Privacy policy
Effective 25 October 2026. Last updated 25 October 2026.
This policy explains what the Still Kicking app does with personal data: yours if you use it, and that of the people you add as your contacts. It also covers this website.
1. Who we are
Still Kicking is made and published by Ahmed Bassiouny, an individual developer ("we", "us"). We decide how personal data in Still Kicking is used, which makes us its controller under data protection law, including the EU General Data Protection Regulation (GDPR). We haven't appointed a data protection officer.
To reach us, write to privacy@stillkicking.app about anything to do with privacy, or support@stillkicking.app about anything else.
2. The short version
- There's no account. We don't know who you are.
- Your schedule, your check-ins and your contacts' details are kept on your phone.
- The main thing that leaves it is your alert email. Each check-in queues a new one with our email service and cancels the last, so one is always waiting. The service keeps copies of these emails, sent or cancelled, for up to 30 days, in the US.
- Our server keeps no names or email addresses. It keeps usage counters to stop abuse, filed under scrambled codes. They stay while you use the app and are deleted a few days after you stop. To stop anyone flooding an inbox, it sometimes also keeps a scrambled form of a contact's address, for up to about two days. If a contact asks us to stop emailing them, it keeps a scrambled form of their address until they ask us to undo it.
- No ads, no analytics, no tracking. The app doesn't use your location and doesn't read your address book.
3. What stays on your phone
The app keeps these on your phone only:
- your check-in schedule (the time, how often, and your grace time), your check-in times and any pause dates;
- your first name, your time zone and whether you use a 12- or 24-hour clock;
- your contacts' names and email addresses, and when you sent each one a heads-up;
- a random install number the app makes up, which identifies this copy of the app and nothing else;
- the details our server and email service need to cancel your queued alert, recent alert events, and your plan's status (including the end date of an access code, if you used one).
None of this is included in your phone's backups or moved to a new phone, so a new phone starts setup from scratch.
Delete everything (Settings › Privacy & data) removes all of this from your phone and cancels your queued alert. It needs a moment online to cancel the alert. It doesn't cancel your subscription, or remove Google Play's and RevenueCat's records (see section 4).
If you delete the app, or move to a new phone, without using Delete everything first, your last queued alert stays queued and will go out once.
When the iPhone version arrives, it will also keep a small record of your queued alert in the phone's keychain, for this device only: its ids, cancel codes and send time, your install number, your last check-in time and your contacts' names, but no email addresses. The keychain outlives the app, so reinstalling on the same iPhone can cancel the alert the old copy left queued. The record is cleared when no alert is queued, and by Delete everything.
4. What leaves your phone
Your alert email
Whenever you check in, change your settings, pause or resume, the app asks our server to queue a new alert email for your next deadline plus grace time, and to cancel the one before it. So there is always one alert waiting, and it goes out on time even if your phone is off or lost.
Each queued email contains: the contact's name and email address, your first name, when you last checked in, when your check-in was due, and whether you check in daily or on another schedule. Your phone also sends its time zone and clock setting, so the times read correctly. The email comes from alerts@mail.stillkicking.app with your first name on it ("Sam via Still Kicking").
The wording is fixed. You can't add a message of your own, so only names, times, how often you check in and the contact's own details differ from one email to the next.
Our email service, Resend, sends from the EU (Ireland) but stores its data in the United States. It keeps every email we queue or send, including the alerts a later check-in cancelled, for up to 30 days, so for that time its copies show your recent check-in times and your contacts' names and addresses. It also records whether each email was delivered, bounced or marked as spam. Transfers to Resend are covered by the EU-US Data Privacy Framework and standard contractual clauses. Open and click tracking is switched off, so the emails carry no tracking pixels or tracked links.
Everything is encrypted between your phone, our server and Resend. The last step, to your contact's inbox, is encrypted whenever their email provider supports it, as almost all do. It isn't end-to-end encrypted, because the email service has to read an email to send it.
Two other emails take the same path. A test alert, if you send one from Settings, goes to your contacts straight away. An all-clear goes out if you check in within 24 hours of an alert being sent: our server asks Resend which address the alert went to and sends the all-clear there.
Every email ends with a line telling the contact they can object, and a link to stop the emails (see section 6).
Checking that requests come from the real app
Before your phone talks to our server, it gets a token from Firebase App Check. On Android, App Check uses Google Play Integrity to confirm the request comes from the genuine app on a genuine device; on iPhone it will use Apple's App Attest. Google or Apple look at information about your device and the app to do this, under their own terms. Our server only sees whether the token is valid.
