Privacy Policy
Last updated: 13 June 2026
How Still Near handles your personal data — in plain words, no jargon.
Still Near ("we", "us", "our") is operated by Evert Smit, Wydaeckerring 53, 8047 Zürich, Switzerland. We build a private photo frame for long-distance couples. This policy is governed by the Swiss Federal Act on Data Protection (FADP/DSG, revised, in force since 1 September 2023) and, where applicable to users in the EU/EEA, the General Data Protection Regulation (GDPR). It explains what data we collect, why, and what you can do about it.
1. What we collect and why
Account data
| Data | Purpose | Basis |
|---|---|---|
| Phone number | Account creation (SMS one-time code login) | Contract |
| Date of birth | Age verification (18+ requirement) | Legal obligation / legitimate interest |
| Email address (optional) | Billing correspondence, export delivery | Contract |
Room and photo data
| Data | Purpose | Basis |
|---|---|---|
| Photos you upload | Displayed on your shared frame | Contract |
| Photo metadata (upload time, uploader id) | Display ordering, deletion, export | Contract |
| Room membership (you + your partner) | Access control — only room members see photos | Contract |
| Paired display identifiers | Device authorisation and revocation | Contract |
Photos are encrypted at rest (AES-256-GCM) and stripped of EXIF location data before storage. There is no public album, no audience, and no social feed.
Billing data
| Data | Purpose | Basis |
|---|---|---|
| Subscription status, plan interval, renewal date | Entitlement and tier enforcement | Contract |
| Mollie customer ID, subscription ID, payment ID | Payment processing and reconciliation | Contract |
We do not store card numbers, bank account details, or payment credentials. All payment processing is handled by Mollie, our payment provider. We receive only transaction references and status updates.
Waitlist data (prelaunch)
| Data | Purpose | Basis |
|---|---|---|
| Email address | Waitlist updates, beta invitations | Consent |
| Situation (optional), spare phone (optional) | Understanding our audience | Consent |
2. Third-party processors
We share personal data only with the following processors, and only for the stated purposes:
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Cloudflare | Hosting, CDN, encrypted storage (R2), key-value store (KV) | All service data (encrypted at rest) | EU (Western Europe) |
| Twilio | SMS one-time code delivery (Verify API) | Phone number | US (Standard Contractual Clauses) |
| Mollie | Payment processing (subscriptions, gifts) | Email (optional), transaction metadata | Netherlands (EU) |
We do not sell, rent, or share your data with advertisers. We do not use advertising trackers or retargeting pixels. Data Processing Agreements (DPAs) are in place with all processors listed above.
3. Data storage and security
- Photos are encrypted (AES-256-GCM) before storage in Cloudflare R2. EXIF location data is stripped on upload. Storage is in Cloudflare's Western Europe region.
- Account and room data are stored in Cloudflare KV (encrypted at rest by Cloudflare).
- Signed URLs — photos are served via time-limited, HMAC-signed URLs. No photo has a permanent public link.
- Authentication uses constant-time secret comparison and Web Crypto APIs. Passwords are not used; login is phone-based OTP or passkey (ECDSA-P256).
4. Data retention and deletion
| Data | Retention |
|---|---|
| Account data | Until you delete your account. Soft-deleted with a 30-day grace period, then permanently purged. |
| Photos | Until you delete them, leave the room, or delete your account. Individual photo deletion is immediate from the active rotation; room-exit deletion has a 30-day soft-delete period. |
| Billing records | Retained while the subscription or its tail period is active. Purged as part of account deletion. |
| Waitlist entries | Until you unsubscribe or ask us to delete your entry. |
| Abuse reports and audit logs | Retained for legal compliance and safety. |
5. Your rights
Under the Swiss FADP and, where applicable, the GDPR, you have the right to:
- Access — request a copy of your data. Use "Export my data" in the app, which generates a downloadable archive (available for 24 hours).
- Deletion — delete your account via "Delete my account" in the app. After a 30-day grace period, all your data is permanently removed.
- Rectification — correct inaccurate data by contacting us.
- Portability — your data export includes your photos and account information in standard formats.
- Object / restrict — contact us to object to or restrict specific processing.
- Withdraw consent — for consent-based processing (waitlist), unsubscribe at any time.
- Lodge a complaint — you may file a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC). If you reside in the EU/EEA, you may also contact your local data protection authority.
To exercise any right, use the in-app controls or email [email protected]. We will respond within 30 days.
5a. Automated decisions
We do not make automated individual decisions that produce legal effects or similarly significant effects on you. Photo selection is deterministic but is a display preference, not a decision about your rights or interests.
6. International transfers
Your data is primarily stored in Cloudflare's EU infrastructure (Western Europe). Phone verification via Twilio involves a data transfer to the US under Standard Contractual Clauses. Mollie processes payments within the EU (Netherlands). We do not transfer data to jurisdictions without adequate protections unless covered by appropriate safeguards.
7. Analytics
We use Cloudflare Web Analytics — a privacy-friendly, cookieless analytics service that counts visits without tracking individuals. There are no advertising cookies, no retargeting, and no third-party tracking scripts.
8. Children
Still Near requires users to be at least 18 years old. We verify age at signup and do not knowingly collect data from anyone under 18. If we discover an underage account, we will delete it promptly.
9. Changes to this policy
We may update this policy as the product evolves. Material changes will be communicated through the app or by email. The "last updated" date at the top reflects the most recent revision.
10. Contact
For privacy questions or to exercise your data rights:
- Email: [email protected]
- General: [email protected]
Evert Smit
Wydaeckerring 53
8047 Zürich, Switzerland