Privacy Policy

Steadily.me is operated by Reality Moss LLC, an Ohio limited liability company ("we," "us," "Reality Moss"). You can reach us at [email protected]. This Privacy Policy explains what information Steadily.me collects, why we collect it, and what you can do about it. It covers the Steadily.me website, the web app at steadily.me/app, and the downloadable apps for iOS, Android, macOS, Windows, and Linux.

We collect the smallest amount of information needed to run the service.

Account information

You need an account to use Steadily.me. Whichever way you sign up, we store your email address and the date you joined. You must confirm your email address before you can sign in.

• Email and password sign-up. We store your email address and a securely hashed version of your password. We never store your password in readable form.
• Sign in with Google. We request only the openid and email scopes. Google sends us a sign-in token containing your email address, whether Google has verified it, and a stable Google account identifier. The token may also carry your name and profile picture, but we do not store them. We keep only the identifier and your email address.
• Sign in with Apple. Apple sends us a stable Apple user identifier and your email address. If you choose Apple's "Hide My Email" relay, we only receive the relay address, and your real Apple ID stays private. If you share your name with Apple's sign-in sheet, we do not store it. We also keep an Apple authorization token whose only use is to disconnect Steadily.me from your Apple ID when you delete your account. We never receive your Apple ID password.

If you sign in with Google or Apple using the same email address as an existing Steadily.me account, the sign-in is linked to that account.

Habit content

We store the content you create in Steadily.me: the names of your habits, the colors, weekly goals, and order you give them, the dates you mark a habit complete, and any weeks you mark as a rest or sick week. Habit names are free text, so if you choose to name a habit after a health condition or a medication, that is stored as you typed it. This is your data, and it stays tied to your account.

Devices

Each installed app generates a random device identifier the first time it runs. It is not derived from your hardware or from any advertising identifier. The app sends it with every synced request together with the platform name (for example "android" or "web"), and our server keeps a list of your devices with the time each was last seen. We use this to apply the sync limits described in our Terms of Service (free accounts sync on one device at a time; Pro removes that limit) and to let you choose which device holds your sync slot.

Support conversations

If you write to us through the Support screen in the app or on the website, we store your messages and our replies in a private conversation tied to your account. Support is handled by people, not by an AI system. Support staff can see your email address and your messages. When you start a new conversation, staff who have asked to be notified receive an email containing your email address and the first part of your message. We may also email you when we reply.

Activity and security logs

When your device talks to our servers, for example when you sign in, sync, export your data, or change a setting, we record the action along with your IP address, your browser or app's user-agent string, the device type and platform it implies (phone, tablet, or desktop), and a coarse location (country and city). The coarse location comes from Cloudflare, which sits in front of our servers and attaches an approximate location to each request based on its IP address. Log entries are tied to your account by an internal ID, not your email address. Failed or suspicious requests are recorded as security events with the same IP and user-agent information. We use these logs to keep accounts secure, spot abuse, and debug problems. We never collect precise GPS location.

Approximate location for sunrise and sunset (optional)

The app can shift its colors with the daylight where you are. If you turn on Follow sunrise & sunsetin Settings, the app asks our server for an approximate latitude, longitude, and city name. Our server takes these from the location Cloudflare attaches to the request based on your IP address and passes them straight back; we do not store them. The app keeps them on your device to calculate sunrise and sunset locally, shows the city name in Settings, and refreshes them at most once every 30 days. If you leave the setting off, no location is ever requested. We never access your device's GPS or location services.

Error reports from the website

The pages of the steadily.me website (sign-in, email confirmation, password reset, support, and account pages) send us a small report when they hit a warning or error, so we can fix bugs. Each report includes the error type and message, where in the page it happened, your browser and platform, a random per-page-load identifier, the website build identifier, your account identifier if you are signed in, and, on our side, your IP address and user-agent string. These reports never include your password. The downloadable apps and the web app at steadily.me/app do not send error reports.

Purchases

If you buy Steadily.me Pro (a subscription or lifetime unlock), the payment is processed by the Apple App Store or Google Play on those platforms. On the web and on desktop, the app sends you to a checkout page run by RevenueCat, where Stripe processes the payment. Your card number, billing address, and other payment details go directly to those processors and never touch Steadily.me's servers. We use RevenueCat to manage purchases across platforms; it receives your numeric Steadily.me account identifier (not your email address) and processes purchase metadata such as the product bought, the store it came from, and purchase and expiration dates. RevenueCat then tells our servers whether your account has Pro, and we store that status, the store it came from, and the expiration date. We do not see or store your payment details.

