YOUR PERSONAL JOURNAL

Privacy Policy

Last updated: October 23, 2026

Your journal is personal. This policy explains what Steady collects, how it is used, and how to contact us about your information.

Who runs Steady

Steady is the personal health journal at app.buttered.org, operated by Toast. For privacy questions or requests, email deleon729@gmail.com.

Information we collect

• Account information: your email address and the identity identifier supplied by our sign-in provider.
• Journal information: the weight entries, food names, calories, protein, saved meals, water, activity, goals, preferences, and reminder settings you choose to enter. If you complete journey setup, we also store your height, optional gender, starting weight and date, chosen goal date, and optional motivation. Activity records may include the weight used for an estimated calorie figure. These profile details stay with your private journal and are included in export and deletion operations.
• Technical information: sign-in and session records, timestamps, and request information processed by our hosting and identity providers, such as IP addresses, browser information, and error or security logs. Steady’s own error events use known route names, statuses, and timings rather than journal contents, account emails, cookies, or sign-in codes. Request query strings are redacted from Cloudflare observability.

Google sign-in

When you choose Google, Google and Supabase process your sign-in. Basic Google identity information, including your email, profile information, and account identifier, may be received by Supabase. Steady uses your verified email and identity identifier to create your account, sign you in, and connect you to your journal. Steady does not request access to your Gmail messages, contacts, Google Drive files, or Google health data. Your Google password is entered with Google, not Steady.

How we use information

We use information to authenticate you, save and synchronize your journal across devices, show your progress, apply your settings, prevent abuse, troubleshoot failures, and respond to support and privacy requests. Steady does not sell your personal information or use your journal for advertising.

Storage and service providers

Cloudflare hosts the website and stores journal and app-session records in its D1 database. Supabase provides authentication and stores identity and sign-in records. Google processes Google sign-in when you select it. When email codes are enabled, the configured email delivery provider processes the recipient address and sign-in message to deliver your code. These providers process information needed to deliver and secure their services. Authorized administrators may access information as needed for support, security, maintenance, or a verified data request. Information may also be disclosed when required by applicable law.

Our providers may process information in countries other than where you live. Their privacy information is available from Cloudflare, Supabase, and Google.

Cookies and browser storage

Steady uses essential cookies for sign-in flows and account sessions. Account sessions expire after seven days unless you sign out sooner. Your browser may cache public files to help the installed app load. Steady does not intentionally cache authenticated journal pages or health records in its service worker. Older versions may have left device journal data or an import key in browser storage; these are used to recover your earlier entries after sign-in. Exported backup files stay wherever you save them. Google and Supabase may use their own cookies during authentication.

Retention and your choices

Journal and account records are retained while your account is in use or until you request deletion. Expired app sessions, sign-in flows, and rate-limit records are removed by scheduled cleanup. Provider logs and backups follow their respective retention settings and may remain for a limited period after active records are removed.

You can edit or remove individual journal entries and export your journal from the app. In Goals & settings, “Delete journal data” removes your saved journal and resets goals and reminders across devices, while keeping your sign-in account. Earlier guest journals, exported files, provider logs, and backups are not erased by that button. To request access, correction, account deletion, or deletion of earlier guest records, email deleon729@gmail.com from the account email address. We may need to verify ownership before acting. For full account deletion, use “Delete account” in Goals & settings, enter your account email, and type DELETE ACCOUNT. This removes the active journal and sign-in identity and revokes all Steady sessions. If identity cleanup cannot finish immediately, a deletion job retains the account identifier temporarily and retries automatically. Earlier guest records and provider logs or backups are outside this operation. Signing out or removing Google's access permission does not delete your saved Steady journal. Copies you exported or saved in browser storage must be removed separately.

Security

Steady uses HTTPS, account checks, and secure session cookies to protect access. No online service can guarantee absolute security. Protect your Google account and devices, and sign out when using a shared device.

Children and policy changes

Steady is intended for adults and is not directed at children. Contact us if you believe a child has provided personal information. We will update this page when our practices change and revise the date shown above. Material changes will be communicated through the site where appropriate.