The short version
- ✓ No ads, no third-party analytics or trackers, no data broker sales — Steady's servers only talk to your app, and to OpenAI/Google when you turn on the specific feature that needs them.
- ✓ Everything sensitive — contacts, message capture, Gmail, AI — is off by default and stays off until you switch it on yourself, one feature at a time.
- ✓ Message capture only ever reads the apps you explicitly pick. Notifications from anything else are never opened, read, or stored.
- ✓ One tap in Settings permanently deletes your account and every row of data tied to it.
01What we collect
Steady is a personal task, routine, and money-tracking app. Almost everything it stores is content you typed or spoke yourself.
Account information
- Name and email address — used to identify your account and sign you in.
- Password — never stored as plain text. It's run through PBKDF2 with a per-account random salt before it ever touches a database row.
Content you create
- Tasks, routines, checklists, and habit-streak history.
- Spending records, accounts, and budget categories you add.
- Contacts (people) you add manually or import, and the categories you sort tasks into.
Device data
- An encrypted authentication token, stored in your phone's secure keystore (Android Keystore via expo-secure-store) — not in ordinary app storage.
- A local offline copy of your data, so Steady still works without a connection and syncs once you're back online.
02Optional features
Four features in Steady need extra access to be useful. Every one of them is a deliberate, individual opt-in — turning on one does not turn on the others.
03What we never do
Steady does not, under any circumstance:
- Sell, rent, or trade your data to anyone.
- Run advertising or third-party analytics/tracking SDKs — there are none in the app.
- Read, store, or process notifications from an app you haven't explicitly chosen to watch.
- Read Gmail messages from senders you haven't marked to watch, or store a full raw email body.
- Share your capture text, contacts, or task data with an AI provider unless you've personally turned that specific feature on.
04Storage & security
Your account data lives in a Cloudflare Workers + D1 database, reachable only over encrypted HTTPS. A few concrete facts, since "we take security seriously" on its own means nothing:
05Your controls
- Edit or delete anything individually — a task, an expense, a contact — right from the screen it lives on.
- Turn off any optional feature anytime from Settings, independently of the others.
- Disconnect Gmail anytime from Settings → Gmail; this also clears the mailbox-watch state on our side.
- Delete your account anytime from Settings → Account & privacy → Delete account. You'll confirm with your password, and then everything — tasks, routines, spending, contacts, checklists, streaks, and the account itself — is permanently removed from our servers. This cannot be undone and does not wait for a grace period.
06Retention
We keep your data for as long as your account exists. Individually deleted items (a task, an expense, a contact) move to a recoverable Deleted & Activity list inside the app first, so an accidental delete can be undone — deleting your whole account skips that grace period and removes everything immediately.
07Children's privacy
Steady is not directed at children and we do not knowingly collect information from anyone under 13. If you believe a child has created an account, contact us and we'll remove it.
08Changes to this policy
If this policy changes in a way that meaningfully affects what we collect or how we use it, we'll update the effective date above and, where the change is significant, tell you inside the app.