Rewarded ads (optional)

On the iOS and Android apps, you can choose to watch a full-screen video ad in exchange for a free week of Steadily.me Pro. An ad only ever appears after you tap "Watch an ad for a free week of Pro" on the Pro screen; we never show ads anywhere else in the app, and if you never tap that button, none of what follows happens.

These ads are served by Google AdMob (Google Mobile Ads). When you choose to watch one, Google receives information from your device in order to select and deliver the ad, such as your IP address, general device information, and, where your device settings and local law allow it, your device's advertising identifier. Google processes this information under its own privacy policy (policies.google.com/privacy). Where the law requires it (for example in the European Economic Area and the United Kingdom), the app shows Google's consent form before the first ad and no ad is requested until you have made a choice; you can revisit that choice at any time from the "Ad privacy" link on the Pro screen. We use RevenueCat to verify that you finished the ad so the free week can be credited to your account; that verification links the ad reward to your Steadily.me account identifier.

Things we do not collect

We do not use third-party analytics or tracking tools (such as Google Analytics, Mixpanel, or PostHog) on the website or in the apps. Outside of the optional rewarded ads described above, there is no advertising and no ad tracking in Steadily.me. We do not collect your precise location. We do not use your camera or microphone, and we do not read your contacts, photos, or other apps. The only time the app touches your photo library is when you ask it to save a picture of your year, and on iOS it asks for add-only permission at that moment. We do not send push notifications.

We use the information described above only to:

• Provide the Steadily.me service to you and sync your data across your devices.
• Send transactional email: email-address confirmation codes, password reset links, and replies to your support messages.
• Send an optional check-in email if you have not synced for a while. This is off unless you turn it on under Settings, where you also choose how many days of inactivity should trigger it. Every such email includes a one-click unsubscribe link.
• Answer your support requests.
• Apply the free tier's one-device sync limit and recognize Pro accounts.
• Diagnose and fix bugs on the website.
• Deliver a rewarded ad when you request one, and credit the resulting free week of Pro to your account.
• Protect the service against abuse, fraud, and security threats.
• Produce aggregate, non-identifying statistics about how the service is used, such as daily active counts.

We do not use your information to train AI models, and we do not send it to AI services.

We share your information only with the service providers we need to run Steadily.me, and only as needed:

• Cloudflare (network and security, United States). All traffic to steadily.me and to our servers passes through Cloudflare, which sees the IP address and request details of every connection, protects the service from attacks, and supplies the coarse location used in our activity logs and, if you turn it on, the sunrise and sunset feature.
• Railway (hosting, United States). We host the Steadily.me backend and database on Railway, which stores your account and habit data on our behalf.
• Resend (transactional email). When we need to email you, for confirmation codes, password resets, support replies, or the optional check-in reminder, the message is delivered through Resend, which processes your email address and the message contents for that purpose.
• RevenueCat (and, for web and desktop purchases, Stripe), only if you buy Steadily.me Pro or watch a rewarded ad, as described in the Purchases and Rewarded ads sections above.
• Google AdMob, only if you choose to watch a rewarded ad for a free week of Pro, as described in the Rewarded ads section above. If you never use that feature, nothing is shared with AdMob.
• Google and Apple (sign-in). If you sign in with Google or Apple, that provider learns that you signed in to Steadily.me. The steadily.me website and the web app also load Google's and Apple's sign-in scripts from their servers, so when you open a page with a sign-in button those companies receive an ordinary web request (your IP address and browser information) even if you sign in another way. The downloadable apps only contact Google or Apple when you start a sign-in with them.
• Our update server (releases.steadily.me). The desktop and Android apps check it for new versions and download updates from it. The website also reads it to offer download links. It receives your IP address as part of the ordinary web request and nothing else about you.
• The app stores. If you install Steadily.me from the Apple App Store, Google Play, or the Samsung Galaxy Store, that store handles the download and any purchase under its own privacy policy.

We do not sell your personal information, and we do not share it with data brokers. The only advertising partner we work with is Google AdMob, and it is only involved when you choose to watch a rewarded ad.

We may disclose information if we are legally required to (for example, in response to a valid subpoena), or if we reasonably believe disclosure is necessary to protect the rights, safety, or property of users or the public.

