Last updated 9 August 2026
Still holds quiet, personal things — notes, moods, goals. Here is how that is looked after.
All traffic to Still is served over HTTPS. Planner data is stored in a managed Postgres database with encryption at rest provided by the hosting platform.
Every planner row is guarded by row-level security tied to your account ID. A signed-in account can read and write only its own planner, profile and plan — this is enforced by the database itself, not just by the app.
Authentication is handled by a managed auth provider. Passwords are never stored by Still in any readable form, and Google sign-in is supported so you can avoid a password altogether.
You can use Still without an account. In that mode your planner never leaves your browser.
Deleting your account removes your planner, profile and plan record, and closes the sign-in account itself. It is not reversible.
If you find a security issue, please email security@stillplanner.com with enough detail to reproduce it. Please don't publicly disclose it before we've had a chance to fix it, and please don't access or modify anyone else's data while testing. We'll acknowledge reports and keep you posted on the fix. For non-security questions, use hello@stillplanner.com.