Steady Fitness Privacy Policy

Account sign-in and policy agreement

The Android app requires a Google or email/password account before library access. The iPhone/browser web beta and native iOS build also offer free local workouts without an online account. Both require the current policy agreement and adult confirmation. The web beta offers optional Google or email sign-in. Apple sign-in is prepared for a future native iOS release and is not offered in the public web beta. Google Firebase Authentication processes the email, account identifier and credentials used for sign-in, available Google profile name/picture URL, and available Apple name/email, including a private relay email if you choose Hide My Email. We do not receive Google or Apple account passwords. Email/password accounts require email verification. Your policy version, agreement time and adult confirmation are saved on this device.

Firebase processes authentication in the United States. It uses network addresses and browser/device information for security and abuse prevention. Google states that authentication IP logs are kept for a few weeks, and other authentication information is removed from live and backup systems within 180 days after account deletion is initiated. See firebase.google.com/support/privacy for its current details.

Sign-in does not upload or back up your workouts. This installation holds one account’s private records at a time. Signed-in records remain behind sign-in after logout. iOS/web local mode keeps records on the device without creating an online account. It cannot open another signed-in account’s private records. You can explicitly keep local-mode records when creating or signing in to an account. Logging out cancels scheduled reminders; enable reminders again after signing back in. A different account must explicitly erase prior local records before using this installation. Existing pre-account records are kept only after you choose to keep them with the signed-in account. We never automatically transfer private history between accounts.

1. Your workouts and private progress

The app stores workout plans, exercise sets, repetitions, resistance, active timer durations, exact session timestamps, streaks, equipment choices, reminders, goals, optional body weight and measurements, optional progress photos, private notes, and routine likes/dislikes and difficulty ratings on your device. These records support the features you use. They are not automatically uploaded to the developer or your friends.

Progress photos you choose are copied into private app storage. The app does not request broad access to your photo library or use your camera or microphone to analyze your body. The 3D muscle map uses your saved workout sets; it does not scan you or diagnose overtraining.

Routine ratings and developer-feedback drafts are collected in local app storage and private JSON files. Recommendations are not active. Exporting a JSON file is optional. Private history notes and progress photos are excluded from the ratings and developer-feedback exports. Files you explicitly save outside the app remain wherever you save them.

2. Optional Friends profiles and sharing

Friends is a separate optional profile; signing in to Steady does not automatically create one. Creating a Friends profile sends your display name to the Steady server address you choose. The server creates a random account ID, friend code and private sign-in key; it stores a hash of the sign-in key. The app stores your server address and sign-in key locally so you can reconnect.

The chosen server stores your profile, community-rules consent version and time, friend requests and connections, mute/block choices, messages containing routines or achievement cards you explicitly send, shared-session invitations, membership, readiness and the shared timer state. A card includes an exact weight or other personal detail only if you choose to include it. Personal set logs, measurements, private notes and progress photos are not automatically shared.

Recipients see the display name and content you intentionally share. Content reports identify the reporting profile, reported profile or message, reason and time so the server operator can investigate abuse. Server requests necessarily expose your network address and basic request information to the host. Do not include sensitive details in display names or reports unnecessarily.

Friends currently supports a private beta server supplied by its operator. The address is shown before connection. An independently operated server receives the data sent to it and must apply its own lawful privacy, security, retention and moderation procedures. Use a server you trust. Contact support for help identifying its operator.

3. Permissions and device services

Notifications are optional. Native local workout and stretch reminders are scheduled on your device. In the web beta, reminders appear only while Steady is open; browser background notifications are not implemented. Web voice cues use browser speech synthesis, without microphone recording, while the app is open. If a build supports Firebase friend alerts and you enable them, Google Firebase Cloud Messaging handles a device registration token and message-delivery metadata; the chosen Steady server stores that token to send generic alerts. Local account/data deletion also requests removal of the Firebase installation identifier. Firebase states that associated installation data is removed from live and backup systems within 180 days after a deletion request. Push payloads do not contain your workout logs, measurements, photos or private card details. The private inbox loads after you open the app.

Health Connect is optional on supported Android phones. After you grant write-only exercise permission and choose an export, Steady writes the selected workout title, start/end times and available active timer duration to Health Connect on your device. Steady does not read Health Connect records and does not export sets, resistance values, progress photos, private history notes or guest logs. This integration is limited to the exercise-export feature you request; Health Connect information is not used for advertising, sale, eligibility decisions or an unrelated purpose.

You can revoke Health Connect access in Android settings and remove exported copies in History > Health Connect or Android Health Connect. Deleting a Steady record or Friends account does not automatically delete a copy already exported to Health Connect.

Optional native voice cues use text-to-speech on Android and the iOS build. Steady does not record speech or request microphone access. Optional Wear OS controls send timer state and commands through Google Play Services between your paired devices. Your phone and watch settings govern those device services.

