Privacy Policy

Effective date: May 15, 2026

Overview

This Privacy Policy explains what data Still ("we", "us", "the app") handles, how it is used, and the choices you have. Still is a Kotlin Multiplatform mobile application for Android and iOS that helps you track product expiration dates and reminders.

Still is built around a simple principle: the products and reminders you create stay on your device. We do not run a server, we do not have a user account system, and we never receive the names, dates, or contents of the items you track.

The limited data we do receive (anonymous analytics on Android, subscription status from Google Play and RevenueCat) is described in detail below.

1. Data You Create Stays on Your Device

When you add products, set expiration dates, choose locations (fridge, freezer, pantry, etc.), or configure reminders, that information is stored only on your device:

• On Android, in a local SQLite database (fresh_track.db) and in SharedPreferences.
• On iOS, in a local SQLite database (fresh_track_v2.db) and in NSUserDefaults.

This data is not transmitted to Still or to any third party. We do not have a server that could store it.

If you uninstall the app, the operating system deletes this local data. On Android, your device may include Still's data in Google Play's automatic app backup if you have that feature enabled in your Google account; you can review or disable Auto Backup at developer.android.com/identity/data/autobackup.

2. Subscriptions and Payments

Still offers an optional Pro subscription. All subscription purchases, billing, renewals, and refunds are processed by Google Play under your Google account. We do not receive or store your payment details (card number, billing address, etc.).

To validate purchases and keep your Pro features unlocked across reinstalls and devices, we use RevenueCat as a third-party subscription and entitlement processor. When you make a subscription action in Still, RevenueCat receives:

• A randomly generated, anonymous app user ID (not linked to your name, email, or Google account in our records).
• The purchase receipt provided by Google Play.
• Your subscription / entitlement status (active, expired, in grace period, etc.).
• Standard device metadata (platform, app version, country code).

RevenueCat does not receive your name, your email address, or any of the products, dates, locations, or reminders you enter into Still.

RevenueCat's privacy practices are governed by their own privacy policy: revenuecat.com/privacy.

You can restore previous purchases at any time from Settings > Restore Purchases, and you can manage or cancel your subscription from Settings > Manage Subscription.

3. Analytics and Crash Reporting (Android Only)

On Android, Still uses two services from Google.

Firebase Analytics. We log anonymous, aggregated events about how the app is used so we can understand which features are useful and which ones need work. Examples of events we log:

• Screens you view (product list, settings, paywall, onboarding, archived products).
• Product actions (added, updated, archived, restored, deleted).
• Reminder actions (weekly reminder enabled or disabled, per-product reminder added, removed, or time changed).
• Subscription events (paywall opened, purchase completed, purchases restored, manage-subscription tapped).

Firebase Analytics does not receive the names, dates, or contents of the products you track, your email, or your name. Events are tied to a Google-generated app instance ID, not to a personal identifier.

Firebase Crashlytics. When the app crashes or hits an unexpected error, Crashlytics records non-personal diagnostic information so we can fix the bug — typically the stack trace, the device model, the operating system version, and the Still app version. It does not capture the contents of the screen you were on or the products you had entered.

The iOS version of Still does not currently use Firebase Analytics or Crashlytics. Nothing is sent to any analytics or crash-reporting service from iOS.

Google's handling of Firebase data is governed by the Firebase Privacy and Security policy: firebase.google.com/support/privacy. You can opt out of Google Analytics on Android via your device's Google account settings.

4. Reminders and Notifications

Still can send local notifications to remind you about expiring products — both a weekly digest (free and Pro) and per-product reminders (Pro only).

All reminder scheduling is performed on your device using the operating system's notification system. The content of every reminder (the product name, expiration text, etc.) stays on the device and is never sent to us or to any third party. We do not run a server that could receive or trigger your reminders.

To deliver these notifications, Still uses operating system permissions:

• Android 13 (Tiramisu) and above: the app requests the POST_NOTIFICATIONS runtime permission so it can show notifications, and it uses the system's exact-alarm scheduling so reminders fire at the time you choose.
• Android (all versions): a boot receiver re-schedules pending reminders after your device restarts so you don't miss them.
• iOS: the app requests notification authorization (alerts and sound) the first time you enable reminders.

You can disable reminders at any time from Still Settings, or revoke the system notification permission from your device's settings app.

5. How We Use the Data We Receive

Beyond the data that stays on your device, the limited information we (or our processors on our behalf) receive is used only to:

• Validate and entitle your subscription (Google Play, RevenueCat).
• Diagnose crashes and bugs (Firebase Crashlytics, Android only).
• Understand how the app is used in aggregate so we can improve it (Firebase Analytics, Android only).

We do not sell this data. We do not use it for advertising. We do not share it with third parties beyond the processors named in this policy (Google and RevenueCat) and as required by law.

6. Third-Party Services We Rely On

7. Data Retention

• On-device data (your products, settings, reminders) is retained as long as Still is installed. Uninstalling the app deletes it from the device. It may also be included in Android's Google Auto Backup if you have that enabled in your Google account.
• Subscription records held by Google Play and RevenueCat are retained per their respective policies and are required for billing, refunds, and entitlement validation.
• Analytics and crash data sent to Firebase (Android only) are retained according to Google's Firebase data retention policy.

Because Still does not have an account system, there is no Still account to delete. To remove your local data, uninstall the app. To remove subscription records, contact Google Play or RevenueCat directly.

8. Children's Privacy

Still is not directed to children under the age of 13, and we do not knowingly collect personally identifiable information from anyone under 13. If you believe we have inadvertently received such information, please contact us at the address below and we will take steps to address it.

9. Your Rights — GDPR (European Union / EEA / United Kingdom)

If you are located in the European Union, the European Economic Area, or the United Kingdom, the General Data Protection Regulation (GDPR) and equivalent UK legislation give you specific rights over your personal data.

Data controller. The data controller for Still is Juan Diego Garita. You can reach the controller at the contact email below.

Legal bases. Where GDPR applies, our legal bases for processing are:

• Your consent — for analytics and crash reporting on Android, which you can opt out of via your device's Google settings.
• Performance of a contract or legitimate interest — for processing your subscription via Google Play and RevenueCat so we can deliver the Pro features you requested, and for scheduling the local reminders you set up.

Your rights. You have the right to access, rectify, erase, restrict, port, or object to the processing of your personal data, and to withdraw consent at any time. Because most of your data lives only on your device, the most direct way to exercise these rights is to manage the data in the app or to uninstall.

Right to lodge a complaint. You may also lodge a complaint with your local data protection supervisory authority.

10. Your Rights — CCPA (California)

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you specific rights:

• Right to know. You can ask us what categories of personal information we have received about you. The categories described in this policy (anonymous analytics on Android, subscription metadata via RevenueCat) are the only categories that apply.
• Right to delete. You can ask us to delete personal information we hold about you. Most of the data described here is held by Google or RevenueCat, not by us — see those services for direct deletion options.
• Right to opt out of sale. We do not sell the personal information of our users.
• Right to non-discrimination. We will not discriminate against you for exercising any CCPA right.

To make a CCPA request, contact us at the email below.

11. Changes to This Privacy Policy

We may update this Privacy Policy as the app evolves. The "Effective date" at the top of this page reflects the most recent revision. Material changes will be reflected in the in-app Settings link and on this page.

12. Contact

If you have questions about this Privacy Policy or how Still handles your data:

Email: hello@jdgarita.dev