Your subscription
Google Play handles the purchase and payment; we never see your card or your Google account. Google acts as a separate controller under its own privacy policy. (The App Store will do the same when the iPhone version arrives.)
RevenueCat, a US company, checks your subscription status for us. It receives an anonymous id the app creates, your purchase receipts and subscription status, and the technical details any app request carries, such as the app and system version and your phone's IP address. It never receives your install number. Transfers to RevenueCat are covered by standard contractual clauses.
Access codes
If you enter an access code (given to app store reviewers), it's sent once to our server, compared and never stored or logged. Its end date is kept on your phone.
Things that never leave your phone
- Reminders are scheduled on your phone. No push service is involved.
- The heads-up message the app writes for your contacts is sent by you, from your phone, using whichever app you choose. We don't see it.
- Choose from contacts opens your phone's own contact picker. The app receives only the name and email of the one person you pick, and never asks for access to your address book.
5. What our server keeps
Our server runs on Google Cloud (Firebase) in Belgium (europe-west1). Requests carry your install number and the alert details above. The server passes the alert details to Resend and doesn't store them. It keeps only:
- A usage counter for your install: how many alerts, tests, cancels and access-code tries it made recently, when each counting window started, when you last sent a test, whether it has queued an alert before, and the random ids of the alerts it queued in the last day. It's filed under a keyed hash of your install number (a code made from it with a secret key), never the number itself. Each use sets it to expire 48 hours later, so it lasts while you use the app and is deleted automatically, usually within a day of expiring, once you stop.
- Hourly and daily totals of test emails and first alerts across all users, tied to no one, which cap how much email the service can send in a burst. They're deleted the same way.
- A count per email address, only sometimes. So that nobody can use Still Kicking to flood someone's inbox, no address gets more than 6 of the emails that could be used that way in any 24 hours: test alerts, a phone's first alert, and an alert queued after the one before it had already gone out or been cancelled. When the server counts one of those, it keeps a keyed hash of the address (a code made from it with a secret key, which can't be turned back into the address; only our server can match it, when it sees the same address again) and the times of those emails. Addresses are compared ignoring capitals, "+tags" and, for Gmail, dots. No address, name or install number is stored with it, and it's deleted within about 48 hours of the last counted email. Ordinary check-ins and changes to your settings create none, so most contacts never have one.
- Addresses that asked us to stop. When a contact uses the link in one of our emails, or writes to us, the server keeps a keyed hash of their address (compared ignoring capitals, "+tags" and, for Gmail, dots), so it can leave that address out of every alert, test and all-clear from then on. Nothing else is stored with it: no address, name, install number or reason. It's kept until that person asks us to undo it.
- Logs of each request: a short code derived from your install number, the request's id, the result, the ids Resend gave the emails, and how many emails were queued. They never contain names, email addresses or your install number itself. They're kept for 30 days in Google Cloud Logging, in the EU (Belgium).
Like any server, ours sees your phone's IP address when it connects. We've excluded the request logs that would record it, so callers' IP addresses aren't kept in our logs.
A keyed hash still counts as personal data, and we treat it that way.
6. Your contacts
Your contacts are people too. We get their names and email addresses from you, and use them only to send the alerts, tests and all-clears described here, to apply the limit per address in section 5, and to leave out anyone who asked us to stop. They're never added to a mailing list or used for anything else.
We don't keep your contacts' addresses ourselves, so we can't write to them directly. Instead, our page for contacts is public, every email links to it, and the app asks you to send each person a heads-up that links to it too. Please tell people before you add them.
Every email also tells your contact they can object and links to a page where they can stop the emails, by pressing a button there. Writing to privacy@stillkicking.app from their address works too. After that we send them nothing more, not even an all-clear, and the app tells you and asks you to choose someone else; if nobody is left, it shows that protection is off until you add someone. One alert already queued for them may still go out if you miss a check-in before your app next connects, because we can't find it by their address; your next check-in replaces it. To get the emails again, they write to support@stillkicking.app from that address.
7. This website
This site is a set of plain pages hosted on Firebase Hosting (Google), served through Google's worldwide network. It sets no cookies and has no analytics, ads or third-party scripts; its fonts are served from the site itself. Google processes your IP address to deliver the pages. We haven't turned on visitor logs.
