I decided not to hold your data — how I removed the account itself

Last time, I wrote: "your material never leaves the device." Today picks up from there — why I held to that, and what I gave up for it.

To put the conclusion first: STIL. has no sign-up. It never asks for your email or a password. It wasn't always that way; right after release, I removed the very idea of an account.

Holding an account means holding data

Until partway through development, STIL. had an ordinary sign-up too. Make an account with your email, log in, use the app — the usual shape.

But as I built it, it started to feel wrong. STIL. is an app built around never letting your videos or photos leave the device. And yet, at the front door, I was collecting email addresses. Saying I won't hold your material, while holding your personal data. The two would not line up.

An email address is real personal data. Collect it, and you inherit a duty to protect it: don't leak it, don't misuse it, delete it on request. Carrying that duty is only right — but if you never hold it, there's nothing to protect. The safest data is the data you never had.

Removing it didn't break the app

The question was whether removing accounts would break anything. The more I looked, the clearer it became: every major feature stands without a custom account.

• Pro billing is tied to your Apple ID by StoreKit 2. I don't need to hold any membership info.
• Sync across devices can use CloudKit. It syncs inside your own iCloud, so my server isn't needed.
• AI processing was on-device from the start. No server, and no identifier to tell users apart.

In other words, there was nowhere I actually needed to sit in the middle holding personal data. So it was better not to. Right after release, while not a single user had arrived yet, I tore the sign-up out. Remove it after users arrive and you create work — "please delete my account," "migrate my data." If it was going to go, it had to be now.

A single line: "Data Not Collected"

Removing sign-up meant the App Store privacy label became "Data Not Collected."

That's a quiet certificate, sitting there on the store page. More than any flashy copy, that one line says what I want STIL. to say. Your material never leaves the device. And I don't even know who you are. That's fine. That's the point.

I stopped counting

One more decision grew out of this. The AI features in STIL. are all free, with no usage limits.

Run AI in the cloud and every use costs server money, so the usual move is to count — "free up to N times a month." But STIL. runs its AI inside the device, so no matter how many times it's used, my cost is zero. Why count something that costs nothing? If there's no reason to count, stop counting.

Once I thought that through, my whole approach to charging changed too. Not "pay to use the AI," but Pro as the features for carrying the frame you made out as a finished piece — but that's for another post.

A design that holds nothing

Privacy is easy if you only say it in the copy. To actually keep it, you have to change the design so you don't even have to say it. Don't collect. Don't hold. Don't have. I built STIL. backwards from there.

Next, something a little more relaxed: how the film colours inside STIL. are, in fact, my own obsessions.

You'll find STIL. at stil.photo, and the app on the App Store.