PRIVACY POLICY

1. INFORMATION WE HANDLE

Website and waitlist

When you join the waitlist, we collect your email address, a unique signup identifier, the date and time you joined, the date and time you consented to receive updates, and limited source information. Source information may include a referring page and campaign values such as source, medium and campaign. We use this information to manage the waitlist, avoid duplicate entries, send requested Stedy product, beta and launch updates, and understand which launch channels are useful.

The website is hosted using OpenAI Sites. Waitlist records are kept in the website's persistent database. Sites and its infrastructure providers may also process routine request, traffic and security information needed to deliver, measure and protect the website.

Information stored by the Stedy app

Current Stedy app builds store product information locally on your device. Depending on the features you use, that may include:

• Your first name and onboarding choices.
• Your goal, usual and planned drink amounts, difficult moment and preferred support.
• The limit, timestamps, drink entries, pause state and result for an active occasion.
• Local reminder times, notification preferences, companion, guidance and haptic preferences.
• Up to 100 completed-occasion summaries, including the pledged limit, final count, result and privacy-safe guidance history used to improve local message selection.

Stedy is local-first. Your active occasion is written to your device before it is sent anywhere else, so tracking can continue while you are offline. When you are signed in, supported app data is queued and synchronised to Supabase when a connection is available. This includes your first name and onboarding choices; plan, notification and experience preferences; current commitment details, drink entries and related timestamps and states; completed-occasion summaries; and account-scoped free-commitment status. Offline changes retry automatically, and local tracking remains the source of truth while a change is waiting to sync.

The general synchronisation process does not include your address book, a chosen recipient, the raw Live Pledge token or an optional supporter message. If you create a Live Pledge, Supabase separately stores your account identifier, the local commitment identifier, the limit you chose, an optional snapshot of your first name, a secure hash of the public token, and link creation, opening, acknowledgement, optional supporter-message, expiry and revocation timestamps. Stedy does not store the raw public token in the database.

Signing in can restore supported account information and up to the 100 most recent completed-occasion summaries. Changes that have not reached the server cannot be recovered from a lost or cleared device. Synchronisation is not a guarantee that every device or exported copy has the same data at every moment.

The Apple Watch companion exchanges the current commitment, drink entries, completion state and limited account/access information with its paired iPhone. Existing authorised tracking can continue while disconnected, with changes queued for later confirmation. Initial setup and a new Watch commitment require a connected iPhone. A queued change is not yet confirmed as synchronised.

Stedy can schedule local reminders on your device when you enable them. Notification text may be visible on a lock screen or to other people who can access your device, depending on your operating-system settings. You can disable Stedy notifications or change their visibility in device settings.

2. SHARING AND ACCOUNTABILITY

Sharing a pledge is optional. When you tap Share Pledge, Stedy opens your device's native share sheet. You choose the application and recipient, review the prepared content and decide whether to send it. Stedy does not request contact access, read or upload your address book, choose a recipient or send anything automatically.

A recipient is not technically bound to a Live Pledge link. Anyone who receives or is forwarded the private link may open and acknowledge it until it expires or is revoked, so share it only with the person you intend.

3. MESSAGES AND SHARING

When you choose to share a pledge, Stedy prepares text and opens your device's native messaging application or share sheet. You choose the recipient, review the content and decide whether to send it. Stedy does not send messages automatically and does not operate an SMS gateway. Messages are handled by your device, mobile carrier, selected application and recipient, whose privacy practices may also apply.

A Live Pledge includes an opaque private link. The recipient can see your first name and pledged limit and can press “I've got your back” and may include one optional short encouragement message that is shown to you in Stedy while tracking. The first acknowledgement and message are locked and cannot be edited through the link. The public response does not return the message after it is sent. The page does not show your surname, contact details, live drink count, drinking history, other onboarding answers or subscription information. The link expires after 24 hours and may be revoked sooner. Public link requests are rate-limited using a one-way network-address hash; the network address is not stored in plaintext.

4. SUBSCRIPTIONS, ACCOUNTS AND PAYMENTS

Supabase provides account authentication and supported cloud synchronisation. Subscription-enabled builds use RevenueCat to validate purchases, restore access and reconcile subscription changes. Purchases are processed by the applicable platform store, initially the Apple App Store. Bell Software does not receive your complete payment-card details.

RevenueCat receives your Stedy account UUID as its App User ID and store purchase, product, transaction and entitlement information. Stedy stores the subscription state needed to confirm access. Signing in alone does not grant paid access. Cancelling a Stedy account does not cancel a store subscription; manage subscriptions through the platform store.

The RevenueCat SDK also sends technical app and device information, including Apple's vendor device identifier (IDFV). This is not the advertising identifier (IDFA). Stedy does not enable RevenueCat advertising-attribution integrations. Subscription and billing records are handled under the stores' and RevenueCat's applicable retention and legal requirements; deleting a Stedy account does not automatically erase those records. See RevenueCat's privacy policy and data processing terms. Those processing terms use the duration of the service agreement as a retention criterion, subject to applicable deletion instructions, backup practices and legal requirements; we do not promise a fixed short retention period for RevenueCat records.

