Steadyish Privacy Policy

Last updated: 1 October 2026.

Steadyish is a personal tracker for ongoing responsibilities. This policy explains what the app stores, where, and what happens to it.

What is collected

Account. An email address and a password. The password is never stored in readable form; authentication is handled by Supabase Auth, which stores a salted hash.

Your content. The areas you create, their checklists, recurring tasks, appointments, habits, counters, notes, due dates, check-ins and check-in notes, the dates of any vacation you set, the history of completions, and the time and any note you record with a counter's log. This is whatever you choose to type. It may include information about your health, your family, your finances or your relationships. Steadyish does not read, categorize or analyze it.

Timezone. The device's timezone name (for example America/Chicago), so that daily, weekly, fortnightly and monthly streaks are counted on your calendar rather than the server's.

Reminder preferences. Whether reminders are on. Reminders themselves are scheduled on your device as local notifications; nothing about them leaves the phone.

Crash reports (optional, off by default). If a build is configured with a Sentry DSN, the app sends crash reports containing a stack trace, the app version, device model and OS version. No email address, note contents or other personal data is attached. Builds without a DSN send nothing.

What is not collected

• No advertising identifiers, no analytics, no tracking across apps or websites.
• No contacts, photos, location or health data from the device.
• No push notification tokens; there is no push server.
• No third-party sign-in.

Where it is stored

Your account and content are stored in a Supabase project (Postgres) hosted by Supabase, Inc. Every table is protected by row-level security: each row is readable and writable only by the account that owns it and, for an area you have chosen to share, the people you shared it with. The app talks to the database with a publishable key that grants access to nothing on its own.

Your session token is stored in the device's secure keychain.

If you add the Steadyish widget to your home screen, the app keeps the names of your counters, their areas and this week's counts in storage on the device that only the app and its widget can read, so the widget can show them. A tap on the widget waits there, with its time, until the app next opens and sends it. None of it leaves the device any other way.

If you install the Steadyish app on an Apple Watch, the iPhone app sends it today's list — the titles of what is due, your check-ins, habits and appointments, their areas, and your counters with this week's counts — over Apple's direct connection between your phone and your watch, and the watch keeps a copy on itself to show. The watch never connects to our servers. What you tick off or log on the watch goes back to your phone the same way, waits there with its time, and is sent by the app the next time it runs.

Who can see it

You, and the people you share an area with. The developer can access the hosting project for maintenance, and does not read user content in the course of that.

Sharing. If you share an area, everyone you share it with can see and change everything in that area — and only that area: its lists, counters, notes, check-ins and history, including who logged or checked in what. They see you by the name you set in the app or, if you set none, by the part of your email address before the @. Nobody can join without the single-use code you send them, and you can remove anyone at any time. If you delete your account, an area you shared passes to the person who has been in it longest, with your check-ins and logs left in it without your name. Content is never sold, shared with advertisers, or used to train anything.

An AI assistant (optional, off until you connect one). If you connect an assistant such as Claude to Steadyish through the optional connector, it can read and add to the areas you have allowed it to, under the per-area Assistant access setting: areas set to "Add only" are never read back, and areas set to "Hidden" are never exposed. The connector runs as you, under the same row-level security, and you authorize it explicitly through a sign-in and consent screen. What the assistant reads from Steadyish becomes part of your conversation with it, which the company that runs the assistant (Anthropic, for Claude) keeps under its own privacy policy, not this one.

Your calendar link (optional, off until you make one). Settings can make a private link that a calendar app subscribes to. Whoever holds the link can read what it carries: the titles, details and dates of the open due items and appointments in the areas you leave on it, and those areas' names. Your calendar provider (Apple, Google, Microsoft) fetches it from its own servers and keeps what it fetched under its own privacy policy, not this one. The app records when the link was last fetched, and nothing about who fetched it. You can switch areas off it, replace it with a new link (the old one stops working at once), or turn it off, in Settings. It holds only what you can already see in the app; each person in a shared area has their own.

Your choices

• Export. Settings > Export data hands you everything in your account as a single JSON file.
• Delete. Settings > Delete account removes your account and every row that belongs to it, immediately and permanently. There is no retention period and no copy kept. The one exception is an area you shared, which the other person keeps, as described above.
• Leave or stop sharing. Leave an area someone shared with you, or remove someone from yours, on the area's Share screen.
• Reminders can be turned off in Settings or in the system notification settings.
• Calendar link. Make a new one or turn it off in Settings, then remove the subscription from your calendar app to clear what it already shows.
• Assistant. Disconnect it in the assistant itself (in Claude, Settings > Connectors), or keep it out of an area by setting that area's Assistant access to Hidden.

Children

Steadyish is not directed at children under 13 and does not knowingly collect information from them.

Changes

Changes to this policy are published on this page, with the date above updated. A material change will also be noted in the app's release notes.

Contact

Steadyish is made by Travis Hoover, an independent developer. Questions about this policy, or about what is stored in your account, go to traviskhoover@gmail.com.