Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how Veteran Service Connect LLC, a New York limited liability company doing business as Stillwater ("Stillwater," "we," "us," or "our"), collects, uses, discloses, and protects your personal information when you use the Stillwater mobile application, website at getstillwater.app, and related services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use the Service.

This Policy should be read together with our Terms of Service.

2. Data Controller

Veteran Service Connect LLC, d/b/a Stillwater, is the data controller responsible for the processing of your personal data under this Policy.

Contact: privacy@getstillwater.app
Website: https://getstillwater.app

While Stillwater does not currently maintain a dedicated Data Protection Officer, we are committed to responding to all data protection inquiries. EU and UK residents may contact us at the address above for any data protection matters.

3. Information We Collect

3.1 Information You Provide Directly

• Account information: Name and email address provided during registration via Apple Sign In, Google Sign In, or email authentication
• User Content: Audio files you upload, sound mixes you create, and playlists you save
• Preferences and ratings: Your tingle profile responses, sound ratings (likes/dislikes), category preferences, and settings (timer duration, headphone mode, haptic feedback)
• Community submissions: YouTube video URLs you submit for community discovery
• Communications: Information you provide when contacting us for support or feedback, including bug reports submitted through the app

3.2 Information Collected Automatically

• Listening data: Session start/end times, session duration, sounds played, mix compositions loaded, session context (selected intention, timer settings)
• Usage analytics: Screen views, feature interactions (e.g., discover card interactions, mix sharing events), play/pause/completion events, subscription events
• Aggregate metrics: Total listening time, play counts, session counts, streak data (current and longest streaks)
• Device information: Device model, operating system and version, app version and build number
• Subscription status: Subscription tier (free, trial, or premium), subscription expiry date, and monetization variant assignment
• Ad interaction data: Daily ad impression counts, rewarded ad redemption events, and session pass status (free tier only)

3.3 Information from Third Parties

• Authentication providers: When you sign in with Apple or Google, we receive your name, email address, and a unique identifier from the authentication provider. We do not receive your password.
• App Store platforms: Subscription purchase confirmation and status updates are provided through RevenueCat, which interfaces with Apple App Store and Google Play Store.

3.4 Information We Do Not Collect

• We do not collect precise geolocation data
• We do not collect biometric data
• We do not collect financial information (credit card numbers, bank account details); all payment processing is handled by the App Store platforms
• We do not collect data from your contacts, calendar, camera, or microphone
• We do not collect browsing history outside the Service

4. How We Use Your Information

We use the information we collect for the following purposes:

5. Legal Bases for Processing

For users in the European Economic Area (EEA), United Kingdom (UK), and other jurisdictions that require a legal basis for processing personal data, we rely on the following:

• Performance of a contract (Art. 6(1)(b) GDPR): Processing necessary to provide the Service you have requested, including account creation, content storage, personalization, and subscription management
• Legitimate interests (Art. 6(1)(f) GDPR): Processing for service improvement, analytics, security, and fraud prevention, where our interests are not overridden by your fundamental rights. You may object to processing based on legitimate interests as described in Section 9
• Consent (Art. 6(1)(a) GDPR): Where we rely on your consent (e.g., for push notifications or optional marketing communications), you may withdraw consent at any time without affecting the lawfulness of prior processing
• Legal obligation (Art. 6(1)(c) GDPR): Processing necessary to comply with applicable legal requirements

6. Information Sharing and Disclosure

We do not sell your personal data. We share your information only in the following limited circumstances:

6.1 Service Providers

We engage third-party service providers who process data on our behalf to operate the Service. These providers are contractually obligated to use your data only for the purposes we specify and in accordance with this Policy.

6.2 YouTube API Services

The Service uses YouTube API Services to display and integrate video content. By using features that involve YouTube content, you are also bound by the YouTube Terms of Service and Google Privacy Policy. We access YouTube video metadata (titles, thumbnails, channel names) but do not share your personal data with YouTube beyond what is inherent in loading embedded content.

6.3 Other Users

When you use the Service's sharing features (e.g., sharing a Mix via a link), certain information about your Mix (sound composition, volume levels, and your display name) is made accessible to recipients of the share link. You control what you share.

6.4 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or when we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation or valid legal process
• Protect and defend our rights, property, or safety
• Protect the personal safety of users or the public
• Detect, prevent, or address fraud, security, or technical issues

6.5 Business Transfers

If Stillwater is involved in a merger, acquisition, reorganization, bankruptcy, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via email or prominent notice within the Service before your data becomes subject to a different privacy policy.

7. Advertising

The free tier of Stillwater displays advertisements served by Google AdMob. AdMob may collect and use certain information about your device and ad interactions to serve relevant ads, including:

• Device identifiers (e.g., IDFA on iOS, Advertising ID on Android)
• IP address (for approximate geographic targeting)
• Ad interaction data (impressions, clicks)
• Device characteristics (model, OS version, screen size)

We do not share your listening history, Tingle Profile, personal preferences, or any other Stillwater-specific behavioral data with ad providers.

You can limit ad personalization:

• iOS: Settings > Privacy & Security > Tracking, and disable "Allow Apps to Request to Track"
• Android: Settings > Privacy > Ads > "Delete advertising ID" or "Opt out of Ads Personalization"

Premium subscribers do not see ads, and no ad-related data is collected for premium accounts.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law.

