STILLSKY — PRIVACY POLICY

last updated 5 July 2026 · the short honest version

1 · what we collect, and why

• Your account: a pseudonymous username, an email (for sign-in and recovery), and a password — which we store only as a salted one-way hash, never in readable form. Past usernames stay linked to your profile as its lineage.
• If you submit a project: the link, your username, an optional email so we can tell you when your star goes live, and the time of submission.
• If you comment or post on a wall: the text, your username, and an optional email so replies can reach you (it is never shown publicly).
• If you connect with builders: the connection between your account and theirs, and notifications generated for you (replies, wall posts, connection requests). Your connection count is public; the list of who you're connected to is visible on your profile.
• If you send feedback: your note, an optional email to reply to, and any screenshot you attach.
• Your IP address is held briefly to rate-limit spam and stored with submissions, comments, and reports so abuse can be traced. It is never shown publicly.
• We don't ask for real names, dates of birth, phone numbers, or any payment details.

2 · what stays in your browser only

Your sign-in token, kept-stars list, sound preference, seen-stars, remembered username and email, and anything you've reported live in your browser's localStorage. They leave your device only when you take an action that needs them (signing in, posting, commenting). Clearing site data erases them and signs you out.

3 · what's public

Approved stars show: project name, link, one-liner, category, city, drop date, the builder's username, and its lineage. Comments and wall posts show their text, username, and time. Profile pictures are public. Emails, IP addresses, and password hashes are never exposed in any public page or API response. Assume anything else you post is public.

4 · analytics

Stillsky records which stars are opened and for how long, to understand what's worth keeping in the sky. Two systems see these events: our own first-party counters, and Google Analytics — fed server-side, meaning no Google scripts or cookies ever load in your browser. What Google receives is the event name, the star involved, and a pseudonymous identifier that rotates daily and can't be linked back to you across days. Known bots are weeded out before counting. No advertising trackers on the page, no data sales — ever.

5 · cookies

The only cookie Stillsky sets is for the curator's own admin login. Ordinary visitors get no tracking cookies at all — preferences and sign-in live in localStorage, described above.

6 · email

We send transactional email through Resend: approval notices, reply notifications, sign-in and password-reset links. We don't send marketing email. If you opted into the weekly digest, your address is stored for that alone and you can ask us to drop it anytime.

7 · embedded projects

Opening a star loads that project's site inside a sandboxed frame. From that moment you're also subject to that site's practices — Stillsky can't see or control what happens inside the frame.

8 · retention & deletion

We keep your data while your account and stars exist. Analytics events expire automatically after about 90 days. Want your project, account, comments, or lineage removed? One mail: madhavsethiwork@gmail.com — it'll be deleted from the sky and the data store.

9 · where it lives

Stillsky runs on Cloudflare's network; your data is stored in Cloudflare's key-value store and processed on their edge. No data is sold or shared with anyone beyond the service providers named here (Cloudflare, Resend, Google Analytics) strictly to run the site.

Drafted with AI assistance; not yet lawyer-reviewed. If Stillsky takes off — or takes on users in stricter jurisdictions — this page graduates with it.