Overseas service region

Privacy Policy

Welcome to Sitill. Sitill is an app designed to help you record sitting duration and the state of the moment. We value your personal information and privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information, and how you may exercise your privacy rights.

This Privacy Policy applies to users of Sitill in English-language markets, including the United States, Canada, Australia, Singapore, and other regions where the English version is used.

Data controller: Shenzhen Sitill Technology Co., Ltd. (深圳市坐坐科技有限公司). Privacy contact: support@sitill.com. We determine why and how Sitill processes the personal data described in this Policy; listed service providers process data for us or under their own privacy terms, depending on the service.

Please note that location, camera, photo library, notifications, and record-related information are not enabled by default or required to be provided. We only process such information when you actively choose, authorize, or create records, and only to the extent necessary to provide the related features. If you decline optional information or permissions, only the related feature may be affected. You can still use basic recording, timing, and local statistics features.

1. Information We Collect and Use

Account and Identity Information

When you choose to sign in with Apple or Google, we receive through Supabase Auth the information returned by the third-party account provider that you authorize to share, such as user ID, display name, and avatar URL. When you choose email verification code sign-in, Supabase Auth generates and verifies the code, while Alibaba Cloud DirectMail processes the email address you enter, the message containing the one-time code, and necessary delivery status to send the code directly to your inbox. We use this information to create or sign in to your account, sync data, display your profile, and protect account security.

We do not receive your Apple or Google account password. Email verification codes are used only for the requested authentication.

Device Identifier and Authentication Information

We generate and store a random device ID in Keychain. This ID is used to anonymously identify the device, issue device authentication tokens, sync records, and prevent data from different accounts from being mixed.

This device ID is not used for advertising tracking.

Sitill Records

When you actively create or edit a record, we may process information such as record ID, type, method, purpose tags, start time, end time, duration, closing method, progress status, deletion status, public status, mood text, location label, photo path, or photo URL.

We use this information for records, history, statistics, achievements, offline storage, and cloud sync.

Location Information

When you choose a place in a record or enable precise location, the app requests iOS location permission. After authorization, we may collect the current latitude and longitude to save the location of that specific record.

Location access is optional. If you do not enable location permission, basic timing and recording features will not be affected.

Photos, Camera, and Photo Library

When you set an avatar or add photos to a record, the app may request camera or photo library permission.

Avatar images may be stored locally and synced as an avatar URL. Record photos are compressed and cached locally first, and may be uploaded to Supabase Storage when records are synced.

Notifications

When you enable sitting or break reminders, the app requests system notification permission and stores reminder preferences locally to send local reminders.

Usage and Operation Data

To provide online user count, badges, offline upload, account security, and service stability, we may process record progress, sync status, network availability, app and operating-system version, request time, IP address, necessary service logs, and error information.

We do not use this information for advertising profiles or cross-app tracking.

Sign-in Country Suggestion

If this device has no successful sign-in country history and you open the country picker, the app makes an HTTPS request to Country (api.country.is). The request naturally includes your public IP address and the service returns an ISO country or region code. The app reads only that code, does not store the returned IP address or request city or precise location, and never changes your service region automatically. If the request fails, you can still choose manually.

Local Preferences

Language, appearance, unfinished records, nickname, avatar cache, and login status may be stored in UserDefaults, Keychain, or the app sandbox to maintain the normal app experience.

Subscription Information

If you purchase Sitill Pro through the App Store, Apple processes the payment and billing. We do not receive your full payment card information.

We may receive or process subscription status information needed to unlock Pro features, restore purchases, manage subscription access, and maintain the normal operation of paid features.

Sound Playback Statistics

When you use Sitill sounds, we may process sound ID, audio version, playback start and end times, effective listening duration, start or end reason, measurement quality, and an optional link to a Sitill record. We use this information for your listening statistics, playback recovery, and sound-service operation. We do not monitor audio activity in other apps.

Support Communications

If you contact support, we process the message, contact details you choose to provide, and relevant app or device diagnostics to investigate and respond. Providing support information is optional, although we may be unable to reply without a contact method.

