Steady Privacy Policy
Steady ("we", "us") is a voice-first wellness companion for structured, self-directed ERP-style practice, available at https://steady-erp-voice.vercel.app. This policy explains what data Steady handles, where it lives, and your rights. The short version: your practice data lives in your browser by default, we run no ad tech, and we never sell your data.
1. Browser-local first
By default, Steady stores your practice data — maps, lists, session records, progress snapshots — locally in your own browser (localStorage/IndexedDB on your device). In this mode it never reaches our servers. Clearing your browser storage deletes it; we cannot recover it, and we cannot see it.
2. Optional account and cloud sync
If you choose to create an account (email + password via our authentication API):
- We store your email address and a hashed password (we never store the plain password).
- Your app state (the same practice data described above) is synced to our database so you can continue across devices. Each account's data is scoped to that account.
- You can use Steady without an account; the account is opt-in.
3. Voice sessions
Voice conversations are processed by OpenAI's Realtime API to power the spoken companion:
- Your audio is streamed to OpenAI transiently for processing during the session.
- Under OpenAI's API policy, API data is not used to train OpenAI's models.
- We keep session summaries/records that you can see in the app (and delete). We do not publish or share your transcripts.
- See
docs/evidence/OPENAI_RETENTION_EVIDENCE.mdfor our record of OpenAI's retention posture.
4. Telemetry
We run self-hosted telemetry: anonymous product events (e.g. "session started", "connection lost", latency timings) used only to keep the product working and improve it.
- No advertising networks, no third-party analytics trackers, no cross-site tracking, no fingerprinting.
- Telemetry events are not tied to the content of your practice.
5. What we do NOT do
- We do not sell your personal data. Ever.
- We do not share your data with advertisers or data brokers.
- We do not use your practice content to train AI models.
- We do not process payments through the app today (if this changes, this policy will be updated first).
6. Legal bases (GDPR / UK GDPR)
Where GDPR/UK GDPR applies: account data — performance of a contract (Art. 6(1)(b)); telemetry and service security — legitimate interests (Art. 6(1)(f)); any processing of data revealing health information you choose to store with an account — your explicit consent (Art. 9(2)(a)), which you may withdraw at any time by deleting your data or account.
7. Your rights
If you are in the UK/EU (and as a matter of policy for everyone), you may:
- Access the data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten") — deleting your account removes your synced state.
- Export your data (data portability) — the app provides export of your practice data.
- Object / restrict processing, and withdraw consent at any time.
- Complain to a supervisory authority (UK: the ICO — ico.org.uk).
To exercise any right, email hayat@beyondelevation.com. We respond within one month.
8. Retention
- Browser-local data: on your device until you clear it.
- Account data: until you delete your account or ask us to delete it.
- Voice audio: processed transiently; not stored by us as audio.
- Telemetry: retained only as long as needed for operations and then aggregated or deleted.
9. Security
Data in transit is encrypted (HTTPS). Account passwords are hashed. Server-side data is scoped per user account, with field-level encryption for sensitive fields and documented security controls (see docs/STEADY_SECURITY_PRIVACY_CONTROLS.md). No system is perfectly secure; we will notify affected users of any breach as required by law.
10. International transfers
Our infrastructure (Vercel, database, OpenAI) may process data in the United States and other countries. Where UK/EU data is transferred internationally, we rely on providers' standard contractual clauses / data processing addenda.
11. Children
Steady is for adults 18 and over. We do not knowingly collect data from anyone under 18; if we learn we have, we will delete it.
12. Changes
We will post changes here with a new "last updated" date, and flag material changes in the app.