4. Purposes and service providers

Data is used to provide workouts, remember your preferences, show training history and progress, deliver reminders, operate optional sharing, protect accounts and respond to support or content reports. We do not sell personal information, use advertising SDKs or include third-party behavioral analytics in the app. No payment-card details are collected by Steady.

The developer cannot see private device records unless you deliberately export and share them or send them in a support message. Emailing support discloses the email address and information you send to the support mailbox provider, Gmail. Never email a private sign-in key.

The public website is hosted by Cloudflare, which processes network addresses, request headers and security/performance information to deliver and protect the site. The website has no advertising or analytics trackers. Its account-deletion tool uses Firebase sign-in and temporary browser-session authentication storage after you choose to sign in. Firebase, Google or Apple sign-in may use authentication cookies on their domains. The separate Friends deletion tool sends a private key directly to the HTTPS Steady server address you enter, not to the static website host. Site operators and their infrastructure providers may process service/security logs under their own policies.

Using a host, email provider or device service can involve processing in the country where the provider operates, which may differ from yours. We may disclose information when legally required or necessary to protect users and the service. We do not claim that data is end-to-end encrypted.

5. Security and backups

Remote Friends connections must use HTTPS. Sign-in keys are bearer credentials: anyone holding a key can use that profile. Keep your key private and use your device lock. The server stores a cryptographic hash instead of the raw sign-in key. Friend codes are public identifiers and cannot authorize account deletion.

The Android release excludes app data from Android cloud backup and device-transfer backup rules. Native progress photos and local JSON collections use private storage excluded from automatic cloud backup. The iOS build also marks its private storage and available WebKit data directories as excluded from backup. Files you save outside the app or copies already made by a system backup are managed separately. Browser storage belongs to that browser profile and origin. The installed web app may have separate storage from an ordinary browser tab. Clearing site data, uninstalling or operating-system storage eviction can remove local records. Account sign-in does not synchronize them across devices. The service worker caches only public app code, movement guides and other static files for offline use, never Firebase requests or private workout records. Public app updates wait for your choice; save open notes and pause a running session before applying an update. Files you export, email, or copy elsewhere have the protections of the destination you choose. No storage or transmission method is guaranteed to be perfectly secure.

6. Retention and deleting your information

Private device records remain until you delete entries, use Privacy & data > Erase local app data, or remove the app/browser data. Erasing local data removes private records, settings, sign-in details, in-app photos and local JSON copies on that device. Health Connect copies, watch data, external files, emails and records on other devices are managed separately. Clearing local data alone does not delete an online Steady or Friends account.

Use the corner Account & settings icon > Delete account to reauthenticate and delete your Steady sign-in account, the connected Friends profile and its associated server data, and this account’s local records. For an Apple-linked account, deletion also requests revocation of its Apple sign-in authorization. A failed Friends deletion or Apple revocation blocks the remaining account deletion so you can retry. Separate Friends profiles and records on other devices are managed separately. The public Delete account page also provides sign-in account deletion, a separate Friends deletion tool and verified support requests without reinstalling the app. Use Friends > Delete account for just the Friends profile. Authenticated deletion permanently removes the profile, key hash, friend connections and requests, block/mute preferences, device tokens, server messages sent to or received by the profile, content reports involving it, and hosted room records. Membership in other hosted rooms is removed. The old key stops working. Disconnect only signs this device out and is not account deletion.

The supplied Friends server deletes its active records immediately and does not retain an application archive of the deleted profile. Firebase authentication retention is described in the Account sign-in section. Independent hosts must remove copies and honor deletion requests according to their disclosed retention practices, including any backups they operate. Shared content another person has already saved separately on their device may remain in that separate copy.

For account access, privacy inquiries or deletion help, email cobblecodev@gmail.com with the subject Steady Fitness account deletion and your Steady account email. For a Friends profile, include its server address and friend code or display name. Do not send your sign-in key. We may ask for information needed to verify control and coordinate with the server operator. We aim to respond within 30 days. Support correspondence may be retained for up to 12 months to resolve the request; legal obligations may require longer retention, and you can ask about a specific request.

7. Your choices and privacy rights

Saved workouts can be used offline while a signed-in account remains locally valid, or in iOS/web local mode after policy agreement. Local mode does not create an online account; erase its data using Privacy & data. You can decline optional permissions, control each sharing action, edit or delete history, revoke Health Connect permission and export local routine-review data. Your jurisdiction may give you rights to access, correct, delete or restrict certain processing or complain to a data-protection authority. Contact cobblecodev@gmail.com to exercise those rights; we may verify the request before acting.

8. Adults, health information and changes

Steady Fitness is intended for adults and is not directed to children under 18. If you believe a child has provided personal information, contact us so it can be investigated and removed.

Steady Fitness is not a medical device and does not diagnose, treat, cure or prevent any medical condition. Consult a healthcare professional for medical advice, diagnosis or treatment. Training plans and muscle-color planning bands are general fitness information and do not replace individualized professional advice.

We will update this policy when the app or its data practices change and show the effective date here. Material changes requiring new consent will be presented before the new processing begins.