The plain-language version: Steady reads receipt-shaped emails from the personal inbox you connect, turns them into structured data (items, prices, due dates), and discards the original emails. We don't read your correspondence, we don't touch work email, we don't sell your data, and we don't show ads. You pay us; that's the business model.
The rest of this page is that promise in detail.
Steady ("Steady," "we," "us") operates the website heysteady.app and the Steady application (together, the "Service"). Questions about this policy can be sent to privacy@heysteady.app.
We use Cloudflare Web Analytics to count visits to heysteady.app. It is cookie-free and does not fingerprint or track individuals: it records page views, referring sites, and general device type, and it does not follow you across other websites.
This website also loads two advertising pixels: the TikTok Pixel and the Meta Pixel (Facebook and Instagram). They set cookies and record that you visited this site, how you interact with the page — such as clicks and time spent — and whether you joined the waitlist, and send that information to TikTok and Meta so we can measure how well our ads perform and so those platforms can show our ads to people like you. This is cross-site advertising technology: TikTok and Meta may each combine what they learn here with information they already hold about you.
When you join the waitlist, our server also reports that signup to TikTok directly, so the conversion is counted even if the pixel is blocked in your browser. That report contains your IP address, your browser's user-agent string, the page address, and the click and cookie identifiers TikTok itself set. Neither these pixels nor that report contains your email address or anything else you typed into the form — we do not send those to any advertising platform, by any route.
You can limit this in your TikTok or Meta ad settings, by blocking third-party cookies, or with a content blocker — none of which affects your ability to join the waitlist. These website advertising tools are separate from the Steady application: nothing derived from your connected email account is ever shared with TikTok, Meta, or any advertising platform.
We do not sell your personal information, and we never share your account data, uploaded content, or anything derived from your email with advertisers or data brokers. The one exception is the website advertising pixel described above, which reports visits to and signups on this marketing site — never anything from inside the Service.
Steady requests three Google permissions.
https://www.googleapis.com/auth/gmail.readonly — read-only. Lets Steady find order confirmations and read the items, prices and dates in them, which is what fills your closet and your kitchen from things you have already bought. It does not allow Steady to send, modify, delete or archive any message, and it never will: this is the only Gmail permission Steady asks for.https://www.googleapis.com/auth/calendar.events.readonly — read-only, and events only. Lets Steady see what your day contains, so an outfit can be matched to it and meals can be timed around it. It reads events and nothing else — not your calendar settings, not who a calendar is shared with, not any other property of it.https://www.googleapis.com/auth/calendar.events.owned — the one permission that writes anything. Lets Steady add reminders to calendars you own, such as a bill falling due or food about to go off, so they reach you without opening the app. Steady only ever creates, updates or deletes events it made itself; every one is tagged so it can be found and removed, and you can clear all of them at once from inside the app. It never edits or deletes anything you created. We use this narrower permission rather than the broader calendar one so that Steady cannot write to calendars that merely happen to be shared with you — a calendar you have been added to is not ours to change.Once a receipt email has been parsed into structured data, the original message is discarded from our processing systems; we retain the extracted facts and a reference to their source so you can see where each fact came from. Steady is designed to connect to personal email accounts only and is not built to connect to workplace email accounts.
If you connect a Google account, Steady's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In plain terms, data from your Google account is used only to provide the features you see in Steady. It is never sold or transferred to advertising platforms, data brokers or information resellers. It is never used for advertising. It is never used to train generalised artificial intelligence or machine learning models. And it is never read by a person, except with your explicit permission, where the law requires it, or to investigate a specific security incident.
You can withdraw Steady's access at any time from inside the app, or at myaccount.google.com/permissions.
We share data with a small set of providers, only as needed to run the Service. Each processes it on our behalf under contractual confidentiality obligations and may not use it for its own purposes.
Payments. Steady does not process payments today; paid plans have not launched. When they do, card details will be handled entirely by a payment processor and will never be seen or stored by Steady, and this policy will be updated to name that processor before any charge is taken. Nothing from your Google account is ever shared with a payment processor.
We keep your structured data for as long as your account is active. You can delete individual items, disconnect your email at any time, or delete your account entirely — which removes your personal data from our production systems within 30 days, except where retention is required by law. Waitlist emails are kept until launch communications conclude or you unsubscribe.
Depending on where you live (including under the CCPA and GDPR), you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, email privacy@heysteady.app. We will not discriminate against you for exercising them.
We use industry-standard safeguards, including encryption in transit and at rest, access controls, and periodic security review. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you as required by law.
Specifically: the tokens that let Steady reach your Gmail, your calendar and your bank are encrypted at rest with AES-256-GCM, so a copy of the database on its own contains no usable credentials. Account data is held in Postgres with row-level security, so the database itself refuses one account access to another's rows.
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.
If we make material changes, we will notify you by email or in the app before they take effect. The "Last updated" date above reflects the current version.