Privacy Policy

SteadyReply is operated by 2723 Ventures LLC (“we”, “us”). This policy explains what we collect, why, and the control you have over your data.

SteadyReply is designed to help people manage some of the most sensitive conversations in their lives. Protecting those conversations is central to how we build and operate the service.

Messages you submit to SteadyReply may contain sensitive personal information relating to family matters, employment, legal disputes, health, or other personal topics. We process this information solely to provide the service you asked for.

Putting information into SteadyReply does not create attorney-client privilege and does not make your communications legally privileged. If you need privileged advice, speak with a licensed attorney directly.

We collect and process information to provide the services you request, maintain your account, take payment, improve product performance, protect the security of the platform, comply with legal obligations, and communicate with you about your account. We never process it to advertise to you, to build a marketing profile, or to sell or share anything about you. The one analysis we perform beyond your direct requests is Communication Insights, which is off unless you turn it on and exists only to show you your own progress — see “Communication Insights” below.

Your account email; the people you set up (name, relationship, notes, voice settings, and facts you ask us to remember); the messages you submit for analysis; the drafts you generate; and the dated log entries you choose to save, including the date, time, and timezone, and any revisions to a saved reply. We collect basic, privacy-respecting usage metrics (actions only, for example “a reply was drafted”, never the content) to improve the product.

One-off background context and screenshots you import are processed to produce your analysis and are not stored unless the result is saved to your log. If you join the launch waitlist or contact us about Teams on our marketing site, we store the email and details you provide so we can respond.

Our hosting providers generate standard server logs when your device contacts the service. These include your IP address, browser type, and device and operating system information, and they exist to operate, secure, and troubleshoot the service.

We also use your IP address to enforce rate limits that stop one caller from overwhelming the service. We do not store your IP address for this: it is converted into a one-way scrambled value that cannot be turned back into your IP, is not linked to your account, and is deleted once the short rate-limit window closes. We do not derive your location from your IP address, and we do not use any of this to track you.

Website visits. Our public website, thesteadyreply.com, uses Vercel Web Analytics to count page visits: which page was viewed, the referring site or campaign link, and broad device and country information. It sets no cookies, does not identify you, is not linked to your SteadyReply account, and does not follow you across other websites. It is not used inside the app.

Usage events. To understand which parts of SteadyReply are actually useful, we record actions you take in the app: which screens you open, which features you use (for example, that a reply was drafted or a rehearsal was run), and roughly how long the app is on screen. These events are tied to your account so we can count people rather than taps. They never contain the content of any message, draft, or record. They are stored only on our own systems, are used only to improve the product, are never sold or shared, and are not collected by any third-party analytics tool. For each AI request we also record which feature ran, which model answered, and how many tokens it used (a size, never the words), so we can keep the cost of running SteadyReply in check.

Safety-check tallies. Each time you ask for a reply or a perspective, we add one anonymous tally that records only whether our safety checks raised a flag and which check did. It carries no account, no text, and nothing that identifies you or your situation. We use it only to notice if the safety checks stop working.

Sign-up step counters.Before you have an account, we count which step of the welcome and sign-up screens a visitor reached, and, if sign-up fails, a broad reason such as “email already registered.” Each count carries a random code that exists only in that browser tab and disappears when it closes. It holds no email address, no account, no IP address, and no device identifier. We use it only to find where people get stuck.

Which link brought you.Our own links in social posts carry a short campaign code, such as “w9c” for one video. If you arrive through one, your browser keeps that code for up to 30 days, it is counted with the sign-up steps above, and it is saved with your account if you sign up. The code names the post, not you. We use it only to learn which posts help people find SteadyReply. We do not use advertising trackers or share it with anyone.

We use cookies and similar technologies to keep you signed in, remember your preferences such as light or dark mode, remember which of our links brought you (see above), and maintain the security of your session. We do not use advertising cookies and we do not use cross-site tracking cookies.

Data is encrypted in transit and at rest. In addition, the content of your saved records — the messages you paste or import, the drafts, your notes, your log, and any parenting plan you upload — is encrypted on your device, using a key that only you hold, before it is stored. We do not keep a copy of that key. As a result, we cannot read the content of your saved records, and neither can anyone who might gain access to our database; to us and to them it is unreadable.

Because only you can unlock your records, if you forget your password you will need the recovery key shown to you once when you set up your account. If you lose both your password and your recovery key, we cannot recover your records for you — that is the trade-off for encryption only you can open.

One exception: when you ask us to analyze a message, read a screenshot, or write a draft, the content you submit at that moment is processed by our AI provider as described in “AI processing” below. That processing is transient, it happens only when you request it, and we never store that content in readable form.

Access is otherwise restricted so that you can only ever read or write your own data. We do not sell the content of your conversations to advertisers. We do not sell your data, we do not show ads, we do not track you across other companies’ apps or websites, and we do not use your messages to train AI models. While we use commercially reasonable safeguards, no security system is completely immune from risk, and we cannot guarantee absolute security.

On paid plans you can upload your parenting plan, custody order, or decree so SteadyReply can show you what it says when a schedule, holiday, or cost question comes up. When you upload it, the document is sent once to our AI provider, Anthropic, to find the clauses that matter day to day. It is not used to train AI models. Identification numbers such as Social Security and account numbers are left out of the clauses kept.

