Privacy Notice

1. Who we are

Still Waters is operated by Crescent Alliance Ltd ("Crescent Alliance", "we", "us"). Crescent Alliance Ltd is the data controller for the personal data described in this notice.

2. What we collect

• Account details: email address and login credentials;
• Your content: saved passages, personal passages, notes, affirmations, and journal entries;
• Preferences: chosen voice, mood, music and alert settings, timezone;
• Usage data: daily read-aloud counts used to apply fair-use limits;
• Technical data: device identifiers, IP address, browser type, and push-notification tokens.

Payment details are collected and processed by Paddle (our Merchant of Record), not by us.

3. Why we use it (legal basis)

• To create and run your account and provide the service (performance of a contract);
• To send daily reminders and "Daily Stillness" emails you switch on (contract / consent — you can turn them off at any time);
• To keep the service secure and prevent fraud or abuse (legitimate interests);
• To improve the service through aggregated, non-identifying usage insight (legitimate interests);
• To meet legal obligations such as accounting and tax records (legal obligation).

4. Who we share it with

• Service providers who host and operate the app (cloud hosting, database, authentication, email delivery, and text-to-speech processing);
• Paddle, our Merchant of Record, for the sale of subscriptions, payments, tax compliance, and invoicing;
• Professional advisers (legal, accounting) where needed;
• Authorities where required by law.

We never sell your personal data.

5. International transfers

Some providers process data outside the UK/EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

6. Retention

We keep your data while your account is active. When it is no longer needed — for example after you delete your account — we delete or anonymise it, except records we must keep by law.

7. Your rights

Under UK GDPR you have the right to access, correct, erase, restrict, or port your personal data, to object to processing, and to withdraw consent at any time. We respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO). To exercise any right, contact us via the support details shown in the app.

8. Security

We apply appropriate technical and organisational measures, including encryption in transit, row-level access controls in our database, and restricted access to production systems.

9. Cookies and storage

We use essential cookies and local storage only — to keep you signed in, remember your preferences, and apply guest usage limits. We do not use analytics or marketing cookies. You can clear them in your browser settings, though sign-in will be lost.