STEADY — Privacy Policy

Last updated: July 26, 2026

STEADY ("the app", "we", "us") is an AI-assisted calorie and nutrition tracking app for Android and iOS, operated by Shivam Bhawsar, an individual developer based in India. This policy explains what information STEADY collects, why, who it's shared with, and the choices you have. Contact: shivambhawsar.next@gmail.com.

STEADY is a self-tracking and logging tool. It does not diagnose, treat, monitor, or manage any medical condition, and it is not a medical device or health service. See "Not medical advice" below.

What we collect

Account information

Name and email address.
Sign-in method: email/password, Google, or Sign in with Apple. If you use Google or Apple, we receive a verified identity token and, depending on your provider settings, your name and email — we never see your Google or Apple password.

Nutrition and wellness information you enter

This is self-reported wellness information, entered voluntarily by you for tracking purposes — it is not clinical or medical data, and STEADY does not interpret it as such:

Date of birth, sex, height, current and goal weight, activity level, dietary restrictions, and your daily calorie/macro/water targets.
Food and drink entries (including quantities and, where applicable, an AI confidence score), water intake, weight history, and body measurements (waist, hips, chest, arms, thighs, neck, body fat %) that you choose to log.
Photos you take or select of meals, used to estimate nutrition content.
Your messages to the in-app AI chat, and the AI's responses, stored so your log history and conversation stay consistent across sessions.

Usage analytics and diagnostics

We use PostHog to understand how STEADY is used and to find and fix problems. This includes:

App interaction events (e.g. sign-up, sign-in, onboarding steps completed, a meal logged, a chat error).
Crash logs and diagnostic information (e.g. error reports and basic performance data) so we can identify and fix bugs.
A device identifier generated by PostHog to distinguish devices and sessions.
Your account ID, name, and email, so we can connect activity to a support request if you contact us — PostHog is not a fully anonymous analytics tool in our configuration.

We do not use an advertising identifier, we do not use this data for advertising, and STEADY does not show ads. We do not sell your data.

Who processes your data

We use the following service providers, acting on our instructions, to run STEADY. None of these providers may use your data for their own purposes.

Provider	Purpose	What they receive
Supabase	Database, authentication, and photo storage	All account and nutrition data listed above. Meal photos are stored in a private storage bucket, accessible only via short-lived signed URLs (24-hour expiry) tied to your account.
OpenRouter, Inc. (routing to OpenAI models)	AI food-photo recognition, AI chat, and nutrition matching	When you log a meal by photo or text, or use the AI chat, your photo and/or message text (plus relevant context such as your goals and today's totals) is sent via OpenRouter to OpenAI's GPT-4o / GPT-4o-mini models to identify foods and estimate nutrition. This data is used only to generate your result and is not used to train third-party models under our API terms with these providers.
USDA FoodData Central (U.S. government API)	Verified nutrition lookups	Food names/search terms only — no account or personal information is sent.
Google / Apple	Sign-in	Used only if you choose "Continue with Google" or "Sign in with Apple" — standard OAuth identity exchange with the provider you selected.
PostHog	Usage analytics and diagnostics	App usage events, crash and diagnostic logs, a device identifier, account ID, name, and email (see "Usage analytics and diagnostics" above).

Data retention

Your account and nutrition data (profile, logs, photos, chat history) are retained for as long as your account exists.
Meal photos are retained only as long as needed to display your log history; deleting a food entry deletes its photo.
When you delete your account, all of the above is deleted immediately and permanently — see below.
Anonymized, non-identifying nutrition facts (e.g. "1 slice whole-wheat bread ≈ 80 kcal") that food entries contribute to our shared food database are retained after account deletion, with no link back to you.

Your rights and choices

Wherever you're located, you have the right to:

Access the personal data we hold about you.
Correct inaccurate data — most fields can be edited directly in the app.
Delete your account and all associated data at any time (see below).
Export your data — email us and we will provide a copy of your logged data in a portable format within 30 days.
Withdraw consent for optional features (e.g. you can decline Google/Apple sign-in and use email/password instead).

To exercise any of these rights, email shivambhawsar.next@gmail.com. We will respond within 30 days.

California residents: we do not sell or share your personal information for cross-context behavioral advertising, so there is nothing to opt out of under the CCPA/CPRA. You may still exercise the access, deletion, and correction rights above.

EEA/UK residents: our legal basis for processing your data is your consent (when you create an account and log data) and our legitimate interest in operating and improving the app. You may also have the right to lodge a complaint with your local data protection authority.

Deleting your account and data

You can delete your account at any time inside the app: Settings → Delete account. This permanently and immediately erases your profile, food and drink logs, meal photos, water intake, weight history, body measurements, and chat history. You can also request deletion without the app — see our account deletion page.

Security

Data is encrypted in transit (TLS) between the app and our servers. Data at rest in our database and storage buckets is encrypted by our infrastructure provider (Supabase, built on PostgreSQL with encryption at rest). Database access is restricted with row-level security so each account can only ever read or write its own data. Meal photos are stored in a private bucket and are not publicly accessible.

Children's privacy

STEADY is intended for users aged 18 and over, and is not directed at children. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a user under 18, we will delete it promptly — contact us at the email above if you believe this has happened.

Not medical advice

Calorie and nutrition figures in STEADY, including AI-generated estimates, are approximations for general self-tracking and wellness purposes. They are not medical advice, diagnosis, or treatment, and STEADY is not a substitute for professional medical or nutritional guidance. Consult a qualified professional for medical or clinical dietary decisions.

International data transfers

Our service providers (Supabase, OpenRouter, PostHog) may process data on servers located outside your country, including in the United States. Where required, we rely on these providers' standard contractual safeguards for cross-border data transfers.

Changes to this policy

If we make material changes, we will update this page and the "Last updated" date above. If changes are significant, we will also notify you in the app.

Contact

Shivam Bhawsar — shivambhawsar.next@gmail.com