Plain-language privacy.

When you sign up and use the program, we store:

• Account: email address (your sign-in identifier).
• Payment: handled by Stripe — we never see your card number. We store the Stripe customer + session identifiers so we can match a purchase to your account.
• Program activity:which Steps and Parts you've completed, your Self-Assessment answers, your tasks (the to-dos you save), your Steady Work responses, and your Journal entries.
• Calendar sync: only if you connect Google Calendar, we store the connected Google account email and encrypted OAuth tokens so we can mirror scheduled tasks to your calendar. To detect reschedules, we also read the minimum Google event metadata we need for sync — event IDs, status, start time, update time, and private extended-property metadata. We ignore unrelated events and do not store their details.
• Operational logs: anonymized analytics events (PostHog) and error or mobile crash reports, which stay on infrastructure we operate (self-hosted GlitchTip). We use anonymized enrollment identifiers — never your email, never the body of a Journal entry, task, or Assessment answer. Mobile crash reports exclude request payloads, screenshots, and view hierarchy. Our public marketing landing page uses Umami (self-hosted, cookieless) to measure visits, traffic sources, and landing-page interactions separately from your program data.

On the mobile app you can dictate a to-do instead of typing it. The speech-to-text runs on your phone's own recognizer, provided by iOS or Android — Steady's servers never receive your audio. We store only the text you choose to save, and that text is a task like any other: private to you and never shared with a Coach.

If you ask Steady to break a task into smaller steps, the text of that task is sent to a model we run on our own infrastructure, which suggests candidate first steps. Your words are never sent to a third-party AI service, and the model is used only to split the task into steps, never to assess you. Nothing is saved until you review the suggestions and choose what to keep. The task text is processed in the moment, is not stored by the model, and is never sent to analytics.

The hard rule, the one that makes the rest of this policy meaningful: Kevin (your Coach) cannot read your Journal entries, your tasks, your Steady Work responses, or your Self-Assessment answers. Our systems enforce this in code, backed by automated tests; it is not a matter of trust.

In v1 of Steady, the Coach has no per-Enrollee dashboard at all. The Program is self-serve: the content is the support, and you control your own data.

Your data lives on our own servers, hosted on Amazon Web Services (AWS). Account details and program activity are stored in our database; files (handouts, lesson assets, data exports) live in our own S3-compatible object storage. Sign-in and sessions run on our self-hosted identity server. Connections between your browser and Steady use HTTPS.

We use the following sub-processors to deliver the program. Each handles a narrow slice of data; none receives more than they need.

• Amazon Web Services (AWS) — cloud infrastructure hosting our self-operated database, file storage, sign-in, and the app itself.
• Stripe — payment processing, billing portal, invoices.
• Resend — transactional email (account setup and invite links, export-ready notifications, lesson-ready notifications).
• PostHog — anonymized usage analytics (event-level only; no content of tasks, Journal entries, or Assessment answers).
• GlitchTip (self-hosted) — web error monitoring and mobile native crash monitoring on our own infrastructure; crash data never leaves servers we operate. Session replay, mobile screenshots, and mobile view hierarchy capture are disabled.
• Better Stack — uptime monitoring; receives only public endpoint health checks, never your data.
• Google Calendar — optional two-way calendar sync only if you connect your Google account; receives the scheduled task text, time, and Steady link needed to create and update calendar events. Steady also reads limited event metadata from Google to reconcile changes, and does not store unrelated events.

Our database, file storage, sign-in, and web hosting run on software we operate ourselves on AWS infrastructure — these are self-hosted, not separate third-party services. Landing-page analytics use Umami, which we also self-host. If you do not connect Google Calendar, we do not send your program data to Google for calendar sync.

You can, at any time:

• Export a copy of everything we hold about you from /portal/me. The export is a JSON file delivered via a signed link.
• Delete your account from /portal/me. Soft-delete is immediate; you have 14 days to change your mind by emailing kevin@newtreecounseling.com. After 14 days, your account and all linked data are permanently purged.
• Cancel billing from /portal/me/billing (Stripe Customer Portal).
• Ask us questions — email kevin@newtreecounseling.com.

California and EU/UK residents: the rights above (access, deletion, portability) satisfy the corresponding CCPA / GDPR obligations. There is no sale or sharing of personal information for cross-context behavioral advertising.

When you delete your account, Stripe retains its own transaction history per its tax + fraud-prevention obligations. We delete our link to that history; Stripe keeps the underlying records under its own privacy terms.

We use a session cookie from our self-hosted sign-in (Zitadel) to keep you signed in. We do notuse third-party advertising cookies. Our public marketing landing page uses Umami (self-hosted analytics) to measure visits, traffic sources, and landing-page interactions; it does not set analytics cookies. If you opt out via your browser's Do Not Track signal, we honor it.

Steady is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, email kevin@newtreecounseling.com and we will close the account.

If we change how we use data in a way that affects you, we will update the “Last updated” date at the top of this page and email signed-in Enrollees ahead of the change taking effect.

New Tree Counseling, P.C. — Kevin Barr, LMFT.
kevin@newtreecounseling.com