Privacy Policy

Who We Are

Stillfold is an app for keeping a family’s important documents, and this website at stillfold.app. Both are made and run by Sarthak Patel, an individual developer based in Tennessee, USA (“Stillfold”, “we”, “us”). For anything about privacy, email privacy@stillfold.app.

This policy explains what we collect, what we can’t see, who helps us run the service, and the choices you have. It covers the Stillfold app, the Stillfold service behind it, share-link pages and this website.

The Short Version

• Your documents are end-to-end encrypted. We store them, but we can’t read them.
• We collect what we need to run your account: your email address, name, sign-in details and devices.
• No ads, no tracking, no analytics, no selling or renting your data. This website sets no cookies.
• Auto-fill details is optional and off until you agree. When you use it, the picture is read by a service that keeps nothing.
• You can delete your account from the app at any time.

What We Collect

Your account

• Your email address and, if you give one, your name. Your name is shown to people you invite or share a shelf with.
• Your sign-in details: which way you sign in (Apple, Google or an email code) and the identifier Apple or Google gives us for your account. If you use Sign in with Apple, we keep a token from Apple that we use only to revoke Stillfold’s access when you delete your account. If you choose to hide your email with Apple, we receive Apple’s relay address instead.
• One-time sign-in codes, stored only in a form that can’t be turned back into the code, and deleted after use or expiry.
• Your account’s public key and a locked copy of your private key that only your recovery code can open. We can’t open it.

Your devices

• Each signed-in device’s name (like “Sarthak’s iPhone”), platform, when it was added and last seen, and a push token so we can tell it there’s something new to sync. Push messages carry no document content.

Your shelves and documents

• Encrypted document data: your documents, pages, details and notes, and the names of your shelves and people, all encrypted on your phone before we receive them. We store this so your shelves are backed up and reach your family. We can’t read it.
• Information we need to run sharing: which accounts are on which shelf, their roles, who invited whom and when, the size of each stored file, and when things changed.
• Share links: for each link you create, an encrypted copy of what you shared, its expiry, whether download is allowed and whether it has a passcode. The key to the copy stays in the link and never reaches us.

Invites

• When you invite someone, we store their email address and send them an email that includes your name and email address, so they know who invited them. The secret part of the invite link is never stored or logged by us.

Requests to our servers

• Like any website or online service, our servers see the IP address, time, requested address and browser or app type of each request. We use these briefly to keep the service running and safe (for example, to limit repeated sign-in attempts). The request logs we keep are minimal and short-lived, and never include document content, invite secrets or share-link keys.

What We Can’t See

Because of end-to-end encryption, we can’t see:

• your documents, photos and PDFs,
• the names of your shelves or the people on them,
• document details such as numbers, dates and notes,
• what’s in a share link.

The keys that unlock this data are on your devices and those of the people you share with. How Stillfold keeps documents private explains this in more detail.

Auto-fill Details

Auto-fill details is optional. It’s off until you agree to turn it on in the app, and you can turn it off at any time.

When it’s on and you add a document, the app sends pictures of the document’s pages (and, if your phone recognised any text, that text) over an encrypted connection to our server. Our server passes them to OpenRouter, which routes the request only to providers that keep no data (zero data retention) and with data collection denied. The details found are returned to your phone.

• Our server holds the pictures in memory only for the time it takes to read them. They are not saved to disk, stored in a database or written to our logs. We log only that a request happened, how many pages it had, how long it took and whether it worked.
• For that moment, the pictures are not protected by Stillfold’s end-to-end encryption.
• The barcode on US driver’s licences and state IDs is read on your phone and never sent for this.

How We Use Information

We use the information above only to:

• create and run your account, sign you in and keep it secure,
• back up and sync your encrypted shelves across your devices and with the people you share with,
• send the emails the service needs: sign-in codes, invites, and reminders about pending shelf access,
• send push messages that tell your devices to sync,
• provide Auto-fill when you’ve turned it on,
• answer you when you contact us, and
• prevent abuse and comply with the law.

We don’t use your information for advertising, we don’t build profiles, and we don’t sell, rent or share it for anyone’s marketing. There is no analytics or tracking code in the app or on this website.

If you’re in the European Economic Area or the UK, our legal bases are: providing the service you asked for (contract), keeping it secure and working (legitimate interests), your consent for Auto-fill, and legal obligations where they apply.

Services That Help Us

A few companies process data for us, only to provide Stillfold:

We may also disclose information if the law requires it. Even then, we can only hand over what we have, and we can’t decrypt your documents.

How Long We Keep It

• Your account and its data: until you delete your account.
• Document history: the last 10 earlier versions of each document, encrypted like the rest.
• Records of people leaving a shelf: 180 days, so their apps can tidy up.
• Invites: they expire after 14 days; the record stays with the shelf until the shelf is deleted.
• Share links: until they expire or you turn them off. The encrypted copy is then deleted, usually within an hour.
• Deleted shelves: removed by a regular clean-up shortly after deletion.
• Backups: we don’t currently keep separate backups of the service’s data.

Deleting Your Account

You can delete your account in the app at any time: open the You tab and tap Delete account. When you do:

• your account, sign-in details, devices and keys are deleted,
• shelves that only you are on are deleted with their documents and files,
• you leave every shared shelf, which stays with its other members,
• your share links stop working,
• if you used Sign in with Apple, we revoke Stillfold’s access with Apple, and
• the copy on your phone is erased.

Some traces may remain for a short time: in the clean-up queue for deleted shelves, and in short-lived request logs. Your name may still appear in the history of shelves you shared, on the phones of people who were on them.

If you can’t use the app, email privacy@stillfold.app from your account’s email address and we’ll delete it for you.

Your Rights and Choices

Wherever you live, you can ask us to:

• access the personal information we hold about you,
• correct it,
• delete it (you can also do this yourself in the app), and
• receive a copy of it in a portable form.

If you’re in the European Economic Area or the UK, you can also object to or restrict some processing, withdraw consent (for Auto-fill, turn it off), and complain to your local data protection authority. If you’re in California, you have the right to know, delete and correct your information, and not to be discriminated against for using these rights. We don’t sell or share personal information as California law defines those terms.

Email privacy@stillfold.app from the address on your account. We’ll reply within 30 days, and we may need to confirm it’s you first. Remember that we can only give you what we can read: your documents are encrypted and only your devices can open them.

Children

Stillfold isn’t directed at children under 13, and children under 13 shouldn’t create an account. Parents and guardians can keep their children’s documents (like passports and birth certificates) on their own shelves; that information is encrypted like everything else. If you believe a child under 13 has created an account, email us and we’ll delete it.

International Transfers

We’re based in the United States, our server is hosted in Germany (EU), and the services listed above may process data in other countries. Wherever it goes, your documents stay encrypted. Where the law requires it, we rely on safeguards such as the European Commission’s standard contractual clauses offered by these services.

Security

Documents are encrypted on your device with keys we don’t have. Connections to our service are encrypted, sign-in codes are stored only as one-way hashes, and access to our servers is restricted. No system is perfectly secure, but our design means that even someone who got into our server couldn’t read your documents. See Security for details.

Changes to This Policy

If we change this policy, we’ll update the date at the top. If a change is significant, we’ll tell you in the app or by email before it takes effect.

Contact

Sarthak Patel, Tennessee, USA
privacy@stillfold.app