Sanctuary Data Sovereignty · Effective November 2026

Your inner world is not for sale.

A nervous system cannot soften if it feels surveilled. Stillbloom is engineered from the ground up to exceed the strictest consumer health privacy standards, including the Washington My Health My Data Act (MHMDA), the FTC Health Breach Notification Rule, and GDPR Article 9.

Pillar I On-Device Vault

What stays exclusively on your phone.

All free-text journal entries, three-word unsent releases, personal reflections, and custom notes are written exclusively to your device's local browser database (IndexedDB).

We cannot read your journal even if compelled by subpoena, because your raw text never crosses the network to our servers. Our server-side ingestion schema (Event Contract v1) enforces a strict allowlist that physically rejects any free-text string fields.

Pillar II Decoupled Telemetry

How our adaptive engine works without knowing your name.

To adapt your sanctuary's daily bandwidth and seasonal cadence across sessions, Stillbloom processes only closed-set categorical tokens (such as selecting depleted, soft, or grounded).

In our cloud database (Cloudflare D1), these categorical wellness tokens are keyed solely to a random, pseudonymous cryptographic identifier (engine_id). Your account email and billing identity live in a separate table and are never joined to marketing or third-party systems.

Pillar III Zero Ad Pixels

Zero advertising trackers, zero data brokers.

Up to 87% of mainstream women's health applications embed third-party SDKs that leak cycle or mood events to advertising networks. Stillbloom embeds zero third-party advertising pixels:

Zero Ad SDKs

No Meta Pixel, no TikTok Pixel, no Google Analytics, and no cross-site retargeting beacons on `stillbloom.space` or inside the app.

Zero Data Selling

We never sell, rent, license, or trade consumer health data or emotional states to data brokers or advertisers.

100%

Self-Hosted Fonts

Even our typography (`Bodoni Moda` and `Jost`) is self-hosted directly from our own origin so your IP address is never leaked to external font servers.

Pillar IV Cryptographic Unlink

1-Click Deletion & the UNLINK_ENGINE Protocol.

Under the Washington My Health My Data Act (MHMDA), GDPR Article 17 (Right to Erasure), and the California Consumer Privacy Act (CCPA), you hold absolute sovereignty over your data at every moment:

1. Instant Local Wipe & Export: Inside Stillbloom Settings, you can export your entire local journal as a portable file or wipe your device's local IndexedDB vault in one tap.

2. Cryptographic Server Severance (DELETE /api/account): When you trigger account deletion, our server immediately deletes your authentication credentials, billing records, and encrypted backups, and executes our UNLINK_ENGINE mutation. This replaces your historical engine_id with a freshly generated random cryptographic UUID that is immediately discarded, permanently severing any link between your identity and historical mood tokens.

Submit a Privacy or Sovereignty Request