through the same logged path.

There is no fifth path. We do not sample conversations, spot-check them, or read them "to see how the product is being used".

Just chat messages that reach our server and match its crisis screening are exempt from personal conversation allowances. Just chat is never crisis-flagged or stored for crisis review. The abuse rule is the one exception, stated in section 2: a Just chat message that seeks child sexual content, plans violence, attempts fraud, or breaks the law is recorded with your account and handled under path 3.

Anthropic receives your Orb conversation text for replies, memory, dreams and related text work, and attached photos for replies in text conversations. Community post text can reach it when you show a post to your Orb and for translation, even if you never speak to your Orb; Desk assistance also uses community post text and comments. Voice during an Orb call goes to OpenAI for recognition; input-box dictation uses Apple, as described in section 2. You can delete Orb's memory of you at any time inside the app.

12. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details (like your Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name, email address, friends list, and profile picture, as well as other information you choose to make public on such a social media platform.

We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information, and how you can set your privacy preferences on their sites and apps.

13. HOW LONG DO WE KEEP YOUR INFORMATION?

Messages. Deleting a message removes it from the history your account can read on our servers. The shared server row can remain for the other person; a direct message's row is deleted when both people have deleted it. The other person's local copy remains theirs: a conversation is a shared record, and nobody owns the other person's memory of it. Unsending is possible for two minutes after sending — the limit is enforced by our server, not by your phone — and always leaves a visible "message was unsent" marker on both sides.

• Automatic message recovery. Eligible encrypted friend messages have an additional ciphertext copy and both phones' public-key bundles for a seven-day recovery window. Recovery request and response payloads are encrypted; we cannot read their message content. Public keys and routing and recovery-status metadata remain readable by our servers. Recovery ends at seven days and expired records are deleted by the daily cleanup, not at the exact instant of expiry. Deleting or unsending the message, clearing or removing the conversation, unfriending, blocking, or changing either phone's registered key bundle revokes recovery immediately; already delivered copies cannot be recalled.

Moments. Deleting a Moment deletes it, its comments, its likes and its media files. Moments and comments cannot be edited. Choosing "last 3 days" visibility hides older Moments from others but does not delete them; switching back restores them instantly.

Orb memory. Deleting something your Orb remembers deletes it from our servers.

Your account. When you ask to delete your account, we mark it for deletion and sign you out everywhere. For seven days you can sign back in and choose to keep it — the request may not have come from you. After seven days an automated process removes your data: first your records, then your media files, then the account itself. Copies in our database backups are cleared as those backups rotate, within a further seven days. Uploaded media files are not in those backups and are unrecoverable as soon as they are deleted.

What outlives your account, and for how long. Five things do, and we would rather list them than let you find out:

• Report evidence. A friend, Circle or stranger-message report carries up to the last twenty eligible messages displayed on the reporting phone, with senders, text and times; the window is not anchored on the reported message. Original message attachments are not copied automatically. A post report carries its title, up to 500 characters of its body, its image count and time; a comment report carries the comment text, author and post identifiers, and time. Screenshots the reporter chooses to attach are included. That evidence belongs to the report, not to the conversation or post: deleting the source, or either account, does not delete it. We delete it ninety days after the report is handled, and no later than one hundred and eighty days after it was filed, whether or not anyone got to it.
• Legal holds. Material we may be required to preserve — child sexual abuse material, or a credible, specific threat to a person — is copied into a separate locked store together with the account details. Within ninety days we either report it or release it; a released hold is deleted the next day. If we report it, we keep the copy for one year from the report, and longer only if law enforcement asks.
• Abuse findings. Our abuse filter may flag a message in an Orb conversation. If a person then confirms the finding — the kind that ends posting permanently — we keep the message that triggered it for one year, then blank it. If the flag turns out to be wrong, the message is blanked the moment we say so. The finding itself, which records only what kind and when, stays.
• Your request to join. If you asked to come in through the door, we keep the email address and the note you wrote. If we let you in, that record is deleted with your account. If we did not, or never decided, we delete the address and the note after thirty days (ninety days for a request left undecided) and keep only the fact that a request existed.
• Moderation records. If we ever removed something of yours, restricted your account, or decided on a hold or a request, the record of what we did, under which rule, when, and to which item stays after your account is gone. It is a record of decisions. Until September 2026 it also carried copies of the content involved; we have removed those and it no longer does.

Safety markers. When our systems flag an Orb conversation for a crisis review, the flag records which conversation and when — not the words — and is deleted after thirty days, or with your account, whichever comes first.

Push notifications. Your phone's notification token is stored while you are signed in. We remove it when you sign out; if your phone was offline at that moment, it is removed when Apple next tells us the token is dead, or when your account is deleted. Our record of each notification, sent or not, including its text, is kept for seven days, then cleared.

14. HOW DO WE KEEP YOUR INFORMATION SAFE?

Chat conversations with friends and Circle group chats are end-to-end encrypted. The keys exist only on your phone — in the app, and in one small extension of it whose only job is the lock-screen preview described in section 5. "Encrypted" here means one specific thing: we cannot read these messages, even if we wanted to, even if we were ordered to. Disk encryption at our database provider does not count — we could still read that — so we do not call it encryption in this document.

This has a real cost, and you should know it before you rely on it:

If you lose your only phone, we cannot restore the encrypted Chat history it could read to a new phone. Our server copy is ciphertext we cannot read.