5. HOW WE USE INFORMATION

We use information only where reasonably necessary to:

• Operate, secure and maintain the Stedy website and waitlist.
• Send product, beta and launch updates you requested.
• Provide the app's commitment, tracking and support features.
• Create, resolve, acknowledge, expire and revoke Live Pledge links.
• Save and synchronise supported app data and retry offline changes.
• Personalise existing features using choices you made in the app.
• Open user-requested sharing, feedback and notification features.
• Respond to enquiries and privacy requests.
• Understand website use through aggregated traffic measurements.
• Measure optional app usage to improve the product.
• Prevent misuse, investigate security incidents and comply with legal obligations.

We do not sell personal information. We do not use your drinking information, address-book data or message contents for advertising, and the optional supporter message is not sent to product analytics or the general synchronisation service.

6. OPTIONAL APP ANALYTICS AND WEBSITE COOKIES

Analytics-enabled app builds use PostHog Cloud, hosted in the United States, for optional product analytics. The preference is enabled by default. A notice is shown before collection begins, and you can turn it off under Settings → Privacy & Data → Share usage analytics, including before signing in. Builds without analytics configuration do not collect these events even if the preference is on.

Events cover onboarding progress, authentication, paywall and purchase or restoration outcomes, commitment and tracking actions, guidance presentation and selected Settings, support and sharing actions. A completion event includes whether a promise was kept or missed, but not the drink count or chosen limit. These outcomes can still reveal moderation-related behaviour. Events include timestamps, event and library identifiers, controlled categories and test or production labels. Before sign-in, events use an SDK-generated anonymous identifier; after sign-in, that eligible activity links to your Stedy account UUID. Account-linked analytics is pseudonymous, not anonymous. We do not attach your name or email as analytics person properties.

We do not send exact drinking amounts, limits, drink logs, raw onboarding answers, contacts, recipient details, supporter notes, private pledge links, free text, companion copy, payment credentials or transaction identifiers to PostHog. Touch autocapture, mobile session replay, recordings, automatic lifecycle and push capture, and app console and exception collection are disabled. The Watch has no separate analytics SDK; accepted Watch actions can be measured by the phone. RevenueCat does not independently forward subscription events to PostHog.

PostHog inevitably receives network information while delivering requests. We enable its client-IP discard setting and disable GeoIP enrichment rather than storing IP addresses or deriving approximate location for these analytics. Turning analytics off stops future collection on this installation and discards its pending analytics queue. It does not change another device's preference, recall a request already received by PostHog or delete previously collected records. Re-enabling does not replay actions discarded while analytics was off.

OpenAI Sites automatically records website traffic measurements, including unique visitors and page views. Sites and its infrastructure providers may process request and security data and may use technologies necessary to deliver and protect the website.

Bell Software has not added advertising cookies, advertising pixels, session replay or a separate third-party analytics SDK to the Stedy website. If we introduce advertising technologies or cookies that require additional notice or consent, we will update this policy and the relevant experience first.

7. SERVICE PROVIDERS AND DISCLOSURE

We use limited service providers to operate Stedy. The current website uses OpenAI Sites and its infrastructure providers for hosting, persistent waitlist storage, security and traffic analytics. Resend provides delivery for account sign-in emails, waitlist confirmations and requested updates, and may process the email address, message content and delivery information needed to send and manage those messages. Supabase provides account authentication, supported app data synchronisation, the Live Pledge database, security controls and server functions. RevenueCat provides subscription management and PostHog provides the optional app analytics described above. The hello@stedyapp.com mailbox is hosted by Hostinger.

Give Feedback opens in your phone's browser, outside Stedy, at our UserJot page. Stedy does not embed the feedback website. The current portal requires separate sign-in. UserJot may process the account details and feedback you provide directly to it, along with routine technical request information, under its service and privacy terms. Posts, comments and uploaded images can be public. Your display name and avatar may appear alongside them. Submit only non-sensitive product feedback; use our private support email for account, billing, privacy or personal-history matters. See UserJot's privacy policy and service terms. Stedy does not automatically attach your Stedy account identifier, sign-in tokens, pledge, drink history, supporter message or synchronisation data to UserJot.

Deleting your Stedy account does not delete your UserJot account or feedback. To request removal of feedback on our board, contact us at hello@stedyapp.com. Requests about a separate UserJot account must also be handled through UserJot. Its account privacy policy distinguishes account information from end-user feedback processed for a workspace; retention and deletion also depend on the applicable service and processing terms.

Your device platform, mobile carrier, messaging or sharing application may process information when you initiate those features. The applicable platform store and RevenueCat process purchase information in subscription-enabled builds.

Providers process information under their own service and privacy terms. We may also disclose information where reasonably necessary to comply with applicable law or a valid legal request; investigate fraud, misuse or security incidents; protect people, rights or property; or complete a business restructure subject to appropriate privacy protections. We do not disclose personal information to data brokers.

