Privacy Policy

• Account basics. Your email address and sign-in credentials.
• Entries you record. Check-ins, 0–10 ratings, free-text reflections, exercise responses, and the timestamps and settings attached to them. Every entry is self-reported, created by you, at a moment you chose.
• Reminder channels, if you turn them on. A browser push subscription, your email address, or a Telegram connection.
• Billing status. Payments are processed by Stripe; card numbers never touch Steadied. We keep your subscription status (for example, trialing, active, or canceled).
• Technical records. Error reports and routine logs of the software doing its job.
• Public website analytics. Plausible counts visits and selected actions on public pages, including signup-button clicks. It receives public page paths, approved campaign and referring-site information, and browser and device information. It does not use analytics cookies or receive your email address, passwords, invitation codes, assessment answers, check-ins, or private app activity.

And what we do not collect: Steadied never connects to your brokerage and holds no positions, balances, or trade history. There are no advertising trackers and no data purchased about you from anyone. The service knows what you tell it.

Each use maps to something you can see in the product:

• To show your readings back to you: the trends, patterns, and exercises that are the service.
• To send reminders you asked for, on the channels you turned on.
• To run the automated safety check described in section 5.
• To keep the service working: error reports tell us what broke.
• To handle billing, and to answer you when you write to support.
• To understand which public pages and signup steps help visitors get started.
• To send necessary service emails, such as receipts, security notices, and notice of changes.

That list is complete. Your entries are not used for advertising, not used to build marketing profiles, and not used to train AI models, ours or anyone else's.

Distress ratings and reflections written on a hard day deserve more care than ordinary app data. Two commitments:

Entries are records of moments, not labels on you. An entry describes a state you noticed at a particular time. The readings and patterns Steadied shows you describe those reports and nothing more. They are never conclusions about who you are, and no profile of you is built or shared.

Access is limited to running the service. Day to day, no person reads your entries. The small team operating Steadied has the technical database access that running any cloud service requires and uses it to operate, support, and fix the service, not to browse reflections. Data is encrypted in transit and stored on managed cloud infrastructure.

Free text you submit is automatically screened, at the moment you submit it, for language associated with a risk of serious harm. If the check matches, the app may temporarily pause access and show crisis resources, and the event is recorded in your account so the pause and its follow-up check-in work properly.

This screening is automated. No person reads your text in real time. It is imperfect: it can miss language it should catch and flag language it should not. It is a safety mechanism, not monitoring, and not an emergency service. If you are in immediate danger, call or text 988 in the United States, or contact your local emergency services.

Steadied runs on a small set of providers. Each receives only what its job requires, and only to do that job:

• Supabase: database hosting. Your account and entries live in a managed cloud database.
• Anthropic: AI processing. Some text you enter is processed through Anthropic's Claude API to generate in-app content, such as drafted prompts and reflections. Anthropic does not use data sent through its API to train its models.
• Stripe: payments. Card details go directly to Stripe; Steadied never sees or stores card numbers.
• Sentry: error monitoring. When something breaks, an error report describes what the software was doing so it can be fixed.
• Plausible: public website measurement. We send only selected events from public pages. We do not send account IDs or use analytics to build advertising audiences. Private app pages are excluded.
• Delivery channels you opt into. Browser push notifications travel through your browser vendor's push service, email through our email delivery provider, and Telegram reminders through Telegram.

Beyond these, personal data is shared only if the law genuinely requires it, or where necessary to protect someone's safety, and in either case, the minimum. If Steadied were ever acquired, this policy would continue to apply to existing data, and you would be notified before anything about that changed.

• We never sell personal data.
• We never share it for advertising, and there are no ads or advertising trackers in the service.
• We never share your entries with other users, employers, brokers, or trading platforms.

Your data is kept while your account exists, which is what lets your history show trends. Delete your account and your entries go with it — check-ins, scans, Pre-Market ratings, debriefs, values, settings, the lot. Residual copies in routine database backups age out on a rolling schedule.

Two kinds of record deliberately outlive the account. You should know what they are before you press delete.

• Crisis-screening records. If the safety scan ever matched something you wrote, that event is kept: the entry that triggered it, the phrase that matched, the category, when it happened, and whether the pause was lifted. It is kept as clinical record-keeping — the same reason a practitioner does not destroy their notes about a risk episode. The link to your account is removed, so what remains is a record of the episode rather than a file on you.
• Billing records. If you ever paid, the subscription record is kept for tax and accounting, for as long as that law requires. The link to your account is removed here too, but the record keeps the reference numbers our payment processor uses, and the processor can still match those to you. That is what makes the record usable in an audit, and it is why we will not claim it is anonymous.

Everything else goes.

• Public website measurement. Our Plausible integration respects your browser's Do Not Track setting. Analytics never blocks browsing or account creation.
• Delete your account, yourself. Settings → Account includes a delete-my-data action that removes your entries and closes the account. It is self-service: no email required, no waiting, no exit interview. The two kinds of record that are kept, and why, are set out in section 08.
• Export your entries. Settings → Account includes a self-service JSON download of the entries available in Steadied's export. You can still ask support@steadied.app for help.
• Tune the channels. Every reminder channel can be turned off where you turned it on.
• Ask us. Write to support@steadied.app to ask what is held about you, to correct something, or for help with any of the above.

Depending on where you live, data-protection law may also give you formal rights: access, correction, deletion, portability, objection. Use the address above; what applies will be honored without hoops.

Your account and app entries are stored on servers in the United States. If you use Steadied from outside the US, those records are transferred to and processed in the United States, where data-protection law may differ from your country's.

Steadied is for adults aged 18 and over. We do not knowingly collect data from anyone under 18; if we learn that we have, we will delete it.

If this policy materially changes, notice comes first, by email or in the app, and the effective date at the top is updated. Quiet edits to material terms are not something we do.

Questions, concerns, or requests about your data: support@steadied.app.

The Terms of Service, available at steadied.app/terms, cover the rest of the relationship.