• Active accounts: Data is retained for the duration of your account's existence
• Deleted accounts: Upon account deletion, all personal data (profile, sessions, mixes, preferences, and listening history) is permanently deleted from our active systems within thirty (30) days. Residual copies in encrypted backups are automatically purged within ninety (90) days
• Analytics data: Aggregated and anonymized analytics data that cannot identify you may be retained indefinitely for service improvement purposes
• Legal obligations: Certain data may be retained as required by applicable law, regulation, or legal process, even after account deletion

9. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

9.1 All Users

• Access: Request a copy of the personal data we hold about you
• Deletion: Delete your account and all associated data at any time from the Account screen in the app, or by contacting us
• Correction: Request correction of inaccurate personal data
• Data portability: Request your data in a structured, commonly used, machine-readable format

9.2 European Economic Area and UK Residents (GDPR / UK GDPR)

In addition to the rights above, you have the right to:

• Object to processing: Object to our processing of your personal data based on legitimate interests
• Restrict processing: Request that we restrict processing of your data in certain circumstances
• Withdraw consent: Withdraw consent at any time where processing is based on consent, without affecting prior processing
• Lodge a complaint: File a complaint with your local data protection authority (supervisory authority)

We will respond to verified requests within thirty (30) days, or within the timeframe required by applicable law.

9.3 California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share it
• Right to delete: Request deletion of your personal information, subject to certain exceptions
• Right to correct: Request correction of inaccurate personal information
• Right to opt-out of sale/sharing: We do not sell your personal information as defined under the CCPA/CPRA. We do not share your personal information for cross-context behavioral advertising purposes
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights
• Right to limit use of sensitive personal information: We do not collect sensitive personal information as defined under the CPRA beyond what is necessary to provide the Service

California residents may submit requests by emailing privacy@getstillwater.app. We will verify your identity before processing your request. You may also designate an authorized agent to submit requests on your behalf.

9.4 Categories of Personal Information (CCPA Disclosure)

In the preceding twelve (12) months, we have collected the following categories of personal information as defined by the CCPA:

• Identifiers: Name, email address, unique user ID, device identifiers
• Internet or electronic network activity: App usage data, feature interactions, listening history, session data
• Audio information: User-uploaded audio files
• Inferences: Preference profiles (Tingle Profile) derived from usage data and explicit ratings

We have not sold personal information in the preceding twelve (12) months. We have disclosed personal information to service providers for business purposes as described in Section 6.

10. Data Security

We implement and maintain reasonable technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption: All data is encrypted at rest and in transit (TLS 1.2+)
• Access control: Row-level security policies in our database ensure users can only access their own data
• Authentication security: We use industry-standard OAuth 2.0 protocols for authentication through Apple and Google
• Infrastructure security: Our backend is hosted on Supabase (AWS) with enterprise-grade security controls

While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials and for any activity under your account.

11. International Data Transfers

Stillwater is operated from the United States. Your data is stored and processed in the United States through our service provider Supabase (hosted on Amazon Web Services).

If you are located outside the United States, including in the European Economic Area, United Kingdom, or other jurisdictions with data protection laws that may differ from U.S. laws, please be aware that your personal data will be transferred to and processed in the United States.

For transfers of personal data from the EEA or UK to the United States, we rely on:

• The EU-U.S. Data Privacy Framework and UK Extension, where applicable to our service providers
• Standard Contractual Clauses (SCCs) approved by the European Commission, where DPF coverage is not available
• Other lawful transfer mechanisms as applicable under GDPR and UK GDPR

By using the Service, you consent to the transfer, processing, and storage of your information in the United States and other countries that may have different data protection standards than your jurisdiction.

12. Children's Privacy

The Service is not directed at children under the age of thirteen (13), or under the age of sixteen (16) in the European Economic Area. We do not knowingly collect personal data from children under these applicable age thresholds.

If we learn that we have collected personal data from a child below the applicable age threshold without verifiable parental consent, we will take steps to delete that information as promptly as possible. If you believe that a child has provided us with personal information, please contact us at privacy@getstillwater.app.

13. Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals. Because there is no uniform standard for interpreting DNT signals, the Service does not currently respond to DNT signals. We will continue to monitor developments in DNT technology and update our practices if a standard is adopted.

14. Cookies and Similar Technologies

The Stillwater website (getstillwater.app) is a static informational site that does not use cookies or tracking technologies. The Stillwater mobile application does not use cookies but may use local device storage (such as AsyncStorage) to maintain your session and preferences. This data remains on your device and is not transmitted to third-party tracking services.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this Policy
• Provide notice through the Service or via the email address associated with your account at least thirty (30) days before material changes take effect
• Where required by law, obtain your consent to material changes in our processing of personal data

Your continued use of the Service after the effective date of any revised Policy constitutes your acceptance of the changes. We encourage you to review this Policy periodically.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Veteran Service Connect LLC, d/b/a Stillwater
Email: privacy@getstillwater.app
General support: support@getstillwater.app
Website: https://getstillwater.app

For data protection inquiries from the EU or UK, please include "GDPR Request" in your subject line. We will respond within thirty (30) days.