Privacy policy for the Steadie app
Last updated 7 October 2026.
This policy explains what the Steadie app keeps about you, why, where it's kept, who else is involved and the choices you have. Steadie is made by [COMPANY NAME] ("we"), which decides how this information is used and is responsible for it. The short version: what you log is kept on your phone and, if you sign in, in a private backup so it comes with you to a new phone. We never sell it, never use it for advertising and never use it to track you.
What the app keeps
About you: your first name if you give it, and whether you've stopped, are stopping or are still taking a weight-loss medicine, and roughly when your last injection was.
Your health check: your answers to the questions about your health (for example heart or joint problems, pregnancy, kidney disease or recent surgery), whether you've checked with your GP, and when you answered.
What you log: weigh-ins, protein, habits, strength sessions, morning check-ins (sleep, hunger, energy, drinking, eating out and similar), lessons read, and the messages you send to the in-app coach.
Your preferences: food preferences, including any diet you follow (for example vegetarian, halal or kosher), allergies, foods you avoid, health conditions that affect food, cooking kit, budget and household size. Some of these can suggest religious beliefs.
Your settings: units, reminders, safe mode, and when you accepted the health information and gave consent.
Your weight, health check answers, medicine status and check-ins are health information, which the law treats as special category data and protects more strictly.
If you sign in
Signing in is optional. If you do, we also keep your email address (or the private relay address Apple gives us if you use Sign in with Apple and choose to hide your email), an account ID, and when your account was created.
For each sign-in we keep the IP address and device type it came from, to keep your account secure. We keep this until you sign out on that phone or delete your account.
When you ask for a sign-in code, we keep the code for up to 10 minutes, and a short record of recent attempts from your IP address so that nobody can guess codes.
We keep a backup of everything listed under "What the app keeps", with when it was last changed, so you can move to a new phone without losing your plan.
Why we use it, and the law that allows it
To build and run your plan, and to back it up and restore it if you sign in. This is needed to provide the app you've asked for (contract). Because it includes health information, we also rely on your explicit consent, which you give in the health check when you set up the app.
To send you sign-in codes and keep your account secure, including limiting repeated attempts. This is needed to provide your account (contract) and is in our legitimate interest in keeping Steadie safe.
To check whether you have an active subscription. This is needed to provide what you've paid for (contract).
To answer you if you contact us, and to meet our legal obligations.
We don't use your information for advertising, profiling for marketing, or to train AI models, and we don't sell it or share it with data brokers.
How the health check changes your plan
Your health check answers change your plan automatically: for example, some answers pause strength sessions until you've checked with your GP, or switch to gentler sessions. This keeps the plan suitable for you; it doesn't have any legal effect on you. If you think an adjustment is wrong, you can redo the health check in Settings or contact us.
Where it's kept
On your phone, always. If you don't sign in, what you log stays on your phone and isn't sent to us.
If you sign in, your backup and account are kept on servers in London, UK. They're sent over an encrypted connection and stored encrypted. The key that keeps you signed in is kept in your iPhone's Keychain.
Your phone's own backups (iCloud, if you use it) also include the app's data, under Apple's terms.
Who else is involved
We use a small number of service providers. They only act on our instructions, are bound by contract to keep your information safe, and can't use it for their own purposes.
Vercel: runs Steadie's server (in London). Neon: the database that holds accounts and backups (in London). Resend: sends sign-in codes, so it receives your email address and the code. RevenueCat: checks your subscription; it receives an anonymous ID, your App Store purchase details and basic device information such as the app version and your country, never what you log. Expo: delivers app updates; when the app checks for one, Expo sees your IP address, a random ID for this install and the app version, nothing else.
Apple: handles payments, Sign in with Apple and Apple Health under its own privacy policy.
Resend, RevenueCat and Expo are based in the US. Where they handle your information outside the UK, it's protected by the UK's approved safeguards (the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum).
We'll only share your information with anyone else if the law requires it, for example a court order.
Apple Health
If you switch it on, Steadie reads your weight and steps from Apple Health and saves weigh-ins you enter there. It only does this with your permission, which you can change at any time in the Health app.
Weigh-ins and steps brought in from Apple Health become part of your plan, so if you've signed in they're included in your backup. They're only used for your own plan.
Information from Apple Health is never used for advertising, never sold and never shared. Steadie doesn't save it to iCloud itself, though your phone's own iCloud backup includes the app's data, as with any app.
Reminders
Reminders are scheduled on your phone. Nothing is sent to us to make them work, and they never mention your weight.
How long we keep it
On your phone: until you delete it, sign out or delete the app.
Your account and backup: until you delete your account. Deleting it removes your account, backup and sign-in records from our database straight away, and from our database's short-term recovery copies within 7 days.
Signing out removes your sign-in from that phone and clears the phone, but keeps your backup so you can sign in again.
If we ever close Steadie, we'll tell you in the app and by email first, and delete what we hold.
Your rights
You have the right to see what we hold about you, have it corrected, have it deleted, take a copy with you, object to or limit how we use it, and withdraw your consent at any time. Withdrawing consent doesn't affect what we did before.
Most of this is in the app. Settings → Export my data gives you a file of everything the app keeps. You can change your answers and preferences at any time. Settings → Delete my account (or Delete everything, if you haven't signed in) deletes it all and withdraws your consent.
For anything else, email [PRIVACY EMAIL]. We'll reply within one month. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we'd like the chance to put it right first.
Keeping it safe
We use encryption in transit and at rest, sign-in codes instead of passwords, limits on repeated attempts, and access to the database for only the people who need it to run Steadie. If something ever goes wrong that puts your information at risk, we'll tell you and the ICO as the law requires.
Who can use Steadie
Steadie is for adults aged 18 and over. We don't knowingly hold information about anyone younger.
Changes to this policy
If this policy changes in a way that matters, the app will tell you before the change applies, and ask for your consent again if we need it.
Contact
[COMPANY NAME], [REGISTERED ADDRESS]. Registered with the Information Commissioner's Office, number [ICO REGISTRATION NUMBER]. Email [PRIVACY EMAIL].