Privacy Policy

Who is responsible for your data

Steady is currently offered by an individual seller based in Estonia. The data controller's legal name and postal contact address must be added before commercial launch: [legal name of seller] and [postal address in Estonia].

Until those details are added, privacy requests can be sent to steady.support@gmail.com.

Assessment answers and browser-local progress

Your assessment answers, stage completion, meaningful selections, and personal plan summaries are stored in your browser's local storage under the Steady progress record. This lets your result and progress remain available when you return in the same browser.

Steady does not send assessment answers, situation selections, check-in answers, or private free-text to its application server, Supabase, or PostHog. You can remove this browser-local data by clearing Steady's site data in your browser settings.

Payments and paid access

Payments are processed by Stripe Checkout. Stripe collects payment details and the customer email required for checkout; Steady does not receive or store card numbers.

To verify and provide paid access, Steady stores purchase-related records in Supabase, including Stripe identifiers, checkout status, the amount and currency, and a cryptographic hash of the customer email. The plain email used in Stripe Checkout is not stored in Steady's purchase records.

Steady also sets an HttpOnly browser cookie containing a purchase-claim token. The server stores only a hash of that token. It is used to verify access in the browser that completed checkout; it is not used for advertising profiling.

Analytics

Steady uses PostHog's EU-hosted analytics service to understand high-level product activity, such as landing-page views, assessment progress, result views, Day 1 progress, offer views, and checkout starts. Assessment answers and private free-text are not sent as analytics event properties.

PostHog may process event names, page context, browser and device information, a browser-generated identifier, and campaign or referrer information available from the browser or URL. Session replay is configured with text, inputs, and element attributes masked; request headers and bodies are not recorded by Steady's replay configuration.

Service providers and international processing

Steady uses Stripe for payment processing, Supabase for purchase and entitlement records, and PostHog for analytics. These providers may process data in locations outside your country under their own data processing terms and transfer safeguards.

Retention and your rights

Browser-local progress remains until you clear Steady's site data. The current application does not implement an automatic deletion schedule for purchase records; a documented retention schedule must be adopted before launch. Stripe, Supabase, and PostHog may retain information under their own configured terms and settings.

Where the GDPR applies, you may have rights to request access, correction, deletion, restriction, objection, or data portability, depending on the processing. You may also have the right to complain to the supervisory authority in your country. Contact support to make a request. Analytics consent requirements can vary by jurisdiction; Steady does not currently include a consent-management interface.

Questions

For privacy questions, contact steady.support@gmail.com.