8. OVERSEAS PROCESSING

Some service providers operate outside Australia, so information may be processed in other jurisdictions, including Japan and the United States. The Stedy PostHog project uses US Cloud hosting. OpenAI Sites does not currently offer data residency for deployed sites, persistent Sites storage or logs. Provider locations and legal requirements may change. We take reasonable steps to select reputable providers, limit the information involved and use appropriate contractual or technical protections where available.

9. STORAGE AND RETENTION

PostHog currently provides a seven-year query window on our paid plan. This is not a guarantee of physical deletion when that window ends. You can request access to or deletion of your analytics by emailing hello@stedyapp.com. After privately verifying ownership, we can locate your account-linked person and request removal of its associated events, including linked anonymous identifiers. Provider deletion is asynchronous and must be checked for completion. We cannot promise that an account lookup finds all unlinked anonymous events. We do not use retention settings as a substitute for a deletion request.

We retain waitlist information while it is reasonably needed to manage the waitlist, provide requested updates, resolve requests or meet legal obligations. You can unsubscribe from marketing emails at any time and ask us to delete or correct your waitlist record. Hosting, security and analytics information is retained under the applicable provider controls and only for as long as reasonably necessary for those purposes.

A Live Pledge token expires 24 hours after creation and is revoked when the occasion ends where Stedy can connect. The privacy-safe lifecycle record may remain with the account until the account or record is deleted, subject to backup and legal retention needs. One-way rate-limit buckets older than 24 hours are deleted during normal service operation.

App information stored locally remains on your device until you clear it through an available app control, reset or delete the app and its data. Local completed-occasion history is limited to the 100 most recent valid summaries. Clearing local data or deleting the app does not by itself delete information already synchronised to your Supabase account. Synchronised records may remain until the account or record is deleted, subject to backup and legal retention needs. Available in-app export and account deletion controls concern Stedy application data. Account deletion does not automatically delete PostHog analytics; request that separately at hello@stedyapp.com. The app export does not include provider-held analytics records. Device backups controlled by Apple, Google or you may affect restoration and deletion timing.

10. SECURITY

We take reasonable administrative and technical measures to protect information against loss, misuse, interference and unauthorised access, modification or disclosure. No storage or transmission method is completely secure. Protect access to your device, email account and associated platform accounts.

11. YOUR CHOICES AND RIGHTS

You may:

• Choose not to join the waitlist.
• Unsubscribe from Stedy marketing emails at any time.
• Decline or revoke notification permission.
• Choose not to share a pledge.
• Revoke an active Live Pledge link from the app.
• Clear locally stored Stedy data through the app.
• Turn off optional app analytics on each installation.
• Ask for access to, or correction or deletion of, personal information Bell Software holds about you.
• Raise a concern about how your information was handled.

Export or delete your Stedy account

1. Open Stedy on your iPhone and sign in to the account you want to manage.
2. Open Settings → Privacy & Data.
3. Choose Export My Data if you want a copy of your supported local and cloud application records.
4. Choose Delete Account & Data, review the warning and confirm deletion.

Account deletion removes your Stedy sign-in account and its account-owned application records from the active cloud service, including supported profile, commitment, drink-entry, history, free-access and Live Pledge records, then clears that account from this installation. Recovery feedback is shown if a request or device cleanup cannot finish. Other devices must reconnect to learn of deletion; it cannot remotely erase an offline device, copies you exported or shared, separate feedback accounts or records retained by providers for legal and billing purposes. Backups may persist under provider retention controls.

If you used Sign in with Apple, Stedy may ask for a fresh Apple confirmation to remove its separate sign-in permission as part of account deletion. The authorization code and Apple tokens are used only to complete that request and are not stored. If automatic removal cannot complete, you can still delete your Stedy account and follow Apple's manual removal instructions. Deleting Stedy does not delete your Apple Account or cancel a subscription.

Clear Local Stedy Data is different: it removes this device's Stedy caches and unsynced changes, not your cloud account. Export My Data does not include provider-held analytics or store billing records. To request separate analytics access or deletion, turn analytics off on each device and contact us. To cancel Apple billing, follow the subscription instructions. You do not need to cancel a subscription before requesting account deletion, but deleting the account will not cancel its billing.

Email hello@stedyapp.com with the subject “Privacy Request” and enough information for us to identify and respond to your request. We may need to verify your identity. If you make a complaint, we will acknowledge it, investigate the issue and respond within a reasonable period. If you remain concerned about how your personal information has been handled, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

12. AGE RESTRICTIONS

Stedy is intended only for adults aged 18 or over who are legally permitted to consume alcohol in their location. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact hello@stedyapp.com.

13. HEALTH AND SAFETY

Information entered into Stedy may relate to alcohol consumption and may be sensitive. Stedy is a moderation and commitment tool. It does not provide medical advice, diagnose a condition, calculate a medically safe drinking amount or replace professional healthcare or emergency support. Do not use Stedy or its drink count to decide whether it is safe to drive. If someone may be in immediate danger, contact the emergency services where you are.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy when Stedy's features, service providers or legal obligations change. The latest version will be published at stedyapp.com/privacy. We will update the effective date above and provide additional notice where a change materially affects how we handle personal information.