Privacy Policy

1. Data Controller

The party responsible for data processing on this website/app is:

Vitalli, Inhaber Mirco Stege
Höllenberg 12
21441 Garstedt
Germany
E-Mail: hello@vitalli.app

2. Data We Collect

When using Still, the following personal data is processed:

2.1 Account Data

• Email address: for identification and login
• Password: stored only as a hash (bcrypt)
• Display name: optional, visible to buddies

2.2 Usage Data

• Fasting events: timestamps when you start fasting or eating
• Fasting templates: the templates you chose
• Notification settings: your preferences
• Activity log: actions you perform in the app
• Confirmation of the safety notice before your first fast: that you confirmed and when, plus the version of the notice — no information about any condition

2.3 Social Data

• Buddies: when you connect with other people

2.4 Health Data (Special Category)

Fasting data and derived physiological states (such as ketosis, autophagy, or fat burning) qualify as health data under GDPR Art. 9. This data receives special protection. In expert mode, during a running fast, Still reads from Vora (Vitalli): glucose, ketones and GKI, pulse and weight (including the 30 days before the fast as a personal baseline), and logged symptoms. These are used to compute the phases shown; those values read from Vora are not stored by Still. What you enter in Still yourself – glucose, ketones, pulse or weight – is stored in Still and passed on to your Vitalli health record in Vora so both apps show the same state; Vora belongs to the same controller and is located in the EU. Markers from your health record – such as diabetes, insulin, SGLT2 inhibitors or gout – are no longer requested or processed by Still as of 11 October 2026.

• Fasting periods: start and end timestamps of your fasting sessions
• Physiological signals: derived states such as ketosis, autophagy, and fat burning phases
• Fasting templates: your chosen fasting protocols (e.g. 16:8, OMAD)
• Read from Vora in expert mode, during a fast only, not stored: glucose, ketones, GKI, pulse, weight and logged symptoms

Processing of health data is based on your explicit consent (GDPR Art. 9(2)(a)). You provide this consent when you first use the app.

You can withdraw your consent at any time from the Settings page. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

3. Legal Basis

Processing is based on the following legal grounds:

• Art. 6(1)(b) GDPR: Contract performance (providing app features)
• Art. 9(2)(a) GDPR: Explicit consent for processing health data (fasting periods, physiological signals)
• Art. 6(1)(a) and Art. 9(2)(a) GDPR: Consent for the beta analysis of health-related events (for example, that you started a fast). Without that consent we do not send such events at all – neither anonymised nor as a count.
• Art. 6(1)(f) GDPR: Legitimate interest in secure, error-free operation (sign-ins, error reports, page views without a health context)

4. Cookies and Session Data

Still only sets cookies that are needed to run the app or that remember a setting you chose yourself – none for measuring, cross-site recognition or advertising. Here they are, in full:

• authjs.session-token: your sign-in token (JWT), valid for 30 days – so you stay signed in
• still-consent: records which version of the Art. 9 GDPR consent you confirmed, so the dialog does not reappear on every visit. It contains your Still account ID and a signature so that it only applies to your account, and it is removed when you sign out or delete your account
• still-locale: your language choice, for one year. It is set only when you actively pick a language. If your browser merely states one, we follow that – but store nothing for it, because that statement arrives with every request anyway
• __Host-authjs.csrf-token and __Secure-authjs.callback-url: set by the sign-in library as soon as the sign-in page is prepared. The first protects the form against cross-site submission (CSRF), the second remembers where you wanted to return to after signing in. Both HttpOnly and HTTPS-only
• authjs.state and authjs.pkce.code_verifier: only for the duration of a sign-in via Vitalli, Google or Apple. They secure the return leg against injection (PKCE) and are discarded afterwards
• still-admin-mfa: only for the operator interface after a sign-in with a second factor. Ordinary use never sets it

We do not use tracking, advertising or third-party cookies. Usage analytics (see “Services we use”) runs exclusively server-side; it stores nothing on your device itself. The feedback widget, by contrast, places a random visitor ID in localStorage once you open it – see “Services we use”.

5. Data Storage

Your data is stored on servers within the EU. Data is retained as long as your account exists.

We store analysis events for two years. If you delete your Vitalli account, the events are anonymised: the link to you is deleted in every field and cannot be restored. What remains is a count with no personal reference.

6. Services We Use / Processors

We use the following services to operate Still:

