Privacy policy
This explains what Steadings stores, why, how long it is kept, and who else sees it. It is written to be read rather than to be technically survivable, so if anything here is unclear, ask and we will explain it.
Who is responsible
Steadings is operated by Moritz Braukhoff, a private individual in Switzerland, who is the controller for the data described here. Contact: hello@steadings.ch. Details are on the imprint.
This website collects nothing
The public site at steadings.ch sets no cookies, runs no analytics, and embeds no third-party trackers. Fonts are served from our own server, so visiting these pages does not send your IP address to a font provider. The only exception is the beta request form below, which you have to fill in deliberately.
Our web server keeps ordinary access logs (IP address, time, requested page, user agent) for a short period, to keep the service running and to deal with abuse. That is a legitimate interest, not a tracking mechanism, and those logs are not used to build a profile of you.
Requesting beta access
If you use the form on the beta page, we store your email address, whatever you write in the message field, and the timestamp of your consent.
- Why: so we can read your request and reply to it.
- Legal basis: your consent, given by ticking the box on the form.
- Who sees it: only the operator. It is not shared with anyone.
- How long: until your request is dealt with and deleted. There is no automatic purge yet, so if you want yours removed sooner, email hello@steadings.ch and it will be deleted.
Your account
To use the app we store an email address, a display name, and either a password hash or, if you sign in with Google, an identifier that Google gives us for your account. We never see or store your Google password. This is needed to give you an account at all, so the legal basis is performance of the contract between us.
A session cookie keeps you signed in. It is strictly necessary, is set only on app.steadings.ch, and is not used for tracking or advertising.
What your household puts in
The substance of Steadings is content you and the people you share a household with enter yourselves: recipes and photos of them, meal plans, shopping lists, chores and task history, calendar events, budget entries, what is in the freezer, and feature suggestions.
This content is visible to the members of your household and to nobody else. It is not sold, not used for advertising, and not used to train machine learning models. Photos you upload have their EXIF metadata, including any GPS location, stripped when they are received, so an uploaded photo does not carry the place it was taken.
Most of it stays until you delete it. Two things are deliberately kept as a permanent record because the feature would be meaningless otherwise: completed task and check history, and the notes and photos attached to it. If you need that removed, ask us.
Optional integrations
You can connect Steadings to other services. None of these are on by default, and each one only sends data once you deliberately connect it.
- Bring: if you connect it, your shopping list items are pushed to your Bring list.
- Google Calendar: if you connect it, calendar events are exchanged with your Google account. This connection is still in beta.
Credentials for these are encrypted before they are stored, and are never written to logs. Once data reaches one of those services it is governed by that service's own privacy policy, not this one. You can disconnect an integration at any time.
Who else processes data for us
These are service providers acting on our instructions, not independent recipients:
- Our hosting provider, which runs the servers the app and database sit on.
- An email provider, which delivers transactional email such as invitations and replies to beta requests.
- Sentry, which receives technical error reports when something breaks, so it can be fixed. Household content is filtered out of these reports before they are sent.
- Google, if and only if you choose to sign in with Google or connect Google Calendar.
Where data is processed
Data is stored in Europe. Some of the providers above may process data outside Switzerland and the EEA. Where that happens, it relies on the safeguards those providers offer, such as standard contractual clauses.
Your rights
Under the Swiss Federal Act on Data Protection, and under the GDPR if you are in the EU or EEA, you can ask for access to your data, correction of it, deletion of it, restriction of how it is used, a copy of it in a portable form, and you can object to processing based on legitimate interests. Where processing rests on consent, you can withdraw that consent at any time, which does not affect what happened before you withdrew it.
Write to hello@steadings.ch and we will handle it. You can also complain to the Swiss Federal Data Protection and Information Commissioner, or to your national supervisory authority if you are in the EU or EEA.
One practical note about deletion in a shared household: some of what you entered is part of a shared record other members rely on. Tell us what you want removed and we will explain what that means for the household before doing it.
Security
Traffic is encrypted in transit. Passwords are stored hashed, never in readable form. Integration credentials are encrypted at rest. Household data is separated so that one household cannot read another's. No system is perfectly secure, and Steadings is a small operation, which is worth weighing when you decide what to put in it.
Changes
If this policy changes in a way that matters, we will say so by email rather than quietly editing the page. The date at the top always reflects the current version.