Moving your Chat history to a new phone is not supported yet. A new phone cannot restore the keys needed to read earlier encrypted messages. Old message rows can still appear as unreadable messages; the old phone keeps its local copy. We do not keep a cloud backup that can restore your encrypted Chat history to a new phone.

One account is active on one phone at a time. Signing in on a new phone signs the old one out; we email your account address that this happened, with the time and nothing about the place. Chat history already on the old phone stays on that phone.

This cost applies only to Chat. Your Orb's memory, your Moments, your community posts and your settings live on our servers and follow you to a new phone.

Because content is encrypted, reporting a Chat message sends us a snapshot from your phone: up to the last twenty eligible messages currently displayed in that conversation, from both sides, with their senders, text and times. This window is not anchored on the message you reported. Original message attachments are not copied automatically; screenshots you choose to attach are included. That is how a report lets us read the messages in that snapshot. What happens to that copy afterwards is in section 13.

Two limits, stated plainly. Photos and videos inside messages are not yet end-to-end encrypted; the text is. And encryption needs both phones to have registered their keys: if you message a friend who has never opened a version of Stillowe that supports encryption, or a Circle where any member has not, that message is sent and stored unencrypted, and we can read it. Messages sent before both sides had keys stay unencrypted; they are not encrypted later.

Automatic message recovery. For eligible encrypted messages between friends sent with recovery credentials, we keep an additional copy of the ciphertext and both phones' public-key bundles for a seven-day recovery window, so a message the receiving phone could not decrypt can be re-sent automatically. Recovery request and response payloads are encrypted; we cannot read their message content. Public keys and routing and recovery-status metadata are readable by our servers. Recovery is limited to the same device identities, not a replacement phone. Recovery stops at seven days; expired recovery records are removed by the daily cleanup, rather than at the exact instant the window ends. Deleting or unsending the message, clearing or removing the conversation, unfriending, blocking, or changing either phone's registered key bundle ends recovery immediately. This cannot recall a copy already delivered.

15. Where your data is, and where we are

Your data is stored in the United States (Virginia, AWS us-east-1, via Supabase). Production traffic never passes through China: your phone connects to servers in the United States, which connect to our database in the United States, which call our model providers from the United States.

Our server logs — who connected, from which IP address, to which path, and what went wrong — are kept by Vercel in the United States for thirty days and then gone. Since September 2026 they carry no account identifiers: an IP and a path, not a name or an ID. Database logs at Supabase follow the same country and a shorter default.

The company that runs Stillowe, nullova LLC, is registered in Wyoming. The people who operate it live and work in mainland China. In practice this means development, deployment and administrative access to our systems happen from mainland China.

We tell you this because you have a right to know it and to decide accordingly, not because a form required it. Our technical answer to it is the encryption in section 14: for your Chat, it does not matter where we are, because ciphertext is ciphertext. For everything else, what protects you is the set of rules in this policy — no training, no targeting, and no reading except as in section 11 — and those are promises, not cryptography.

16. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at ops@stillowe.com.

17. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account.

• Contact us using the contact information provided.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

Cookies and similar technologies: Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services. For further information, please see our Cookie Notice: https://stillowe.com/cookies.

If you have questions or comments about your privacy rights, you may email us at ops@stillowe.com.

18. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

19. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.

Categories of Personal Information We Collect

The table below shows the categories of personal information we have collected in the past twelve (12) months. The table includes illustrative examples of each category and does not reflect the personal information we collect from you. For a comprehensive inventory of all personal information we process, please refer to the section "WHAT INFORMATION DO WE COLLECT?"

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels;

• Participation in customer surveys or contests; and

• Facilitation in the delivery of our Services and to respond to your inquiries.

We will use and retain the collected personal information as needed to provide the Services or for:

• Category A - As long as the user has an account with us

• Category B - As long as the user has an account with us

• Category D - As long as the user has an account with us

• Category F - As long as the user has an account with us

• Category H - As long as the user has an account with us

Sources of Personal Information

Learn more about the sources of personal information we collect in "WHAT INFORMATION DO WE COLLECT?"

How We Use and Share Personal Information

Learn more about how we use your personal information in the section, "HOW DO WE PROCESS YOUR INFORMATION?"

Will your information be shared with anyone else?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information to in the section, "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months:

• Category A. Identifiers

• Category B. Personal information as defined in the California Customer Records law

• Category D. Commercial information

• Category F. Internet or other electronic network activity information

• Category H. Audio, electronic, visual, and similar information

The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found under "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"

Your Rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data

• Right to access your personal data

• Right to correct inaccuracies in your personal data

• Right to request the deletion of your personal data

• Right to obtain a copy of the personal data you previously shared with us

• Right to non-discrimination for exercising your rights

• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)

• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)

• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)

• Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)

• Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)

• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)

• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)

How to Exercise Your Rights

To exercise these rights, you can contact us by visiting mailto:ops@stillowe.com, by emailing us at ops@stillowe.com, By mail: nullova LLC, 8330 Rush St, Rosemead, CA 91770, or by referring to the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at ops@stillowe.com. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" Law

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"

20. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

21. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at ops@stillowe.com or contact us by post at:

nullova LLC

8330 Rush St

Rosemead, CA 91770

United States

22. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please visit: mailto:ops@stillowe.com.

This Privacy Policy was created using Termly's Privacy Policy Generator