StillMind | Meditation Journal

This Privacy Policy explains how StillMind | Meditation Journal ("StillMind", operated by Prioritised OÜ, Reg. no: 16530243, VAT ID: EE102588297, registered address: Sepapaja tn 6, 15551 Tallinn, Harju County, Estonia) collects, uses, discloses, and protects your information when you use our mobile application, website, and meditation-journal services (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

1. Information We Collect

1.1 Personal Information

Account Information: Email address, username, and encrypted password

Contact Information: Name and email address (if provided)

Payment Information: StillMind does not process or store payment-card or bank details. All purchases are handled through Apple App Store or Google Play Billing. We receive only transaction identifiers and subscription status.

1.2 Usage and Technical Information

Device Information: Device type, operating system, browser type, device identifiers, and IP address

Usage Data: Features used, time spent, screens viewed, interactions, preferences, and settings

Performance Data: Crash reports, error logs, performance metrics (via Firebase Crashlytics)

Location Data: StillMind does not request or collect precise location. Our analytics providers may derive coarse city- or country-level region from IP addresses to generate aggregated statistics.

1.3 Meditation & Mood Data

Our Service allows you to log mindfulness sessions, reflections, mood ratings, goals, and related progress ("Meditation & Mood Data"). We do not collect sensitive medical or biometric health data.

1.4 AI Insights

With your explicit opt-in, we process your Meditation & Mood Data using cloud-hosted large-language-model (LLM) services to surface personalised recommendations and patterns ("AI Insights"). Journal content is encrypted in transit and at rest. You can disable AI processing at any time under Settings → Privacy → AI Insights.

2. How We Use Your Information

2.1 Service Provision

• Provide, maintain, and improve the Service
• Personalise your experience and surface AI Insights
• Process payments via App Store / Play Store and manage your subscription status
• Send important service notifications

2.2 Communication

• Respond to inquiries and provide customer support
• Send marketing communications (with your prior consent)
• Notify you about new features, updates, or beta opportunities
• Send administrative messages and policy updates

2.3 Analytics and Improvement

• Analyse aggregated usage patterns to improve user experience
• Conduct research and development for new features
• Monitor and prevent fraud, abuse, and security threats
• Generate aggregated, anonymised statistics

2.4 Legal Compliance

• Comply with applicable laws and regulations
• Enforce our Terms of Service and other agreements
• Protect our rights, property, and safety
• Respond to legal requests and prevent harm

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your personal data on the following legal grounds:

• Consent: When you explicitly agree to the processing (e.g., enabling AI Insights or receiving marketing emails)
• Contract Performance: To deliver the Service you requested and fulfil our contractual obligations
• Legitimate Interest: To improve the Service, ensure security, and prevent fraud (without overriding your rights and freedoms)
• Legal Obligation: To comply with applicable laws and regulations
• Vital Interests: To protect your health and safety in emergency situations

4. Information Sharing and Disclosure

4.1 Service Providers

We share your information only with trusted third-party service providers who assist us in operating our Service:

• Firebase (Google Cloud Platform): Hosting, databases, authentication, and crash/performance analytics
• Mixpanel: In-app analytics and event tracking
• OpenAI ChatGPT API: Generation of AI Insights (content is used solely to provide requested functionality and is not retained by OpenAI for model training)

4.2 Legal Requirements

We may disclose your information if required to:

• Comply with valid legal requests (e.g., subpoenas, court orders, government investigations)
• Address emergencies involving public safety
• Enforce our Terms of Service or other agreements
• Protect our rights, property, or safety

4.3 Business Transfers

If StillMind is involved in a merger, acquisition, reorganisation, or sale of assets, your information may be transferred as part of that transaction. You will be notified of any change in control or use of your personal data.

4.4 Aggregated and Anonymised Data

We may share aggregated, anonymised, or de-identified information for research, analytics, or other purposes that do not identify individual users.

5. Data Security

We implement technical and organisational measures to protect your information:

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Access Controls: Strict role-based access and multi-factor authentication for staff
• Regular Audits: Security assessments and vulnerability testing
• Data Minimisation: We only collect and retain the data necessary for stated purposes
• Employee Training: Ongoing security and privacy training for all staff
• Incident Response: Procedures for detecting, responding to, and notifying you of security incidents

6. Data Retention

We retain your personal information only as long as necessary:

• Personal and Usage Data: Retained for 24 months, then aggregated or deleted
• Account Data: Deleted within 30 days of your confirmed deletion request
• Communication Data: Retained while our relationship is active and as required for legal compliance
• Legal Requirements: Some data may be retained longer to comply with statutory obligations

7. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards through:

• Standard Contractual Clauses (SCCs) for transfers outside the EEA
• Adequacy Decisions for countries recognised as providing adequate data protection
• Certification Programs where applicable
• Consent in specific circumstances

8. Your Rights and Choices

8.1 Access and Control

You have the right to:

• Access a copy of your personal data
• Correct inaccurate or incomplete data
• Delete personal data ("right to be forgotten")
• Restrict or object to certain processing
• Port data in a machine-readable format
• Withdraw consent at any time

8.2 Marketing Preferences

• Unsubscribe using the link in each marketing email
• Update your preferences in Settings → Notifications
• Contact us directly to opt out of specific communications

8.3 Cookies and Tracking

• Adjust your browser settings to block or delete cookies
• Use browser extensions to block analytics tracking
• Opt out of analytics tracking where available

9. Minimum Age

The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete the information.

10. Third-Party Services and Links

Our Service may contain links to third-party websites or integrate with third-party services. We are not responsible for their privacy practices. Review their policies before providing any personal information.

11. California Privacy Rights (CPRA)

If you are a California resident, you have the rights to:

• Know what personal information is collected and how it is used
• Correct inaccurate personal information
• Delete personal information
• Opt out of the sale or sharing of personal information (StillMind does not sell personal information)
• Non-discrimination for exercising your privacy rights

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy within the app and on our website
• Sending an email notification to registered users

The "Last Updated" date at the top indicates when it was last revised. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact Information

Data Protection Officer
Email: [email protected]

For EU residents: You may lodge a complaint with your local data protection authority.

For California residents: Use the email above to exercise your CPRA rights.

14. Definitions

• Personal Data / Personal Information: Information that identifies or can be used to identify an individual
• Processing: Any operation performed on personal data (collection, use, storage, etc.)
• Data Controller: The entity responsible for determining how and why personal data is processed
• Data Processor: An entity that processes personal data on behalf of the controller
• GDPR: General Data Protection Regulation (EU) 2016/679
• CPRA: California Privacy Rights Act