Privacy Policy
This policy describes what we process to run stillyours, for how long, and what happens when you delete your account. We do not ask for your legal name, your full date of birth or any identity document. Opening a link you received requires no account and no personal data.
Shared content is encrypted on the sender's device and we hold no key that opens it. What we process about content is described below; what we cannot see is not processed at all, except when a recipient reports it (section 7).
Data controller. UnderLayer, Société par actions simplifiée (SAS), 60 rue François 1er, 75008 Paris, France (993 344 027 R.C.S. Paris). Contact: support@stillyours.io. See the legal notice for full company details.
1. Data we process
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Account | Email address; optional display name | Create and secure the account, allow sending; the display name is what recipients see as the sender | Performance of the contract |
| Subscription | Whether the account is on the Creator plan and until when; the identifier of the App Store transaction, the product bought and the store environment; a random token attached to the purchase so that it can be matched to your account; the date, origin and IP address of every change of plan | Activate the Creator plan on the account that bought it, keep it in step with the App Store, prevent one subscription from serving two accounts | Performance of the contract |
| Content | Encrypted image and video files in transit, which we cannot read; the fingerprint and size of each encrypted file; a fingerprint of the original computed by the app; our half of each content key | Provide the sharing service; enforce the sender's rules (expiry, openings, revocation); verify reports; block re-uploads of removed content | Performance of the contract |
| Identification | IP address, connection and sending timestamps, device identifier | Legal retention duty, abuse prevention | Legal obligation, legitimate interest |
| Moderation | Reports received, decisions issued; for content reported by a recipient, the key half their app sent and, where needed, the encrypted copy their device held — together, that one content in readable form; a log of every access to it | Handle reports, preserve evidence for the authorities, prevent repeat abuse | Legal obligation, legitimate interest |
2. Retention
- Encrypted files: deleted from our servers once every allowed opening has been served, and at the latest 24 hours after the link expires or is revoked.
- Our half of each content key: refused to everyone the moment the link closes; destroyed 30 days later. It is kept until then solely so that a report on the content can still be verified.
- Fingerprints and sizes of encrypted files, and the fingerprint of the original declared by the app: one year, with the identification data below.
- Fingerprints of removed content: kept without time limit, so that content removed by moderation cannot be sent again from any account. A fingerprint is a fixed-length digest from which the image or video cannot be reconstructed.
- Account: kept until you delete it.
- Subscription: the transaction identifier and the product are kept while the plan is active and deleted with the account; the record of plan changes (date, origin, IP address) is kept one year, to justify what an account was allowed to send and to answer a billing dispute.
- Data identifying the author of shared content (email address, login identifiers, IP address, timestamps): one year from the sharing of the content, under II of article 6 of French law n° 2004-575 of 21 June 2004 and decree n° 2021-1362 of 20 October 2021. This retention is mandatory and survives account deletion.
- Moderation records: one year from the decision, to justify our decisions and prevent repeat abuse.
- Content made readable by a report: destroyed immediately when the report is dismissed; when the content is removed, kept one year from the decision in access-restricted storage, every access being logged, and longer only at the request of a judicial authority.
Beyond these durations, data is deleted automatically.
3. Deleting your account
You can delete your account at any time from Settings → Delete account inside the app, without contacting us.
Deleted immediately: your email address, your display name if any, your subscription record, and all your active transfers — their links stop working at once.
Your subscription is not cancelled by deleting the account: Apple keeps billing it until you cancel it from your Apple ID (Settings → Apple ID → Subscriptions). Do that first.
Kept, and why: the data allowing the identification of the author of content you shared is retained for one year from each sharing, because French law requires it and we cannot derogate from it, even at your request. It is stored separately, used for no commercial or statistical purpose, and can only be disclosed to judicial authorities upon lawful request. Our half of the key of each link you created is kept 30 days after deletion, refused to everyone, for the sole purpose described in section 2. If your account was terminated for breaking the terms, we also keep your device identifiers to prevent a new registration from the same devices.
4. Recipients
Your data is accessible to our hosting provider and to Resend, our email delivery provider, each acting as a processor under our instructions and a contract compliant with article 28 GDPR. No data is sold or used for advertising.
Apple. The Creator plan is sold through the App Store: Apple collects the payment and holds your payment details, name and billing address as an independent controller, under its own privacy policy. What reaches us is a signed proof of the transaction, which carries none of them.
Transfers outside the European Union. Emails we send you (verification codes, moderation decisions) are processed by Resend on servers located in the United States. This transfer is governed by the European Commission's standard contractual clauses. Shared content itself is not sent through this channel.
5. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability. The right to erasure does not apply to data whose retention is legally required, described in section 2. To exercise your rights: support@stillyours.io. You can lodge a complaint with the CNIL, 3 place de Fontenoy, 75007 Paris, France.
6. Minors
The Service is reserved for people aged 17 or over. In France, processing the data of a child under 15 requires parental consent. If we learn that an account belongs to a child under that age, it is deleted.
7. Encryption, and what a report makes readable
Content is encrypted on the sender's device with a key split in two: one half inside the link, which never reaches us, the other half on our server. We cannot read content in transit or at rest, and no one can compel us to hand over a key we do not hold. Two things follow. First, in the event of a breach of our servers, what an attacker would obtain is encrypted files and half-keys, which open nothing. Second, the only content we can ever read is content a recipient has chosen to report: their app then sends us the link half of the key (and, if needed, their encrypted copy, accepted only if it matches what the sender uploaded). That content is read only by our moderation team, only to decide on the report, with every access logged. It is destroyed if the report is dismissed, and preserved as evidence if the content is removed.