The clauses, and the original file if it is kept, are encrypted on your device with your key before they are stored, the same as the rest of your record, so we cannot read them. When a later message touches one of those topics, only the matching clauses are sent with that request. You can remove a clause, the whole plan, or the original at any time, and all of it is deleted when you delete your account. SteadyReply shows your document’s own words. It does not interpret them, and it is not legal advice.

If we learn that your personal information has been accessed or disclosed without authorization, we will investigate promptly and tell affected users by email and in the app, as the law requires. The notice will say what happened, what information was involved, and what you can do about it. Because the content of your saved records is encrypted on your device with a key only you hold, it is designed to stay unreadable even to someone who reaches our database.

To analyze a message, extract text from a screenshot, or write drafts, the content you submit — the message itself, any context you add, and the notes we keep about that person, so the draft is written in your voice — is sent to our AI provider, Anthropic, for processing. Processing happens only when you ask for it, and the app asks your permission the first time before any of this is sent. Your saved records and log are not part of this: those stay encrypted on your device and are never sent to Anthropic or anyone else. Replies are AI-drafted suggestions. You review, edit, and decide what to send.

Anthropic is contractually required to protect what you send with security and confidentiality safeguards consistent with our own, to process it only to generate your response, and not to use it to train its models. Neither SteadyReply nor Anthropic uses the content of your messages to train generative AI models — this is contractually prohibited, not just our policy.

Your conversations belong to you. Communication Insights is an optional coaching feature that shows you how your own communication is changing over time — for example, that you have been more direct this month, paused more often before replying, or held a boundary more consistently. It is off unless you turn it on, and turning it on is the only thing that starts it.

It works on patterns, not transcripts, and it never leaves your device. The report is worked out in your browser, from records your key has already unlocked there, at the moment you look at it. Nothing is stored and nothing is sent to us— no scores, no trends, no observations. There is no copy of your report on our servers, because one is never created. It is also computed without AI: the measures come from patterns in your own writing, so no part of this feature sends anything anywhere.

You stay in control. Communication Insights is off until you switch it on in Settings, and switching it off stops the analysis immediately — there is nothing left behind to delete, because nothing was kept. Your underlying records are untouched either way. We never sell or share your insights, we do not use them to advertise to you, and we cannot use them for any other purpose, because we never receive them.

Payment information is processed directly by Stripe. SteadyReply does not receive or store complete payment card numbers. We keep your plan and a Stripe customer reference so we can give you the access you paid for and honour cancellations.

We use a small set of providers to run SteadyReply: Supabase (database and sign-in), Vercel (hosting), Anthropic (AI processing, as described above), Stripe (payments), and Resend (transactional email delivery). They process data on our behalf and are not permitted to use it for their own purposes. We do not use third-party analytics or advertising SDKs.

We may send transactional emails relating to security, subscriptions, billing, password resets, and the operation of your account. These are part of providing the service rather than marketing.

Your information may be processed and stored in the United States. If you use SteadyReply from outside the United States, you understand that your information will be processed there.

SteadyReply is for adults (18+). We do not offer accounts to minors and do not knowingly collect personal information from children under 13. Messages you submit may mention your children. That content belongs to you, is protected like everything else you store, and is never used beyond providing the service. If you believe a child has created an account, contact privacy@thesteadyreply.com and we will delete it.

You may at any time:

• access the data held in your account;
• export your data, as a JSON backup or a per-person PDF record;
• correct your data by editing it in the app;
• delete individual entries, wipe your data, or delete your whole account;
• contact us with any privacy question or request.

Residents of certain states may have additional privacy rights under applicable law. Where required, we will honour verified requests. Send them to privacy@thesteadyreply.com.

You can export all of your data at any time (a JSON backup, plus a PDF record per person), and you can permanently delete your account from Settings, then Delete my account. Deleting your account removes your login and everything in it (people, logs, drafts, and settings) and cancels any paid subscription. You can also wipe your data and keep your account. See Delete your account for the full details.

Your account becomes inaccessible immediately and deletion from our active systems begins promptly. Encrypted backups may retain the data for a limited period before being automatically overwritten. We cannot restore an account once deleted, so export anything you may need first.

We retain your information until you delete it, except where longer retention is required for legal, security, fraud prevention, backup recovery, or accounting purposes. Billing records are retained by Stripe as required for accounting and tax, so deleting your account cancels your subscription but does not erase financial records they are legally required to keep. Waitlist and Teams inquiry emails are kept until that outreach is complete or you ask us to delete them.

When you delete your account we keep a deletion record for up to 12 months: the email address, the dates the account was created and deleted, and the plan it was on. It holds none of your people, messages, drafts, logs, or usage events, and we use it only for fraud prevention (for example, repeated free trials) and support.

If you were invited as a tester, your email address is also held on our invite list, which is separate from your account. That entry lets us manage who has access to early features, and it remains after an account is deleted so an invitation stays valid — it holds your email address only, never any of your records or messages. Email us and we will remove you from the invite list as well.

We may disclose information if required by law, court order, subpoena, or other valid legal process, or where necessary to protect our rights, our users, or the public. Message content is never read by humans except as required by law or with your consent.

If 2723 Ventures LLC is involved in a merger, acquisition, financing, or sale of assets, user information may be transferred as part of that transaction. This policy would continue to apply to the transferred information until the acquirer gives notice of a change.

If your organization purchases SteadyReply Teams, your organization may have administrative control over work accounts it creates or pays for, including the ability to manage or remove them.

We may update this Privacy Policy from time to time. Material changes will be communicated through the app, by email, or by updating the date above.

Privacy questions or requests: privacy@thesteadyreply.com.