StillShield Privacy Policy

1. Information You Provide to Us

When you create an account or use StillShield features, we may collect information you provide directly, including:

• Name and email address — collected when you register for an account
• Account credentials — your password is processed to create a secure credential; StillShield does not store your plaintext password
• Authentication and security settings — such as whether you have enabled two-factor authentication and your trusted-device preferences
• Feedback — if you submit feedback through the app
• Number reports and notes — phone numbers you submit for community reporting and any optional notes you include with a report
• Lumen messages — messages you send to Lumen, StillShield's AI assistant
• Other information — any other information you voluntarily submit through StillShield features

StillShield does not collect your personal phone number as part of account registration. Phone numbers submitted through the Number Lookup and community reporting features represent numbers you are reporting or looking up, which may be third-party or suspicious numbers.

2. Security and Application Data

To provide StillShield's security features, we create, process, and store information about your security posture and activity, including:

• Your Still Score and security pillar scores
• Coach task completion — which of the 25 security tasks you have completed
• Security timeline — a record of security events and milestones in your account
• Account security state — such as whether your email is verified, whether 2FA is enabled, and your trusted-device information
• Breach and exposure information — results from breach lookups associated with your verified email address
• Security signals and findings — observations and recommendations generated by the StillShield platform
• Privacy Journey progress — your progress through StillShield's guided security improvement experience

3. Information Collected Automatically

When you use StillShield, we may automatically collect limited technical information, including:

• Device and browser information — such as browser type and operating system
• IP address — used for security and service operation purposes
• Diagnostic information — error messages and technical details submitted through client error reporting, used for troubleshooting, debugging, and service reliability

StillShield does not currently use third-party analytics SDKs, advertising SDKs, or tracking pixels. We do not collect broad behavioral analytics about how you navigate the app beyond what is necessary to operate the service.

4. Have I Been Pwned — Breach Lookup

StillShield uses Have I Been Pwned (HIBP) to provide breach and exposure information.

When the breach lookup feature operates for your account, your verified email address may be transmitted server-side to Have I Been Pwned to check whether it appears in known data breach records. Relevant breach results may be cached and stored by StillShield to provide your Personal Exposure experience and security history.

StillShield does not currently perform Pwned Passwords checks. Your password is not sent to Have I Been Pwned.

Have I Been Pwned's privacy practices are governed by their own privacy policy, available at haveibeenpwned.com/Privacy.

5. Lumen — AI Assistant (OpenAI)

Lumen is StillShield's AI-assisted security feature, powered by OpenAI.

When you interact with Lumen, StillShield may transmit information to OpenAI to generate a response. This may include:

• Your Lumen message and recent conversation context
• Your name
• Your Still Score and security pillar scores
• Your security platform state and findings
• Breach count and status
• Email verification status, 2FA-enabled status, and trusted-device count
• Reports-submitted count and account age
• Relevant security recommendations and historical security observations
• Recent platform and heartbeat information
• Relevant personalization and security signals
• Current page context where applicable

The following information is not included in Lumen prompts and is not sent to OpenAI: your email address, phone number, or internal account ID.

Conversation history: StillShield does not currently persist your Lumen conversation history in its own database. Conversation context is maintained in your browser session only.

OpenAI data practices: Information transmitted to OpenAI is processed according to OpenAI's privacy policy and applicable terms. StillShield makes no independent representations about how OpenAI stores, retains, or uses information it receives. You can review OpenAI's privacy policy at openai.com/privacy.

6. Resend — Transactional Email

StillShield uses Resend as its transactional email service provider. Resend may process information necessary to deliver messages to you, including:

• Your email address
• Account verification messages
• Two-factor authentication codes
• Password-reset communications
• Service and account communications

Certain feedback or number-report workflows may generate internal administrative email notifications. These notifications may include information associated with the relevant account or report.

Resend's privacy practices are governed by their own privacy policy, available at resend.com/privacy.

7. Number Lookup and Community Reports

StillShield's Number Lookup feature allows users to look up phone numbers and submit community reports about suspicious or unwanted calls.

Account association: Reports submitted while signed in to a StillShield account may be internally associated with that account for security, integrity, moderation, abuse prevention, and account-management purposes.

Public display: Your identity is not publicly displayed to other users viewing community reports for a phone number. Internal account association is distinct from public identity disclosure.

8. Data Storage and Infrastructure

StillShield stores application and account data using Turso, a third-party database infrastructure provider. Data is processed and stored on infrastructure operated by Turso and StillShield's hosting providers.

StillShield is hosted on infrastructure provided by GoDaddy/Airo.

We use technical and organizational safeguards to protect information where supported by our current implementation. No information system can guarantee absolute security, and we cannot make that guarantee.

9. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve StillShield and its features
• Calculate and maintain your Still Score and security posture
• Deliver breach and exposure information
• Power Lumen responses
• Send transactional and account-related communications
• Process and display community number reports
• Detect and prevent fraud, abuse, and security threats
• Troubleshoot, debug, and maintain service reliability
• Comply with legal obligations and enforce our Terms of Service

10. How We Share Your Information

We do not sell your personal information.

We may share information with:

• Service providers — third parties that help us operate StillShield, including Turso (data storage), Resend (email delivery), OpenAI (Lumen AI responses), and Have I Been Pwned (breach lookups), as described in this Privacy Policy
• Hosting and infrastructure providers — including GoDaddy/Airo
• Legal and safety disclosures — when required by law, legal process, or to protect the rights, property, or safety of StillShield, its users, or others
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality obligations

Advertising and tracking: StillShield does not currently use your personal information for third-party advertising or cross-app advertising tracking. We do not use Google Analytics, Meta Pixel, or similar advertising or behavioral analytics tools.

11. Tracking and Cookies

StillShield may use session-related browser storage (such as localStorage) to maintain your authenticated session. We do not currently use third-party advertising cookies or behavioral tracking technologies.

12. Data Retention

We retain your information for as long as your account is active or as reasonably necessary to provide our Services.

• Account information — retained while your account remains active
• Temporary authentication information — such as verification codes and password-reset tokens, which have limited lifetimes as part of their security design
• Breach and security information — may be cached or retained to provide your security experience and history
• Security history and timeline — retained to support your ongoing security posture
• Diagnostic information — retained for a limited period for troubleshooting and reliability purposes

We may retain certain information when reasonably necessary for security, fraud and abuse prevention, legal obligations, dispute resolution, or service operation.

13. Your Choices and Controls

StillShield provides the following controls within the app:

• Account deletion — Go to Settings → Your Data & Privacy → Delete Account. Password confirmation is required. Account-linked personal information is handled according to StillShield's deletion process. Certain security, audit, or aggregate records may be retained or anonymized after deletion where required for legal, security, or operational purposes. Business or company records associated with Business StillShield are not necessarily deleted when a consumer account is deleted.
• Data export — Go to Settings → Your Data & Privacy → Download My Data to receive a structured export of information StillShield holds about your account.
• Two-factor authentication — Manage 2FA settings in Settings → Security.
• Trusted devices — View and remove trusted devices in Settings → Security → Trusted Devices.

14. Children's Privacy

We do not knowingly collect, maintain, or use information from children under 13 years of age, and no part of our Services are directed toward children. If you learn that a child has provided us with information in violation of this Privacy Policy, you may alert us at support@stillshield.com.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised version on this page with an updated effective date. If we make material changes, we may notify you through the app or by other means. We encourage you to review this Privacy Policy periodically.

16. Contact Us

For questions, concerns, or requests related to this Privacy Policy or your personal information, contact us at:

Email: support@stillshield.com

You can also visit our Support page or review our Terms of Service.