Privacy policy
Last updated 10 August 2026
SteadyCal records what you eat and how you move, which is personal and sometimes sensitive. This explains exactly what is held, who else ever sees it, and how to get it all back or delete it.
The short version
- Nothing is sold, shared with data brokers, or used for advertising.
- There are no third-party trackers and no advertising identifier is read.
- Photographs of your meals are sent to OpenAI in the United States to estimate what is in them. This is the most significant thing on this page.
- You can export everything, or delete your account outright, from inside the app.
Who is responsible
The data controller for SteadyCal is Mark Dandy, of 10 Bothwell Road, Manchester, M40 7PA, United Kingdom. Questions about this policy, or any request about your data, go to support@steadycal.app.
What is held, and why
| Data | Why | Legal basis |
|---|---|---|
| Email address and password | To create and secure your account | Performance of a contract |
| Health and fitness data — steps, active energy, workouts, heart rate, body mass, mindful minutes and sleep from Apple Health, plus the food, water, weight and mood you enter yourself | To provide the tracking the app exists for and to show your own history back to you | Explicit consent (special category data, UK GDPR Article 9(2)(a)) |
| Photographs of meals you choose to take | To estimate calories and macronutrients | Explicit consent |
| Usage data — which screens are opened and which features are used | To understand whether the app is useful and where it fails | Legitimate interests |
| Crash diagnostics | To find and fix crashes | Legitimate interests |
What is deliberately not held
No location, no contacts, no browsing or search history, and no financial information. No advertising identifier is read. Usage data is recorded as a fixed list of event names and true/false values, and never carries a number — so a weight, a calorie total or a step count cannot travel inside it.
Who else sees it
| Who | What they receive | Where |
|---|---|---|
| Supabase | Everything: your account, your health data, your meal photographs and your usage data. They host the service | Ireland (EU) |
| OpenAI | Photographs of your meals, one at a time, and only when you take one. Sent from our server, never from your phone. No account details are attached | United States |
| Sentry | Crash reports. No account is attached, and messages are stripped of digits before they leave your phone | European Union (Frankfurt) |
| Open Food Facts | A barcode number, and nothing else. The request goes through our server so that your IP address never reaches them | France |
| Expo | A request for app updates, carrying the app version only | United States |
About the meal photographs
When you photograph a meal, that image is sent to OpenAI to be identified and estimated. Your name, email and account identifier are not sent with it. The app will not analyse a photograph containing a person, and no flow in SteadyCal asks you to photograph anyone.
Sending data outside the UK
Most of your data never leaves the UK or the European Economic Area. Your account, health data and meal photographs are stored in Ireland, crash reports go to Germany, and barcode lookups go to France. The UK recognises the EEA as providing an adequate level of protection, so those transfers need nothing further.
Two things do go to the United States: meal photographs sent to OpenAI, and the requests your app makes to Expo to check for updates. Both are covered by the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, which is the mechanism UK law provides for exactly this. You can ask for details of those arrangements at the address above.
How long it is kept
Your data is kept for as long as your account exists. When you delete your account it is removed — every row and every photograph, including your usage history. Deletion is immediate and cannot be reversed.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of what we hold — You → Your data in the app does this instantly
- correct anything that is wrong
- delete everything — You → Your data also does this
- restrict or object to how it is used
- hand it to another service in a portable format
- withdraw your consent, at any time, by deleting your account
Ask at support@steadycal.app. If you are unhappy with the response, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
Data is encrypted in transit and at rest by our hosting provider. Access is restricted per account at the database level, so one account's queries cannot return another's rows. Keys that could reach other people's data are never present in the app on your phone.
Children
SteadyCal is for adults and is rated accordingly. It is not designed for, and should not be used by, anyone under 18. If you believe a child has created an account, contact us and it will be deleted.
Changes
If this policy changes materially you will be told in the app before the change takes effect. The date at the top always reflects the current version.