A LITTLE TRANSPARENCY

Your life.
Your data.

Still is an experimental reflection tool made by Gaurav Sharma. This page describes this version of the service. It is intended for adults aged 18 and older.

The profiles you connect

Still does not ask you to describe yourself or fill out a questionnaire. You choose X, Spotify, or both, authorize each account directly, and separately consent to a portrait.

X provides a sample of up to 300 of your recent posts and replies, excluding reposts. Spotify provides available top artists and tracks over short and long periods, and up to 50 recent listening events. These are limited samples, not complete histories. Still does not request private messages, browsing history, private likes, audio files, or lyrics.

What happens when you request a portrait

Only the selected connected accounts are fetched. Their activity is processed on Still’s server and sent through OpenRouter to its selected model provider to generate your portrait. The free router may choose a different provider for each request. The request uses store: false, but that does not guarantee zero data retention. Provider logging, retention, and training practices vary. See OpenRouter’s data collection information and provider logging policies.

Still does not save profile activity or portraits to a database or browser storage, and does not intentionally log them. The portrait remains in the current tab’s memory. Closing or reloading the tab clears it. Hosting providers may retain request metadata under their policies.

Your connection and security

For X, an encrypted, HTTP-only cookie stores the access token and basic profile details for up to two hours or the token’s expiry, whichever is earlier. Spotify uses a separate encrypted cookie lasting up to one hour or token expiry. Each platform has a separate sign-in verification cookie lasting up to ten minutes. No refresh tokens are stored. These cookies are used only for the requested connection. There are no advertising cookies or analytics scripts in this app.

X Disconnect asks X to revoke the token and clears the connection on success. Spotify Disconnect removes the token from Still and clears the displayed portrait. Spotify does not offer the same token revocation endpoint; revoke Still’s grant at spotify.com/account/apps to remove its platform authorization. A link is provided beside the connection. Clearing a portrait does not disconnect accounts.

Rate limiting and other services

Live production analysis uses Upstash Redis to count requests against a SHA-256 hash of the request IP address. The hash is pseudonymous, not anonymous. Counters expire after one hour and are used to limit costs and abuse. Development uses temporary in-memory counters. The service currently allows five analysis requests per IP per hour.

Google Fonts supplies the typefaces and may receive your IP address and browser request metadata when the fonts load. The site includes external links to Gaurav’s website, Lollygag, and, if configured, a payment provider. Those services receive data when you visit them and apply their own policies. Lollygag’s footer placement is the same for everyone; your portrait is not used to choose advertisements.

What a portrait means

AI observations can be wrong. They are prompts for reflection, not a validated psychological assessment, diagnosis, or prediction of aptitude. You decide which observations fit. The example portrait is fictional and never uses your connected accounts.

Keeping, clearing, and contacting

You may save a plain text copy of your portrait to your own device. Use “Clear & start again” or close the tab to clear the app’s in-memory portrait. Still has no stored portrait database to delete from. This does not delete provider-side records or previously downloaded files.

A dedicated privacy contact has not been configured yet. Contact the maker through gauravkr.com. Live launch requires configuring a monitored contact.