PRIVACY POLICY

1. INFORMATION WE HANDLE

Website and waitlist

When you join the waitlist, we collect your email address, a unique signup identifier, the date and time you joined, the date and time you consented to receive updates, and limited source information. Source information may include a referring page and campaign values such as source, medium and campaign. We use this information to manage the waitlist, avoid duplicate entries, send requested Stedy product, beta and launch updates, and understand which launch channels are useful.

The website is hosted using OpenAI Sites. Waitlist records are kept in the website's persistent database. Sites and its infrastructure providers may also process routine request, traffic and security information needed to deliver, measure and protect the website.

Information stored by the Stedy app

Current Stedy app builds store product information locally on your device. Depending on the features you use, that may include:

• Your first name and onboarding choices.
• Your goal, usual and planned drink amounts, difficult moment and preferred support.
• The limit, timestamps, drink entries, pause state and result for an active occasion.
• Local reminder times, notification preferences, companion, guidance and haptic preferences.
• Up to 100 completed-occasion summaries, including the pledged limit, final count, result and privacy-safe guidance history used to improve local message selection.

Stedy is local-first. Your active occasion is written to your device before it is sent anywhere else, so tracking can continue while you are offline. When you are signed in, supported app data is queued and synchronised to Supabase when a connection is available. This includes your first name and onboarding choices; plan, notification and experience preferences; current commitment details, drink entries and related timestamps and states; completed-occasion summaries; and account-scoped free-commitment status. Offline changes retry automatically, and local tracking remains the source of truth while a change is waiting to sync.

The general synchronisation process does not include your address book, a chosen recipient, the raw Live Pledge token or an optional supporter message. If you create a Live Pledge, Supabase separately stores your account identifier, the local commitment identifier, the limit you chose, an optional snapshot of your first name, a secure hash of the public token, and link creation, opening, acknowledgement, optional supporter-message, expiry and revocation timestamps. Stedy does not store the raw public token in the database.

Complete reinstall and cross-device restoration of all synchronised information is still being completed. Until that work is available, do not treat cloud synchronisation as a complete backup of your Stedy data.

Stedy can schedule local reminders on your device when you enable them. Notification text may be visible on a lock screen or to other people who can access your device, depending on your operating-system settings. You can disable Stedy notifications or change their visibility in device settings.

2. SHARING AND ACCOUNTABILITY

Sharing a pledge is optional. When you tap Share Pledge, Stedy opens your device's native share sheet. You choose the application and recipient, review the prepared content and decide whether to send it. Stedy does not request contact access, read or upload your address book, choose a recipient or send anything automatically.

A recipient is not technically bound to a Live Pledge link. Anyone who receives or is forwarded the private link may open and acknowledge it until it expires or is revoked, so share it only with the person you intend.

3. MESSAGES AND SHARING

When you choose to share a pledge, Stedy prepares text and opens your device's native messaging application or share sheet. You choose the recipient, review the content and decide whether to send it. Stedy does not send messages automatically and does not operate an SMS gateway. Messages are handled by your device, mobile carrier, selected application and recipient, whose privacy practices may also apply.

A Live Pledge includes an opaque private link. The recipient can see your first name and pledged limit and can press “I've got your back” and may include one optional short encouragement message that is shown to you in Stedy while tracking. The first acknowledgement and message are locked and cannot be edited through the link. The public response does not return the message after it is sent. The page does not show your surname, contact details, live drink count, drinking history, other onboarding answers or subscription information. The link expires after 24 hours and may be revoked sooner. Public link requests are rate-limited using a one-way network-address hash; the network address is not stored in plaintext.

4. SUBSCRIPTIONS, ACCOUNTS AND PAYMENTS

Supabase authentication and supported cloud synchronisation are enabled in current Stedy builds. Paid subscriptions are not currently enabled. When subscriptions become available, purchases will be processed through the Apple App Store or Google Play. Bell Software will not receive your complete payment-card details, but may receive transaction and entitlement information needed to confirm access and support purchase restoration.

Before enabling RevenueCat subscription services or an equivalent provider, we will update this policy to describe the additional information involved.

5. HOW WE USE INFORMATION

We use information only where reasonably necessary to:

• Operate, secure and maintain the Stedy website and waitlist.
• Send product, beta and launch updates you requested.
• Provide the app's commitment, tracking and support features.
• Create, resolve, acknowledge, expire and revoke Live Pledge links.
• Save and synchronise supported app data and retry offline changes.
• Personalise existing features using choices you made in the app.
• Open user-requested sharing, feedback and notification features.
• Respond to enquiries and privacy requests.
• Understand website use through aggregated traffic measurements.
• Prevent misuse, investigate security incidents and comply with legal obligations.