Steadily.me works offline, so the app keeps a local copy of your habits, completions, rest weeks, and a queue of changes waiting to sync, together with your sign-in token, your email address, your settings (including the cached sunrise location if you turned that on), the random device identifier, and your Pro status. In the web app this lives in your browser's storage; the downloadable apps keep it in their application data folder. These files are ordinary files protected by your device's own security, not additionally encrypted by the app.

Logging out or deleting your account removes your habit content and sign-in token from that device. Settings, the device identifier, and any pictures you exported stay until you uninstall the app or clear its data. On the web, the sign-in token is shared between the steadily.me website and the web app through the browser's local storage, and the website caches its own pages so it can load offline.

When you export your year as a picture, the image is created on your device and saved where you choose (your photo library, gallery, or downloads). It includes your habit names and counts. Nothing about it is uploaded. If you turn on "Start automatically at login" on a desktop computer, the app adds a launch entry to your user account on that computer, which it removes when you turn the setting off.

You always have the following rights over your data:

• Access and export. You can export a complete copy of your habits, completions, and rest weeks at any time from the app under Settings, then Account, then Export my data (JSON), or programmatically via GET /api/me/export while signed in. If you'd prefer, you can also email [email protected] and we'll send it to you. Data export is and will remain free, regardless of any paid tiers.
• Deletion. You can delete your account from inside Steadily.me at any time, under Settings, then Account, then Delete account, or on the web at steadily.me/delete-account. After you confirm by typing DELETE, we permanently delete your account, habit content, device records, support conversations, and pending tokens from our active systems immediately. If you signed in with Apple, we also revoke Steadily.me's Sign in with Apple access. If you can no longer sign in, email us from your account's address and we will delete it for you.
• Correction. You can edit your habit content directly in the app. To correct any other information, email us.
• Sign out everywhere. Sign out of all devices under Settings, then Account, invalidates every signed-in session for your account.
• Email choices. The check-in reminder is off by default; turn it on or off under Settings, then Account, or use the unsubscribe link in any reminder email. Confirmation codes, password resets, and support replies are sent only when you trigger them.
• Ad choices. Rewarded ads only run when you ask for one. Where Google's consent form applies, you can change your choices from the "Ad privacy" link on the Pro screen.
• Withdraw consent. You can stop using Steadily.me and delete your account at any time.

Depending on where you live, you may have additional rights under laws such as the GDPR (European Economic Area and United Kingdom) or the CCPA (California). We honor these rights for all users, not just those covered by law. To exercise them, email [email protected].

We keep your account information and habit content for as long as your account is active. When you delete your account, we remove it and your content from our active systems immediately. Our hosting provider's routine backups may retain a copy for up to 60 additional days before they are overwritten.

After deletion we keep a small anonymous record that an account was created and deleted, with aggregate counts such as how many habits it had. It contains no email address or other contact information.

Logs are kept separately from your content and are deleted automatically. Website error reports and server error logs are deleted after 90 days. Security event records are deleted after 30 to 365 days depending on severity. Account activity logs (sign-ins, syncs, exports, and similar events, with the IP address, user agent, and coarse location described above) are deleted after 365 days. Activity log entries record the type of event, not your email address.

When you delete your account, its log entries are anonymized at the same time. Activity log entries lose the link to your account along with the IP address, user agent, city, and event details, leaving only the type of event, its date, the device type, and the country, which we use for aggregate statistics. Server error and security event records lose the link to your account. The remaining anonymous entries then expire on the schedules above.

Your sign-in session stays valid until you log out, sign out of all devices, change your password, or delete your account.

We protect your data with encryption in transit (HTTPS) and rely on our hosting provider's encryption at rest, and we limit access to systems handling user data to the people who need it to operate the service. The people who operate Steadily.me can see account details, habit content, and logs when needed to run the service and help you. No system is perfectly secure, but we take this responsibility seriously and will notify affected users without undue delay if we ever learn of a breach.

Steadily.me is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, please contact us and we will delete it.

We operate Steadily.me from the United States. If you use Steadily.me from outside the United States, your information will be transferred to and processed in the United States. By using the service you consent to that transfer.

We may update this Privacy Policy from time to time. If we make material changes, for example if we add a new sign-in provider, change how we share information, or introduce new paid or advertising-supported features, we will notify you through the app or by email before the change takes effect.

Questions, requests, or feedback? Email [email protected].

Reality Moss LLC
An Ohio limited liability company