Privacy Policy

SteadyReply is operated by 2723 Ventures LLC (“we”, “us”). This policy explains what we collect, why, and the control you have over your data.

SteadyReply is designed to help people manage some of the most sensitive conversations in their lives. Protecting those conversations is central to how we build and operate the service.

Messages you submit to SteadyReply may contain sensitive personal information relating to family matters, employment, legal disputes, health, or other personal topics. We process this information solely to provide the service you asked for.

Putting information into SteadyReply does not create attorney-client privilege and does not make your communications legally privileged. If you need privileged advice, speak with a licensed attorney directly.

We collect and process information to provide the services you request, maintain your account, take payment, improve product performance, protect the security of the platform, comply with legal obligations, and communicate with you about your account. We never process it to advertise to you, to build a marketing profile, or to sell or share anything about you. The one analysis we perform beyond your direct requests is Communication Insights, which is off unless you turn it on and exists only to show you your own progress — see “Communication Insights” below.

Your account email; the people you set up (name, relationship, notes, voice settings, and facts you ask us to remember); the messages you submit for analysis; the drafts you generate; and the dated log entries you choose to save, including the date, time, and timezone, and any revisions to a saved reply. We collect basic, privacy-respecting usage metrics (actions only, for example “a reply was drafted”, never the content) to improve the product.

One-off background context and screenshots you import are processed to produce your analysis and are not stored unless the result is saved to your log. If you join the launch waitlist or contact us about Teams on our marketing site, we store the email and details you provide so we can respond.

Our hosting providers generate standard server logs when your device contacts the service. These include your IP address, browser type, and device and operating system information, and they exist to operate, secure, and troubleshoot the service.

We also use your IP address to enforce rate limits that stop one caller from overwhelming the service. We do not store your IP address for this: it is converted into a one-way scrambled value that cannot be turned back into your IP, is not linked to your account, and is deleted once the short rate-limit window closes. We do not derive your location from your IP address, and we do not use any of this to track you.

We use cookies and similar technologies to keep you signed in, remember your preferences such as light or dark mode, and maintain the security of your session. We do not use advertising cookies and we do not use cross-site tracking cookies.

Data is encrypted in transit and at rest. In addition, the content of your saved records — the messages you paste or import, the drafts, your notes, and your log — is encrypted on your device, using a key that only you hold, before it is stored. We do not keep a copy of that key. As a result, we cannot read the content of your saved records, and neither can anyone who might gain access to our database; to us and to them it is unreadable.

Because only you can unlock your records, if you forget your password you will need the recovery key shown to you once when you set up your account. If you lose both your password and your recovery key, we cannot recover your records for you — that is the trade-off for encryption only you can open.

One exception: when you ask us to analyze a message, read a screenshot, or write a draft, the content you submit at that moment is processed by our AI provider as described in “AI processing” below. That processing is transient, it happens only when you request it, and we never store that content in readable form.

Access is otherwise restricted so that you can only ever read or write your own data. We do not sell the content of your conversations to advertisers. We do not sell your data, we do not show ads, we do not track you across other companies’ apps or websites, and we do not use your messages to train AI models. While we use commercially reasonable safeguards, no security system is completely immune from risk, and we cannot guarantee absolute security.

To analyze a message, extract text from a screenshot, or write drafts, the content you submit is sent to our AI provider (Anthropic) for processing. Processing happens only when you ask for it. Replies are AI-drafted suggestions. You review, edit, and decide what to send.

Neither SteadyReply nor our AI provider uses the content of your messages to train generative AI models. This is contractually prohibited, not just our policy.

Your conversations belong to you. Communication Insights is an optional coaching feature that shows you how your own communication is changing over time — for example, that you have been more direct this month, paused more often before replying, or held a boundary more consistently. It is off unless you turn it on, and turning it on is the only thing that starts it.

It works on patterns, not transcripts, and it never leaves your device. The report is worked out in your browser, from records your key has already unlocked there, at the moment you look at it. Nothing is stored and nothing is sent to us— no scores, no trends, no observations. There is no copy of your report on our servers, because one is never created. It is also computed without AI: the measures come from patterns in your own writing, so no part of this feature sends anything anywhere.

You stay in control. Communication Insights is off until you switch it on in Settings, and switching it off stops the analysis immediately — there is nothing left behind to delete, because nothing was kept. Your underlying records are untouched either way. We never sell or share your insights, we do not use them to advertise to you, and we cannot use them for any other purpose, because we never receive them.

Payment information is processed directly by Stripe. SteadyReply does not receive or store complete payment card numbers. We keep your plan and a Stripe customer reference so we can give you the access you paid for and honour cancellations.

We use a small set of providers to run SteadyReply: Supabase (database and sign-in), Vercel (hosting), Anthropic (AI processing, as described above), Stripe (payments), and Resend (transactional email delivery). They process data on our behalf and are not permitted to use it for their own purposes. We do not use third-party analytics or advertising SDKs.

We may send transactional emails relating to security, subscriptions, billing, password resets, and the operation of your account. These are part of providing the service rather than marketing.

Your information may be processed and stored in the United States. If you use SteadyReply from outside the United States, you understand that your information will be processed there.

SteadyReply is for adults (18+). We do not offer accounts to minors and do not knowingly collect personal information from children under 13. Messages you submit may mention your children. That content belongs to you, is protected like everything else you store, and is never used beyond providing the service. If you believe a child has created an account, contact privacy@thesteadyreply.com and we will delete it.

You may at any time:

• access the data held in your account;
• export your data, as a JSON backup or a per-person PDF record;
• correct your data by editing it in the app;
• delete individual entries, wipe your data, or delete your whole account;
• contact us with any privacy question or request.

Residents of certain states may have additional privacy rights under applicable law. Where required, we will honour verified requests. Send them to privacy@thesteadyreply.com.

You can export all of your data at any time (a JSON backup, plus a PDF record per person), and you can permanently delete your account from Settings, then Delete my account. Deleting your account removes your login and everything in it (people, logs, drafts, and settings) and cancels any paid subscription. You can also wipe your data and keep your account. See Delete your account for the full details.

Your account becomes inaccessible immediately and deletion from our active systems begins promptly. Encrypted backups may retain the data for a limited period before being automatically overwritten. We cannot restore an account once deleted, so export anything you may need first.

We retain your information until you delete it, except where longer retention is required for legal, security, fraud prevention, backup recovery, or accounting purposes. Billing records are retained by Stripe as required for accounting and tax, so deleting your account cancels your subscription but does not erase financial records they are legally required to keep. Waitlist and Teams inquiry emails are kept until that outreach is complete or you ask us to delete them.

If you were invited as a tester, your email address is also held on our invite list, which is separate from your account. That entry lets us manage who has access to early features, and it remains after an account is deleted so an invitation stays valid — it holds your email address only, never any of your records or messages. Email us and we will remove you from the invite list as well.

We may disclose information if required by law, court order, subpoena, or other valid legal process, or where necessary to protect our rights, our users, or the public. Message content is never read by humans except as required by law or with your consent.

If 2723 Ventures LLC is involved in a merger, acquisition, financing, or sale of assets, user information may be transferred as part of that transaction. This policy would continue to apply to the transferred information until the acquirer gives notice of a change.

If your organization purchases SteadyReply Teams, your organization may have administrative control over work accounts it creates or pays for, including the ability to manage or remove them.

We may update this Privacy Policy from time to time. Material changes will be communicated through the app, by email, or by updating the date above.

Privacy questions or requests: privacy@thesteadyreply.com.