8. Why we're allowed to use it
| What we do | Legal basis (GDPR) |
|---|---|
| Queue, send and cancel your alerts, tests and all-clears | Performing our contract with you (Art. 6(1)(b)) |
| Use your contacts' names and addresses in those emails | Legitimate interests (Art. 6(1)(f)): yours and your contacts' interest in their being told when something may be wrong |
| Usage counters, the limit per address, logs and App Check | Legitimate interests: keeping the service secure and stopping it being used to send unwanted email |
| Keep the list of addresses that asked us to stop | Legal obligation (Art. 6(1)(c)): respecting their objection (Art. 21) for as long as it stands |
| Check your subscription | Performing our contract with you |
| Deliver this website | Legitimate interests in showing it to you |
| Answer your emails to us | Legitimate interests in replying, or our contract with you if it's about the app |
To set up alerts, you need to give a first name and at least one contact's name and email address. Without them the app can't do its job. Nothing else is required.
9. Who else handles it
- Resend, Inc. (US): queues and sends the emails, as our processor.
- ImprovMX (US): receives email sent to privacy@, support@ and review@stillkicking.app and forwards it to our own mailbox, as our processor. It receives mail in France and deletes it once delivered; forwarding may pass through its servers in France or the United States.
- Google (Firebase and Google Cloud): runs our server, its counters and its logs in Belgium, runs App Check and hosts this website, as our processor. The website is served worldwide, so visits may be handled outside the EU; Google LLC is certified under the EU-US Data Privacy Framework and its terms include standard contractual clauses.
- RevenueCat, Inc. (US): checks subscription status, as our processor.
- Google Play (and later the App Store): handles purchases, and checks your device for App Check, under its own terms.
- Your contacts: receive the emails you set up.
You can ask us for a copy of the safeguards that cover transfers outside the EU. We don't sell personal data or share it for advertising. We'd only disclose it to authorities if the law required it.
10. How long it's kept
| Data | Kept |
|---|---|
| Everything on your phone | Until you use Delete everything or remove the app. |
| Your alert emails, at Resend | The queued one waits until it's sent or your next check-in cancels it. Resend keeps copies of every email, sent or cancelled, for up to 30 days. |
| Usage counter for your install, and the overall totals | Expire 48 hours after their last update, then deleted automatically, usually within a day. |
| Count per email address (keyed hash) | Deleted within about 48 hours of the last counted email to that address. Most addresses never have one. |
| Address that asked us to stop (keyed hash) | Until that person asks us to undo it. |
| Server logs | 30 days, in the EU (Belgium). |
| Subscription records | RevenueCat keeps them while we use it, and deletes them if we ask. Google Play keeps its own under its policy. |
| Emails you send us | Until your question is resolved, unless we need them for a legal claim. |
11. Your rights
You can ask to see the personal data we hold about you, to correct it, to delete it, to restrict how we use it, or to receive it in a portable format.
Most of this is in the app. Export my data (Settings › Privacy & data) gives you a file of what the app keeps about you: your name, time zone, contacts, schedule, check-ins, pause, plan status, queued alert, recent alert events and install number. It leaves out only the codes that cancel your alert. The app removes its copy of the file once you've shared it, and Delete everything removes any copy left on the phone. Delete everything removes what the app holds and cancels your queued alert. You can change your name, schedule and contacts at any time in Settings.
Because there's no account, we can't tell which records on our side are yours without your install number. Write to privacy@stillkicking.app for anything the app can't do; we'll answer within one month, free of charge.
Your right to object. Where we rely on legitimate interests, you can object at any time, for reasons relating to your situation. If you use the app, Delete everything stops all of it. If you're someone's contact, use the link at the end of any email from us, or write to us; our page for contacts explains what happens.
You can also complain to a data protection authority: in Ireland, the Data Protection Commission, or the authority where you live or work.
12. Everything else
Automated decisions
We make no decisions about you by automated means that have legal or similarly significant effects. Alerts go out automatically because that's how you set them up, and the server may automatically refuse requests that look like abuse.
Security
Data is encrypted in transit. Our server only answers requests that pass Google's app checks, our keys are held in Google's secret storage, and we keep as little as we can, for as short a time as we can. No system is perfectly secure, so please tell us at privacy@stillkicking.app if you find a problem.
Age
Still Kicking is for adults aged 18 and over. It isn't meant for children.
What Still Kicking isn't
It isn't a medical device or an emergency service, and it collects no health information.
Changes
If we change this policy, we'll update the date at the top. If a change affects what we collect or who we share it with, we'll say so on this page before it takes effect.