Steady Fitness Privacy Policy

1. Your workouts and private progress

The app stores workout plans, exercise sets, repetitions, resistance, active timer durations, exact session timestamps, streaks, equipment choices, reminders, goals, optional body weight and measurements, optional progress photos, private notes, and routine likes/dislikes and difficulty ratings on your device. These records support the features you use. They are not automatically uploaded to the developer or your friends.

Progress photos you choose are copied into private app storage. The app does not request broad access to your photo library or use your camera or microphone to analyze your body. The 3D muscle map uses your saved workout sets; it does not scan you or diagnose overtraining.

Routine ratings and developer-feedback drafts are collected in local app storage and private JSON files. Recommendations are not active. Exporting a JSON file is optional. Private history notes and progress photos are excluded from the ratings and developer-feedback exports. Files you explicitly save outside the app remain wherever you save them.

2. Optional Friends profiles and sharing

You can use the workout library and private history without a Friends account. Creating a Friends profile sends your display name to the Steady server address you choose. The server creates a random account ID, friend code and private sign-in key; it stores a hash of the sign-in key. The app stores your server address and sign-in key locally so you can reconnect.

The chosen server stores your profile, community-rules consent version and time, friend requests and connections, mute/block choices, messages containing routines or achievement cards you explicitly send, shared-session invitations, membership, readiness and the shared timer state. A card includes an exact weight or other personal detail only if you choose to include it. Personal set logs, measurements, private notes and progress photos are not automatically shared.

Recipients see the display name and content you intentionally share. Content reports identify the reporting profile, reported profile or message, reason and time so the server operator can investigate abuse. Server requests necessarily expose your network address and basic request information to the host. Do not include sensitive details in display names or reports unnecessarily.

Friends currently supports a private beta server supplied by its operator. The address is shown before connection. An independently operated server receives the data sent to it and must apply its own lawful privacy, security, retention and moderation procedures. Use a server you trust. Contact support for help identifying its operator.

3. Permissions and device services

Notifications are optional. Local workout and stretch reminders are scheduled on your device. If a build supports Firebase friend alerts and you enable them, Google Firebase Cloud Messaging handles a device registration token and message-delivery metadata; the chosen Steady server stores that token to send generic alerts. Push payloads do not contain your workout logs, measurements, photos or private card details. The private inbox loads after you open the app.

Health Connect is optional on supported Android phones. After you grant write-only exercise permission and choose an export, Steady writes the selected workout title, start/end times and available active timer duration to Health Connect on your device. Steady does not read Health Connect records and does not export sets, resistance values, progress photos, private history notes or guest logs. This integration is limited to the exercise-export feature you request; Health Connect information is not used for advertising, sale, eligibility decisions or an unrelated purpose.

You can revoke Health Connect access in Android settings and remove exported copies in History > Health Connect or Android Health Connect. Deleting a Steady record or Friends account does not automatically delete a copy already exported to Health Connect.

Optional voice cues use a local text-to-speech voice on Android. Steady does not record speech or request microphone access. Optional Wear OS controls send timer state and commands through Google Play Services between your paired devices. Your phone and watch settings govern those device services.

4. Purposes and service providers

Data is used to provide workouts, remember your preferences, show training history and progress, deliver reminders, operate optional sharing, protect accounts and respond to support or content reports. We do not sell personal information, use advertising SDKs or include third-party behavioral analytics in the app. No payment-card details are collected by Steady.

The developer cannot see private device records unless you deliberately export and share them or send them in a support message. Emailing support discloses the email address and information you send to the support mailbox provider, Gmail. Never email a private sign-in key.

The public website is hosted by Cloudflare, which processes network addresses, request headers and security/performance information to deliver and protect the site. The website has no advertising, analytics trackers or account cookies. The web deletion tool sends your private key directly to the HTTPS Steady server address you enter, not to the static website host. Site operators and their infrastructure providers may process service/security logs under their own policies.

Using a host, email provider or device service can involve processing in the country where the provider operates, which may differ from yours. We may disclose information when legally required or necessary to protect users and the service. We do not claim that data is end-to-end encrypted.

5. Security and backups

Remote Friends connections must use HTTPS. Sign-in keys are bearer credentials: anyone holding a key can use that profile. Keep your key private and use your device lock. The server stores a cryptographic hash instead of the raw sign-in key. Friend codes are public identifiers and cannot authorize account deletion.

The Android release excludes app data from Android cloud backup and device-transfer backup rules. Photos and local JSON collections use private no-backup storage. Browser storage belongs to that browser profile and origin. Files you export, email, or copy elsewhere have the protections of the destination you choose. No storage or transmission method is guaranteed to be perfectly secure.

6. Retention and deleting your information

Private device records remain until you delete entries, use Privacy & data > Erase local app data, or remove the app/browser data. Erasing local data removes private records, settings, sign-in details, in-app photos and local JSON copies on that device. Health Connect copies, watch data, external files, emails and records on other devices are managed separately. Clearing local data alone does not delete a Friends account.

Use Friends > Delete account, or the public Delete account page without reinstalling the app. Authenticated deletion permanently removes the profile, key hash, friend connections and requests, block/mute preferences, device tokens, server messages sent to or received by the profile, content reports involving it, and hosted room records. Membership in other hosted rooms is removed. The old key stops working. Disconnect only signs this device out and is not account deletion.

The supplied server deletes these active records immediately and does not retain an application archive of the deleted account. Independent hosts must remove copies and honor deletion requests according to their disclosed retention practices, including any backups they operate. Shared content another person has already saved separately on their device may remain in that separate copy.

For a lost key, privacy inquiries or deletion help, email cobblecodev@gmail.com with the subject Steady Fitness account deletion, the server address and your friend code or display name. Do not send your sign-in key. We may ask for information needed to verify control and coordinate with the server operator. We aim to respond within 30 days. Support correspondence may be retained for up to 12 months to resolve the request; legal obligations may require longer retention, and you can ask about a specific request.

7. Your choices and privacy rights

You can use offline workouts without a profile, decline optional permissions, control each sharing action, edit or delete history, revoke Health Connect permission and export local routine-review data. Your jurisdiction may give you rights to access, correct, delete or restrict certain processing or complain to a data-protection authority. Contact cobblecodev@gmail.com to exercise those rights; we may verify the request before acting.

8. Adults, health information and changes

Steady Fitness is intended for adults and is not directed to children under 18. If you believe a child has provided personal information, contact us so it can be investigated and removed.

Steady Fitness is not a medical device and does not diagnose, treat, cure or prevent any medical condition. Consult a healthcare professional for medical advice, diagnosis or treatment. Training plans and muscle-color planning bands are general fitness information and do not replace individualized professional advice.

We will update this policy when the app or its data practices change and show the effective date here. Material changes requiring new consent will be presented before the new processing begins.