Trust & Privacy

Steady has four roles: patient, caregiver, clinician, and admin. Patients see only their own diary, skills, and assessments. Caregivers see only the patients who have invited them. Clinicians see only patients on their roster. All access is enforced server-side by row-level security policies on the database, not just by the UI.

Roles are stored in a dedicated user_roles table and checked through a security-definer function, so a user cannot grant themselves elevated permissions by editing their profile.

Sign-in uses our backend's managed authentication. Sessions are scoped to the device and can be revoked by signing out. Invite codes (family and clinician codes) are generated with a cryptographically secure random source and are single-use.

All traffic between your browser and Steady is served over HTTPS. Application data is stored in our managed Postgres backend, which encrypts data at rest at the storage layer. We do not claim end-to-end encryption — clinicians you have invited can read the diary entries you share with them, by design.

Steady stores the diary entries, skills practice, safety plan, and assessment responses you enter, plus the account info needed to sign you in (email, display name, role, time zone). We use this data to render your own history, share it with the care team you have invited, and send the reminders you have opted into.

We do not sell personal data. We do not use diary content for advertising.

Push notifications and email reminders are opt-in per user. You can disable them at any time from your settings, and unsubscribe links are included in reminder emails.

Patients can request account deletion from their settings. Deleting an account removes the auth user and cascades to that user's diary entries, assessments, safety plan, and care-team links.

Steady is not an emergency service. If you or someone you support is in immediate danger, contact local emergency services or a crisis line right away. The in-app Crisis page lists resources but does not replace professional care.

If you believe you have found a security vulnerability, please email the project owner so we can investigate and fix it. Please do not post details publicly until a fix has shipped.