Privacy Policy

1. Who we are

Steady is provided by Capable Mind, operating as a sole trader business based in the United Kingdom.

Data controller: Rebecca Allinson, trading as Capable Mind.

ICO registration number: ZC183559

Contact: hello@capablemind.app

2. Our commitment to your data

Steady is a new product and we are committed to transparency about how your data is handled as it grows. We take data protection seriously and have built this policy to reflect exactly what we collect and why.

We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator, as a data controller.

3. What data we collect

We only collect what is needed to provide the features you use. We do not ask for or store more information than is necessary for the app's planning and pattern-noticing features to work.

• Account information: your email address, and optionally your name.
• Health-related information (special category data): this includes whether you have ADHD or autism, your menopause or perimenopause and HRT status, your menstrual cycle status if relevant, and the symptoms, capacity levels, and sleep ratings you log each day.
• Daily usage data: the tasks, notes, and reflections you create within the app, including items in Today, Basics, Non-Negotiables, Later, Ideas, and the Worry jar.
• Device and notification data: a push notification subscription identifier, if you enable notifications, so we can send you reminders you have asked for.
• Technical data: limited usage information about how you use the app, linked to a random account identifier rather than your name or email, to help us understand and improve it. This is pseudonymous personal data. No health-related data, task content, or free-text entries are ever included in this data.
• Error and diagnostic data: if something goes wrong in the app, basic technical details about the error (such as the browser type and the screen where it happened) are sent to our error monitoring service so we can fix it. This never includes your health data, tasks, or notes.

4. Why we collect this data, and our legal basis

For your account information, we process this data under Article 6(1)(b) UK GDPR because it is necessary to provide you with the app and the service you have signed up for.

For health-related information, this is special category data under Article 9 UK GDPR. We process this data on the basis of your explicit consent under Article 9(2)(a). You are asked to give this consent clearly and separately during onboarding before health-related data is collected.

You may withdraw this consent at any time by emailing us at hello@capablemind.app, or by deleting your account in the app's Yours tab, which removes your data entirely. If you withdraw consent, we will stop processing new health-related data going forward. Because Steady's core features depend on this data, withdrawing consent will mean the app can no longer provide these personalised features, though your account and any non-health data may remain usable where practical.

For product analytics and advertising measurement, we only collect data after you accept cookies via our cookie banner, and we rely on that consent as the basis for processing. Analytics data is linked to a random account identifier, not your name or email, and no health-related data, task content, or free-text entries are ever included in it. You can withdraw this consent at any time from Cookie preferences in the app's Yours tab.

We use your data to:

• Provide the daily planning features you use, including your capacity check-in, task lists, and reminders.
• Show you patterns in your own data over time, such as the symptom and sleep trends visible in the Patterns screen.
• Send you the notifications you have specifically asked for, including morning, midday, and evening nudges.
• Maintain and improve the app, and fix problems when they occur.

5. Important note: Steady is not a medical product

Steady is a self-help planning and pattern-noticing tool. It is not a medical device, and it does not diagnose, treat, monitor, or give advice about any medical condition. Any patterns or comparisons shown in the app are based only on what you have self-reported, and are descriptive, not clinical or diagnostic.

Always speak to your GP or a qualified clinician about any health symptoms, concerns, or treatment decisions.

6. Who we share your data with

We use a small number of trusted service providers to run Steady. These providers only process your data to help us deliver the app, under contractual obligations to protect it.

We do not sell your personal data to any third party. We do not share your health-related data with advertisers.

• Supabase: our database, authentication, and backend infrastructure provider, which stores your account and app data securely and handles sign-in.
• Netlify: our hosting provider, which serves the Steady app and website to your browser.
• Anthropic: AI processing provider. When you use the task simplification feature, the text of your task is sent to Anthropic to generate suggestions. Task text may contain personal information. No health-related data from your check-ins or profile is sent to Anthropic.
• Resend: transactional email delivery, used to send you the one-time sign-in code when you log in to Steady.
• Loops: email platform, used to send you a small number of onboarding and service emails about your Steady account, with an unsubscribe link in every one. Loops receives your email address, first name if you gave one, and basic usage milestones (such as whether you have completed onboarding and how many days you have checked in) so emails arrive at the right moment. It never receives any health-related information, check-in answers, notes, or task content.
• PostHog: product analytics, hosted within the European Union. PostHog helps us understand how the app is used so we can improve it. It only runs if you accept cookies. No health-related data, task content, or free-text entries are ever sent to PostHog.
• Google (Google Tag Manager and Google Analytics): used to understand how people find Steady and move through key flows such as signing up. These only run if you accept cookies.
• Meta (Meta Pixel): used to measure whether our adverts are helping people find Steady. The Meta Pixel only runs on our public landing and sign-in pages, only if you accept cookies, and never inside the app itself. Meta never receives any of the information you log in Steady.
• Sentry: error monitoring, used to detect and fix problems in the app. Sentry receives technical error details only, never your health data, tasks, or notes.
• Zoho: email hosting for our contact address at hello@capablemind.app.
• Web push providers through your browser: used only if you enable notifications, so reminders can be delivered to your device.

7. Where your data is stored

Our service providers may store data in the UK, the European Economic Area, or other locations with appropriate data protection safeguards in place, such as Standard Contractual Clauses, where data is transferred outside the UK or EEA.

PostHog analytics data is hosted within the European Union.

8. How long we keep your data

We keep your account and health-related data for as long as your account remains active.

If you delete your account, we will delete or anonymise your personal data, including health-related data, within 90 days, except where we are required to retain certain records for longer to meet a legal obligation.

You can request deletion of your account and data at any time through the app's Yours tab or by contacting us at hello@capablemind.app.

9. Your rights

Under UK GDPR, you have the right to:

To exercise any of these rights, please contact us at hello@capablemind.app.

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Withdraw consent for special category data processing at any time.
• Object to or restrict certain processing.
• Request a copy of your data in a portable format.
• Make a complaint to the Information Commissioner's Office if you believe your data has not been handled correctly.

10. Security

We take reasonable technical and organisational measures to protect your data, including secure database access controls, encrypted connections, and limiting access to your data to what is necessary to provide the service.

11. Children

Steady is intended for adults. We do not knowingly collect data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us so we can remove it.

12. Changes to this policy

We may update this policy from time to time as Steady develops. We will let you know of any significant changes through the app or by email.

13. Contact us

If you have any questions, concerns, or requests relating to your data or this policy, please contact us at hello@capablemind.app.