• Railway (Railway Corp., hosting in the EU, Amsterdam data centre): runs the app and its database. Legal basis: Art. 6(1)(b) GDPR.
• Cloudflare, Inc., USA (network and protection against attacks): requests to Still pass through Cloudflare's network before they reach our server. Cloudflare processes the connection data technically required for this, such as IP address, requested address, browser identifier and time, and forwards the request; for this the encrypted connection is decrypted and re-encrypted at Cloudflare. The purpose is fast delivery and defence against attacks. Cloudflare is certified under the EU-U.S. Data Privacy Framework; the transfer to the USA relies on this (adequacy decision of the European Commission), alternatively on the standard contractual clauses in Cloudflare's data processing agreement. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation).
• Apple Push Notification Service (Apple): if you use the iOS app and allow notifications, we store the device token Apple issues for this and deliver notifications through this service, currently the notice that someone has invited you as a buddy, with their display name. Apple receives the device token and the text of the notification. According to Apple's privacy policy, Apple Distribution International Ltd. (Ireland) is responsible for data from the EEA; transfers to the USA rely on standard contractual clauses there. Legal basis: Art. 6(1)(b) GDPR. You can turn notifications off at any time in your device settings; we delete the token together with your account.
• Web push services of the browser makers: if you allow notifications in the browser or the installed web app, we store the push address your browser creates for this and send notifications through your browser's push service, for example about fasting phases reached, the fasting goal reached or buddy invitations. Which service that is depends on your browser, not on Still: Google for Chrome and other Chromium browsers, Mozilla for Firefox, Apple for Safari, Microsoft for Edge; the providers are mostly based in the USA. The content of each notification is end-to-end encrypted (Web Push encryption under RFC 8291) and readable only on your device; the push service sees the push address, the time and the size of the message. The privacy terms of your browser maker apply. Legal basis: Art. 6(1)(b) GDPR, for notifications about the ongoing fast additionally your consent to the processing of health data (Art. 9(2)(a) GDPR). You can turn notifications off at any time in the Still settings or in your browser.
• Uptik (usage analytics, operated by Vitalli, owner Mirco Stege, hosted on Railway in the EU/Amsterdam): our server reports which features are used. Without your consent those are health-neutral events only – sign-in, account creation, account deletion, errors, and page views with a simplified path, excluding the fasting history, the statistics and the sharing view. Only with your consent to the beta analysis do health-related events get added (fast started or ended, template chosen, measurement recorded, buddy added, onboarding completed, app installed) – always only THAT and WHEN something happened, never templates, durations or measured values. Two of these events (app installed, onboarding completed) are triggered by your browser; they are sent by our server, not by an analytics script. Browser, operating system, device type and language setting are sent along; we no longer send the country of origin as of 11 October 2026. Events are linked to a pseudonymous identifier (your Vitalli account ID); we do not send your email address with them. Uptik itself sets no cookies and stores nothing on your device; IP addresses are not transmitted. Legal basis: for the health-related events your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR), for the rest our legitimate interest in secure operation (Art. 6(1)(f) GDPR). You can withdraw the consent at any time in your Vitalli account settings at auth.vitalli.app – with effect for the future; without it you keep using Still unchanged.
• IdeaQ (feedback widget, operated by Vitalli, owner Mirco Stege, hosted on Railway in the EU): the widget is only loaded when you open the feedback form. From then on it stores a random visitor ID in your browser's localStorage to recognise your submissions. In the feedback window you can attach a screenshot. This is off by default; an image is only captured if you tick the box – this app can neither trigger nor preselect a capture. A screenshot can show health data. The feedback window shows whether screenshots are currently accepted. An attached screenshot is stored by IdeaQ; the images are kept in Cloudflare R2 object storage, which is not tied to a location in the EU. Your message and console error messages are only transmitted if you submit the feedback. Feedback entries are not deleted automatically; how long an entry remains is for IdeaQ, as the operator of that tool, to decide. Legal basis: Art. 6(1)(a) GDPR (consent; for a screenshot, insofar as it shows health data, additionally Art. 9(2)(a) GDPR) or Art. 6(1)(f) GDPR (handling your feedback).
• Anthropic PBC, USA (triage of feedback): what is transmitted is the feedback text and, if you attached one, the screenshot – a screenshot can show whatever is on your screen at that moment, including health data. Anthropic processes this as a processor and, under the terms of its API, does not use it to train its own models. The transfer to the USA relies on the European Commission's standard contractual clauses. Legal basis: Art. 6(1)(f) GDPR (handling your feedback), for an attached screenshot your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR). Without feedback, nothing leaves the app.
• Google Ireland Limited (signing in with Google): only if you choose „Continue with Google“. Your browser is then sent to Google, and we receive your name, your email address and a Google identifier from there in order to create or recognise your account. What data Google itself processes during that step is Google's decision; Google's privacy policy applies to it, and processing in the USA is possible. Fasting data, measurements and buddy names never go to Google. If you choose „Sign in with Vitalli“ or email and password instead, Google is not contacted at all. Legal basis: Art. 6(1)(b) GDPR (creating and running your access).
• AI assistants via the Vitalli interface: if you connect an AI assistant in your Vitalli account, it can reach your Still data through a secured interface – reading (current fasting state, summary, fasting history, available templates) and writing (start and end a fast, choose a template, record a measurement). The fasting history is health data under Art. 9 GDPR. Every access is logged. Which provider is behind the assistant, and where it processes – usually a third country outside the EU – follows from your choice of assistant, not from Still; you will find those details with that provider. The same applies to whether it reuses the data it retrieved, for training for instance: we have no contract with it and cannot restrict that – it follows from its terms alone. None of this happens without a connected assistant; you can connect and disconnect it at any time in your Vitalli account. Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR – the consent you give by connecting it.

7. Your Rights

You have the following rights regarding your data:

• Access: Know what data is stored about you
• Rectification: Correct inaccurate data
• Erasure: Delete your data ("right to be forgotten")
• Restriction: Restrict processing
• Data portability: Export your data
• Objection: Object to certain processing
• Withdrawal: Take back a consent at any time – the one for health data in the app settings, the one for the beta analysis in your Vitalli account settings at auth.vitalli.app

To exercise your rights, contact us at the email address above.

8. Right to Complain

You have the right to lodge a complaint with a data protection supervisory authority – either with the authority responsible for us (Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover) or with the authority where you live.

9. Data Security

We implement technical and organizational measures:

• Encrypted transmission (HTTPS/TLS)
• Passwords stored only as hash (bcrypt)
• Regular security updates

10. Minimum Age

Still may only be used from the age of 18. The minimum age is confirmed when your Vitalli account is created; we do not collect a date of birth.

11. Changes

This privacy policy may be updated. The current version is always available on this page.