Sources and Legal Bases

We receive data directly from you, automatically from your device when a feature communicates with our services, and from Apple, Google, Supabase, and other providers you choose to use. Depending on applicable law, we process data to perform our contract with you (account, sync, and subscription features), with your consent (optional permissions and content), for legitimate interests that do not override your rights (security, fraud prevention, reliability, and support), and to comply with legal obligations. You may withdraw consent at any time; this does not affect earlier lawful processing.

2. Permission Usage

Location Permission: Used to record the place where you sit during a Sitill session.

Camera Permission: Used to take photos of what you see, or to set your profile avatar.

Photo Library Permission: Used to add images to your records, or to change your profile avatar.

Notification Permission: Used to send break reminders and gently remind you to get up and move when you have been sitting for too long.

You may turn off these permissions at any time in iOS Settings. After a permission is turned off, the related feature may no longer be available, but other basic features will not be affected.

3. Third-Party Services

We currently use the following third-party services:

Apple Sign In

Apple Sign In, provided by Apple Inc., is used for Apple account login. It may process Apple user identifiers, authorization tokens, display name, and related information according to Apple’s privacy policy.

Google Sign-In

Google Sign-In, provided by Google LLC, is used for Google account login. It may process Google user identifiers, authorization tokens, display name, avatar URL, and related information according to Google’s privacy policy.

Supabase

Supabase, provided by Supabase Pte. Ltd., is used for authentication, database, edge functions, object storage, and cloud sync. It may process account ID, device ID, Sitill records, avatar or record photos, sync logs, and related information under our instructions. Privacy information: https://supabase.com/privacy

If an Apple account is not found in the selected region, we ask for separate consent before sending this sign-in's Apple identity token and verification nonce to our other service region to find and sign in to an existing account. No Sitill records are included. If neither region has an account, one is created in the selected region. You can decline and choose your previous country or region manually.

Alibaba Cloud DirectMail

Alibaba Cloud DirectMail is used only to deliver transactional verification-code emails for overseas email sign-in. It may process the recipient email address, the message containing the one-time code, delivery status, and necessary mail logs. It does not receive Sitill records. Service information: https://www.alibabacloud.com/help/en/direct-mail/

Country IP-to-Country Service

Country (api.country.is) is contacted only when the device has no successful sign-in country history and you open the country picker. It uses the request's public IP address to return an ISO country or region code for an optional suggestion. Sitill does not store the returned IP address or request precise location. Service information: https://country.is/

Apple Maps

When you request your current location or search nearby places, Apple's MapKit service may process location, search terms, and device or network information needed to return map results. Privacy information: https://www.apple.com/legal/privacy/

Apple App Store

If you purchase Sitill Pro, Apple processes App Store subscriptions, payments, renewals, cancellations, refunds, and purchase restoration. We only receive information necessary to confirm subscription status and provide paid features.

Other than the services listed above, Sitill currently does not use advertising SDKs, does not enable cross-app or cross-website tracking under App Tracking Transparency, and does not sell personal information.

4. Storage and Retention

Sitill records are stored locally on your device by default. If you sign in or use sync, account data, Sitill records, photos, and necessary operational data are transmitted securely to our overseas Supabase project. Supabase and its infrastructure subprocessors may process customer data in the project region and other locations needed to operate and secure the service. Alibaba Cloud DirectMail processes verification-email data through its mail infrastructure. Apple, Google, and Country process data when you choose or trigger their respective features.

Your data may therefore be processed outside your country or region, including in China and in locations where Supabase and its subprocessors operate. Where applicable law requires safeguards for an international transfer, we use the provider's contractual and technical safeguards and complete any other required steps. Contact us if you need information about safeguards relevant to your location.

Local data is retained until you actively delete it, clear it by signing out, or uninstall the app.

Account data is retained while your account exists. After you request account deletion, your account enters a 30-day cooling-off period. After the cooling-off period ends, we will delete or anonymize your account data within a reasonable time, unless retention is required by applicable law.

Record photos may be stored in local cache or Supabase Storage. When you delete records, delete your account, or contact us to request deletion, we will delete or anonymize the relevant data within a reasonable time.

One-time verification codes are retained only for the short period needed for authentication. Security, delivery, and audit logs are retained only as long as needed for security, service operation, dispute handling, or legal obligations. Data that cannot be removed immediately from protected backups is isolated from normal use and deleted through the backup lifecycle.

