Privacy Policy
Effective Date: November 14, 2026
1. Introduction & Core Philosophy
still ("we", "us", or "our"), operated at stillmail.org, provides autonomous email assistance, triage, and drafting services for professionals and executives. We believe email privacy is fundamental. This policy explains what information we access, how it is processed on our Cloudflare edge architecture, and how we protect your data.
2. Google API Limited Use Disclosure
still's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- No Generalized Model Training: Your email content, message bodies, metadata, and attachments are NEVER used to train, retrain, or fine-tune generalized or third-party AI/ML models.
- Purpose-Specific Processing: Google Workspace and Gmail data is strictly utilized to provide user-facing features—specifically autonomous inbox triage, summarizing message threads, and generating reply drafts directly requested or authorized by you.
- Human Oversight Restrictions: No humans read your emails unless: (a) you provide explicit written consent for troubleshooting, (b) it is required for security investigations (such as preventing abuse), or (c) necessary to comply with applicable law.
3. Information We Collect
When you authenticate with still via Google OAuth, we access only the scopes required to deliver our core email service:
- Account Profile Information: Your primary email address, display name, and avatar image to identify your connected account.
- Email Content & Metadata: Message subjects, headers (sender, recipients, timestamps), thread identifiers, and message bodies required to calculate confidence scores, organize priority streams, and generate drafts.
- User Configuration & Feedback: Your autonomy tier settings, draft approval history, and user preferences stored to calibrate your agent's tone.
4. Security & Data Storage
still is engineered on Cloudflare's global edge infrastructure:
- All communication occurs strictly over modern TLS (HTTPS) with HSTS enforcement.
- OAuth tokens and confidential credentials are stored encrypted at rest using industry-standard AES-256 encryption.
- Data stored in vector databases for long-term memory retrieval is isolated per user account and never shared across tenants.
5. Data Retention & Deletion
You maintain complete ownership of your data at all times. You can disconnect any Google account at any moment through your settings. Upon request or account disconnection, your cached tokens, vector memory embeddings, and message drafts are permanently purged from our databases within 30 days.
6. Third-Party Disclosures
We do not sell, rent, monetize, or disclose your personal data or email records to third parties, advertisers, or data brokers. Data transfers occur only with verified cloud infrastructure providers (such as Cloudflare) bound by strict confidentiality and data protection obligations.
7. Contact Information
For any privacy inquiries, data deletion requests, or questions regarding our Google API compliance, please contact us at: