Steady Privacy Policy
Steady ("we", "us") is a voice-first wellness companion for structured, self-directed ERP-style practice, available at https://steady-erp-voice.vercel.app. This policy explains what data Steady handles, where it lives, and your rights. The short version: your practice data is encrypted and stored on our database so Steady can remember you and keep improving your sessions, we run no ad tech, and we never sell your data.
1. Where your practice data lives
Steady stores your practice data — maps, lists, session records, progress snapshots, saved notes — in our database (hosted on Supabase, in the EU). It is encrypted by the app before it is written (see Security), and it is scoped so only your own session can read it.
You do not need an account for this. The first time you use Steady, your browser is given an anonymous identity: a random identifier stored in a secure, http-only cookie. It is not tied to your name, email, phone number or IP address, and we hold no way to work out who you are from it. Your data is stored against that identifier so Steady remembers your progress between sessions rather than starting from zero every time.
Your browser also keeps a local copy (localStorage) so the app works instantly and offline. "Reset progress" in the app clears both copies.
2. Optional account
If you choose to create an account (email + password via our authentication API):
- We store your email address, name, phone number and a hashed password (we never store the plain password).
- Your existing anonymous record is upgraded into that account — your practice history carries over, and from then on it is scoped to your account so you can continue across devices.
- You can use Steady without an account; the account is opt-in and only adds identity, sign-in and multi-device access.
2a. How Steady learns from your practice
Steady adapts to you. Your own stored data — what you have said, your mood and language patterns over time, which practices helped — is analysed by the app, for your sessions only, to personalise what Steady says next and to spot when you are struggling. This analysis runs against your record alone; it never builds a profile of you for anyone else, and no human reads it.
Separately, we keep anonymous, content-free counts of how well individual questions land across all users (for example, "this question is misunderstood 30% of the time"). These counts contain no words you said and nothing that identifies you, and they are what let us improve the script for everyone.
We do not use your practice content to train AI models — not ours, not anyone else's.
3. Voice sessions
Voice conversations are processed by OpenAI's Realtime API to power the spoken companion:
- Your audio is streamed to OpenAI transiently for processing during the session.
- Under OpenAI's API policy, API data is not used to train OpenAI's models unless the customer explicitly opts in to share it. Steady has not opted in and will not.
- OpenAI may retain API inputs and outputs for up to 30 days for abuse monitoring, after which they are deleted unless retention is legally required (OpenAI enterprise privacy commitments, updated 8 January 2026).
- We send OpenAI what the session needs — your words and the session's clinical context. We do not send your email address or account identifiers with it.
- We keep session summaries/records that you can see in the app (and delete). We do not publish or share your transcripts.
- See
docs/evidence/OPENAI_RETENTION_EVIDENCE.mdfor our record of OpenAI's retention posture.
4. Telemetry
We run self-hosted telemetry: anonymous product events (e.g. "session started", "connection lost", latency timings) used only to keep the product working and improve it.
- No advertising networks, no third-party analytics trackers, no cross-site tracking, no fingerprinting.
- Telemetry events are not tied to the content of your practice.
5. What we do NOT do
- We do not sell your personal data. Ever.
- We do not share your data with advertisers or data brokers.
- We do not use your practice content to train AI models.
- We do not process payments through the app today (if this changes, this policy will be updated first).
6. Legal bases (GDPR / UK GDPR)
Where GDPR/UK GDPR applies: account data — performance of a contract (Art. 6(1)(b)); telemetry and service security — legitimate interests (Art. 6(1)(f)); any processing of data revealing health information you choose to tell Steady, whether under an anonymous identity or an account — your explicit consent (Art. 9(2)(a)), given when you start a session and withdrawable at any time by resetting your progress or deleting your account.
7. Your rights
If you are in the UK/EU (and as a matter of policy for everyone), you may:
- Access the data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten") — deleting your account removes your synced state.
- Export your data (data portability) — the app provides export of your practice data.
- Object / restrict processing, and withdraw consent at any time.
- Complain to a supervisory authority (UK: the ICO — ico.org.uk).
To exercise any right, email hayat@beyondelevation.com. We respond within one month.
8. Retention
- Browser-local copy: on your device until you clear it.
- Anonymous records: kept until you reset your progress in the app or ask us to delete them.
- Account data: until you delete your account or ask us to delete it.
- Voice audio: processed transiently; not stored by us as audio.
- Telemetry: retained only as long as needed for operations and then aggregated or deleted.
9. Security
Data in transit is encrypted (HTTPS). Account passwords are hashed. Server-side data is scoped per user account, with row-level security so one account can never read another's rows. No system is perfectly secure; we will notify affected users of any breach as required by law.
Your practice content — the map we build together, your saved facts and your session transcripts — is encrypted by the application (AES-256-GCM) before it is written to the database. The encryption key is held by the Steady application, not by our database provider, so a copy of the database on its own is unreadable. Our database is hosted on Supabase, which additionally encrypts all customer data at rest with AES-256 and in transit with TLS, and holds SOC 2 Type 2 and ISO 27001 certifications.
Nobody at Steady reads your sessions. There is no human review of your practice content, and no admin or support screen anywhere in Steady that shows one person's practice content to anyone else. The app decrypts your content for one purpose only: to run your own signed-in session. Where we need to know the product is working, we use content-free operational counts (for example, how many sessions started), never what you said. Our logs are written to exclude transcripts, plans and profile content.
10. International transfers
Our infrastructure (Vercel, database, OpenAI) may process data in the United States and other countries. Where UK/EU data is transferred internationally, we rely on providers' standard contractual clauses / data processing addenda.
11. Children
Steady is for adults 18 and over. We do not knowingly collect data from anyone under 18; if we learn we have, we will delete it.
12. Changes
We will post changes here with a new "last updated" date, and flag material changes in the app.