The plain-language version: Steady reads receipt-shaped emails from the personal inbox you connect, turns them into structured data (items, prices, due dates), and discards the original emails. We don't read your correspondence, we don't touch work email, we don't sell your data, and we don't show ads. You pay us; that's the business model.
The rest of this page is that promise in detail.
Steady ("Steady," "we," "us") operates the website heysteady.app and the Steady application (together, the "Service"). Questions about this policy can be sent to privacy@heysteady.app.
We use Cloudflare Web Analytics to count visits to heysteady.app. It is cookie-free and does not fingerprint or track individuals: it records page views, referring sites, and general device type, and it does not follow you across other websites.
This website also loads two advertising pixels: the TikTok Pixel and the Meta Pixel (Facebook and Instagram). They set cookies and record that you visited this site, how you interact with the page — such as clicks, time spent, and whether you clicked through to the app — and send that information to TikTok and Meta so we can measure how well our ads perform and so those platforms can show our ads to people like you. This is cross-site advertising technology: TikTok and Meta may each combine what they learn here with information they already hold about you.
These pixels never receive your email address, your password, or anything else you enter in the Steady app — we do not send those to any advertising platform, by any route. The pixels run on this marketing site only; they are not loaded inside the app itself.
One thing does cross over. If you arrived from a Meta ad and then create a Steady account or start a subscription, our server tells Meta that the visit which began with that ad led to a sign-up or a purchase, so we can tell which ads work. What Meta receives is the cookie identifier it set on this site, the price paid, and a scrambled account number that identifies nobody — not your email, your name, or anything from inside the app. If you live in California or anywhere else that gives you the right to opt out of this kind of sharing, email hello@heysteady.app from your account's address and we will stop it for you.
You can limit this in your TikTok or Meta ad settings, by blocking third-party cookies, or with a content blocker — none of which affects your ability to sign up for or use Steady. These website advertising tools are separate from the Steady application: nothing derived from your connected email account is ever shared with TikTok, Meta, or any advertising platform.
We do not sell your personal information, and we never share your account data, uploaded content, or anything derived from your email with advertisers or data brokers. The one exception is the website advertising pixel described above, which reports visits to and signups on this marketing site — never anything from inside the Service.
Steady requests three Google permissions.
https://www.googleapis.com/auth/gmail.readonly — read-only. Lets Steady find order confirmations and read the items, prices and dates in them, which is what fills your closet and your kitchen from things you have already bought. It does not allow Steady to send, modify, delete or archive any message, and it never will: this is the only Gmail permission Steady asks for.https://www.googleapis.com/auth/calendar.events.readonly — read-only, and events only. Lets Steady see what your day contains, so an outfit can be matched to it and meals can be timed around it. It reads events and nothing else — not your calendar settings, not who a calendar is shared with, not any other property of it.https://www.googleapis.com/auth/calendar.events.owned — the one permission that writes anything. Lets Steady add reminders to calendars you own, such as a bill falling due or food about to go off, so they reach you without opening the app. Steady only ever creates, updates or deletes events it made itself; every one is tagged so it can be found and removed, and you can clear all of them at once from inside the app. It never edits or deletes anything you created. We use this narrower permission rather than the broader calendar one so that Steady cannot write to calendars that merely happen to be shared with you — a calendar you have been added to is not ours to change.Once a receipt email has been parsed into structured data, the original message is discarded from our processing systems; we retain the extracted facts and a reference to their source so you can see where each fact came from. Steady is designed to connect to personal email accounts only and is not built to connect to workplace email accounts.
If you connect a Google account, Steady's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In plain terms, data from your Google account is used only to provide the features you see in Steady. It is never sold or transferred to advertising platforms, data brokers or information resellers. It is never used for advertising. It is never used to train generalised artificial intelligence or machine learning models. And it is never read by a person, except with your explicit permission, where the law requires it, or to investigate a specific security incident.
You can withdraw Steady's access at any time from inside the app, or at myaccount.google.com/permissions.
We share data with a small set of providers, only as needed to run the Service. Each processes it on our behalf under contractual confidentiality obligations and may not use it for its own purposes.
Payments. Subscription payments are processed by Stripe. Checkout and the billing portal run on Stripe's own pages, so your card details never reach Steady's servers and are never stored by us; Steady keeps only a Stripe customer reference and your subscription's status, plan, and renewal date. Nothing from your Google account or your bank connection is ever shared with a payment processor.
We keep your structured data for as long as your account is active. You can delete individual items, disconnect your email at any time, or delete your account entirely — which removes your personal data from our production systems within 30 days, except where retention is required by law. Email addresses collected by the pre-launch waitlist are kept until the launch announcements conclude or you unsubscribe.
Depending on where you live (including under the CCPA and GDPR), you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, email privacy@heysteady.app. We will not discriminate against you for exercising them.
We use industry-standard safeguards, including encryption in transit and at rest, access controls, and periodic security review. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you as required by law.
Specifically: the tokens that let Steady reach your Gmail, your calendar and your bank are encrypted at rest with AES-256-GCM, so a copy of the database on its own contains no usable credentials. Account data is held in Postgres with row-level security, so the database itself refuses one account access to another's rows.
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.
If we make material changes, we will notify you by email or in the app before they take effect. The "Last updated" date above reflects the current version.