5. Security

We use HTTPS/TLS transmission, Keychain storage for device ID and authentication tokens, app sandbox isolation, local file access restrictions, and Supabase row-level security policies to protect your personal information.

Please understand that no internet environment is absolutely secure. If a personal information security incident occurs, we will take remedial measures as required by applicable law and notify you through in-app notice, email, or other reasonable methods.

6. Sharing, Transfer, and Public Disclosure

We do not sell or rent your personal information. Except for third-party services necessary for login, sync, storage, subscription access, and related app features, we do not actively share your personal information with third parties.

We may share, transfer, or disclose relevant information when required by law, legal process, judicial or administrative authorities, to protect the significant legal interests of you or other users, to handle security incidents, or in connection with a merger, division, or asset transfer.

When such sharing, transfer, or disclosure occurs, we will require the recipient to protect your personal information at a standard no lower than this Privacy Policy.

We do not use personal data for decisions that produce legal or similarly significant effects, and we do not use your Sitill records for advertising.

7. Your Choices and Rights

You may view, edit, or delete Sitill records in the app, change your nickname and avatar, sign out, or request account deletion.

You may revoke location, camera, photo library, and notification permissions through iOS Settings. After revocation, we will no longer collect information based on that permission.

You may contact us to request access to, correction of, deletion of, or a copy of your personal information, to withdraw consent, to delete your account, or to ask questions or make complaints about this Privacy Policy.

We may need to verify your identity before processing your request. We will respond within the period required by applicable law.

You may submit a request through in-app account controls where available or by emailing support@sitill.com. We do not discriminate against you for exercising an applicable privacy right. If we deny a request under a legal exception, we will explain the reason and available appeal or complaint route where required.

8. Regional Privacy Rights

United States Users

Depending on your state of residence, you may have the right to know, access, correct, delete, or receive a copy of certain personal information. You may also have the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising.

Sitill does not sell personal information and does not share personal information for cross-context behavioral advertising. If our practices change, we will update this Privacy Policy and provide appropriate choices.

If applicable state law gives you a right to appeal our decision on a privacy request, reply to our decision email and state that you wish to appeal. We will provide the result and any regulator complaint route required by that law.

EEA, United Kingdom, and Switzerland Users

You may have rights to access, rectify, erase, restrict or object to processing, and receive portable data, as well as the right to withdraw consent and complain to your local data protection authority. Our legal bases are described under Sources and Legal Bases. International transfers are handled as described under Storage and Retention.

Canada Users

If you are located in Canada, you may request access to or correction of your personal information. You may also withdraw consent for optional permissions or processing, subject to legal or contractual restrictions and reasonable notice.

Withdrawing consent may affect the related feature but will not affect unrelated basic functions.

Australia Users

If you are located in Australia, you may request access to or correction of your personal information. For a privacy complaint, email support@sitill.com with enough detail for us to investigate. We aim to acknowledge and respond within a reasonable period, generally within 30 days. If you remain dissatisfied, you may contact the Office of the Australian Information Commissioner.

Your information may be processed outside Australia by providers described in this Policy. The exact locations can change with provider infrastructure; contact us for current information relevant to your data. Where overseas disclosure occurs, we take reasonable steps required by applicable law to protect the information.

Singapore Users

If you are located in Singapore, you may request access to or correction of your personal data, and you may withdraw consent for optional processing.

Your personal data may be processed outside Singapore by service providers such as Supabase and Alibaba Cloud DirectMail. Where this occurs, we take reasonable steps to ensure that the transferred data receives a comparable standard of protection.

9. Children’s Privacy

Sitill is not directed to children under 13, or below a higher minimum age required by local law. A child below the applicable age should not create an account or use cloud features unless a parent or guardian can validly authorize that use under local law.

If you are a guardian and believe that a child’s personal data was collected without valid authorization, contact us so we can delete it or take other necessary measures.

10. Changes to This Privacy Policy

We may update this Privacy Policy due to changes in product features, legal requirements, or third-party services.

If there are material changes, we will notify you through in-app pages, pop-ups, release notes, or other reasonable methods.

11. Contact Us

If you have questions about this Privacy Policy or personal information protection, please contact us at:

Email: support@sitill.com