Stillness is an object, not a service that watches you. This page says exactly what leaves your device, what we hold, and what we cannot read.
Last updated: 11 August 2026.
Signing in is optional. The app is complete without it: you can read, sit, write, keep a Before journal, Burn locally, and use the widget with no account at all.
If you do sign in with Apple, the following is stored on our server:
| What | Form on our server | Linked to your account | Used for tracking |
|---|---|---|---|
| Your Apple user identifier | Plain | Yes | No |
| Identity display email (optional) | Plain | Yes | No |
| Your journal lines | AES-GCM ciphertext | Yes | No |
| Your sittings (when, how long) | Plain | Yes | No |
| Your reading progress | Plain | Yes | No |
That is the whole list. We do not collect your name, your contacts, your location, your device identifiers for advertising, your usage patterns, or anything else.
Apple’s Sign in with Apple gives us a stable user identifier. Separately, on the first authorization (and only if you share it), Apple may also provide an email address — either your real address or a Hide My Email relay. When one is provided, we store it on that provider identity and may show it on the signed-in Your scroll surface so you can see which identity holds the session.
This is the part that matters most, so it is stated plainly.
When you write a line and you are signed in, your device generates a 256-bit notebook key and encrypts the line with AES-GCM before sending it. What arrives at our server is ciphertext, a nonce, and a key version number. Nothing else — no plaintext, no preview, no excerpt, no length-preserving derivative, nothing searchable.
We do not hold your notebook key. It is created on your device and lives in your iCloud Keychain, which is synchronized by Apple between your own devices and which we have no access to. There is no copy on our side, no escrow, no recovery key, and no support process that can recover your lines.
The consequence is deliberate and you should understand it before you rely on it: if you lose every device and lose access to your iCloud Keychain, your synced lines become permanently unreadable. Not by us either. This is not a cloud drive and it is not a backup service — it is a way for your own devices to carry your own sealed notebook between them. If you want a readable copy, use Take everything with you in Settings to export plain text you own.
Burn is the deletion path, and it deletes the account too. It is in Settings, in the app, and it does not require contacting us.
Burn erases, in one committed operation:
Burn cannot be undone. There is no trash, no grace period, and no copy retained for us. What remains afterwards is an audit record that the deletion happened — an operation identifier and a timestamp, holding none of your content.
If you signed in and later use Leave, that only signs this device out. It is not a deletion. Use Burn if you want the data gone.
Our backend can be unreachable — maintenance, a network problem, a tunnel restarting. When that happens, the app tells you it cannot reach the server. It does not lose anything.
Everything that does not need the server keeps working, in full: reading the day’s koan, sitting, writing lines, the Before journal, local Burn, and the widget. Lines you write while offline wait on your device and upload when the connection returns.
A sync error means the connection is down, not that your writing is gone. If you would like a copy that never depends on us, export it from Settings.
No analytics. No advertising identifiers. No crash-reporting SDK. No third-party SDKs at all, so there are no third-party tracking domains. No streaks, no feed, no push notifications, no profiling. We do not sell, rent, or share your data with anyone, because there is nothing collected that could be sold and we do not want it.
We do not use your data for training anything.
Our server runs outside mainland China and stores data in an overseas region. Data is held for as long as your account exists, and is destroyed when you Burn.
Stillness is not directed at children under 13 and we do not knowingly collect anything from them.
The Dana offering is processed by Apple through In-App Purchase. We never see your payment details — Apple tells us only that a purchase completed. See the Terms of Use.
If this policy changes, the updated date at the top changes with it, and the change is recorded in the repository history of this document.
Write to the keeper of this object: nanyiniu76@gmail.com. Letters are read, though not always answered.