We do not sell personal information. We do not use your drinking information, address-book data or message contents for advertising, and the optional supporter message is not sent to product analytics or the general synchronisation service.

6. WEBSITE ANALYTICS AND COOKIES

OpenAI Sites automatically records website traffic measurements, including unique visitors and page views. Sites and its infrastructure providers may process request and security data and may use technologies necessary to deliver and protect the website.

Bell Software has not added advertising cookies, advertising pixels, session replay or a separate third-party analytics SDK to the Stedy website. Product analytics and mobile session replay are not enabled in the current app build. If we introduce analytics, advertising technologies or cookies that require additional notice or consent, we will update this policy and the relevant experience first.

7. SERVICE PROVIDERS AND DISCLOSURE

We use limited service providers to operate Stedy. The current website uses OpenAI Sites and its infrastructure providers for hosting, persistent waitlist storage, security and traffic analytics. Resend provides delivery for waitlist confirmations and future requested updates, and may process the email address, message content and delivery information needed to send and manage those messages. Supabase provides account authentication, supported app data synchronisation, the Live Pledge database, security controls and server functions. The hello@stedyapp.com mailbox is hosted by Hostinger.

If you open Give Feedback, an in-app browser loads Stedy's UserJot page. UserJot may process content you submit and routine technical request information under its own service and privacy terms. Stedy does not automatically attach your pledge, drink history, supporter message or synchronisation data to UserJot.

Your device platform, mobile carrier, messaging or sharing application may process information when you initiate those features. Apple, Google and a subscription-management provider may process purchase information once production subscriptions are enabled.

Providers process information under their own service and privacy terms. We may also disclose information where reasonably necessary to comply with applicable law or a valid legal request; investigate fraud, misuse or security incidents; protect people, rights or property; or complete a business restructure subject to appropriate privacy protections. We do not disclose personal information to data brokers.

8. OVERSEAS PROCESSING

Some service providers operate outside Australia, so information may be processed in other jurisdictions, including Japan and the United States. OpenAI Sites does not currently offer data residency for deployed sites, persistent Sites storage or logs. Provider locations and legal requirements may change. We take reasonable steps to select reputable providers, limit the information involved and use appropriate contractual or technical protections where available.

9. STORAGE AND RETENTION

We retain waitlist information while it is reasonably needed to manage the waitlist, provide requested updates, resolve requests or meet legal obligations. You can unsubscribe from marketing emails at any time and ask us to delete or correct your waitlist record. Hosting, security and analytics information is retained under the applicable provider controls and only for as long as reasonably necessary for those purposes.

A Live Pledge token expires 24 hours after creation and is revoked when the occasion ends where Stedy can connect. The privacy-safe lifecycle record may remain with the account until the account or record is deleted, subject to backup and legal retention needs. One-way rate-limit buckets older than 24 hours are deleted during normal service operation.

App information stored locally remains on your device until you clear it through an available app control, reset or delete the app and its data. Local completed-occasion history is limited to the 100 most recent valid summaries. Clearing local data or deleting the app does not by itself delete information already synchronised to your Supabase account. Synchronised records may remain until the account or record is deleted, subject to backup and legal retention needs. While in-app account export and deletion controls are being completed, you can email us to request access, correction or deletion. Device backups controlled by Apple, Google or you may affect restoration and deletion timing.

10. SECURITY

We take reasonable administrative and technical measures to protect information against loss, misuse, interference and unauthorised access, modification or disclosure. No storage or transmission method is completely secure. Protect access to your device, email account and associated platform accounts.

11. YOUR CHOICES AND RIGHTS

You may:

• Choose not to join the waitlist.
• Unsubscribe from Stedy marketing emails at any time.
• Decline or revoke notification permission.
• Choose not to share a pledge.
• Revoke an active Live Pledge link from the app.
• Clear locally stored Stedy data through the app.
• Ask for access to, or correction or deletion of, personal information Bell Software holds about you.
• Raise a concern about how your information was handled.

Email hello@stedyapp.com with the subject “Privacy Request” and enough information for us to identify and respond to your request. We may need to verify your identity. If you make a complaint, we will acknowledge it, investigate the issue and respond within a reasonable period. If you remain concerned about how your personal information has been handled, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

12. AGE RESTRICTIONS

Stedy is intended only for adults who are legally permitted to consume alcohol in their location. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact hello@stedyapp.com.

13. HEALTH AND SAFETY

Information entered into Stedy may relate to alcohol consumption and may be sensitive. Stedy is a moderation and commitment tool. It does not provide medical advice, diagnose a condition, calculate a medically safe drinking amount or replace professional healthcare or emergency support.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy when Stedy's features, service providers or legal obligations change. The latest version will be published at stedyapp.com/privacy. We will update the effective date above and provide additional notice where a change materially affects how we handle personal information.