Data Retention Policy

1. Overview

This policy explains how long different types of data exist and how you can manage them.

2. On-Device Data

All personal data you enter into SteadiDay is stored locally on your device. This includes:

• Medication schedules, dosages, and reminder times
• Tasks, appointments, and daily routines
• Emergency contacts and trusted persons
• Food and water intake logs
• Health data synced from Apple Health (iOS) or Health Connect (Android)
• App settings and preferences
• Insurance card details (plan name, member ID, group number)
• Medical records (lab results, diagnoses, procedures, allergies)
• Doctor and care team information
• Notes and parking spot locations

How long it's kept: This data remains on your device for as long as the app is installed. If you are not signed in, it is never uploaded to our servers. If you are signed in, some of this data (medications, tasks, check-ins, activity summaries) is synced to our servers — see Section 2.1 below. You can delete individual items at any time within the app, or remove all data by uninstalling the app.

2.1 Synced Account Data (If Signed In)

If you create an account and sign in, the following data is synced to our servers (hosted on Supabase):

• Medications and schedules
• Tasks and reminders
• Check-in responses
• Activity summaries

How long it's kept: Synced data is retained for as long as your account exists. The in-app deletion action removes active account records from SteadiDay's application databases immediately; infrastructure backups, security logs, and provider records may remain for a limited period under provider retention schedules or legal requirements.

What is not stored in account sync: Apple Health and Health Connect records other than an optional shared daily step count, source photos, and insurance card details. A source photo is still transmitted through our backend to OpenAI when you choose an AI scanning feature.

2.2 Backend Data Retention Periods

Our backend server temporarily stores certain data to provide safety and sharing features. This data has specific retention periods and is automatically cleaned up:

• Safety Session data (live location): The most recent GPS coordinates are stored so the private live link can work. Ended sessions are deleted after approximately 24 hours. Abandoned active sessions expire after seven days and are deleted by the following cleanup cycle.
• Caregiver activity snapshots: Encrypted activity data shared with a caregiver (medication adherence, task completion, step counts) is retained for up to 90 days without an update, then automatically deleted. Daily activity history is kept for 30 days.
• Emergency escalation data: User names and contact information used during fall detection escalation are encrypted with AES-256-GCM and retained for 24 hours after the session ends, then automatically deleted.
• AI-processed data (photos and audio): SteadiDay does not save source photos or audio in its application database. OpenAI may retain API inputs and outputs for up to 30 days for service delivery and abuse prevention, unless a shorter retention control applies.

3. Pseudonymous Analytics Data

SteadiDay collects pseudonymous usage data via Firebase Analytics (provided by Google) and uses Firebase Crashlytics for crash reporting. This includes:

• An app-installation identifier (SteadiDay does not set your signed-in account ID as the Analytics user ID)
• App usage events and feature usage patterns (not the content you enter)
• Crash reports and error logs (technical information only, no personal data)
• General device information (device model, operating system version)

This data does not include any health information, medication details, personal contacts, or any content you create in the app.

How long it's kept: Firebase retains analytics and crash data according to the retention settings configured for those services. Installation identifiers are not the same as your SteadiDay account ID, but they are device/app-instance identifiers and should not be described as fully anonymous.

4. Emergency SMS Data

When you use the Emergency SOS feature or fall detection activates, the app sends an SMS to your trusted contacts via Twilio, a third-party messaging service. The message includes your display name, GPS coordinates, and an alert.

How long it's kept: The relay transmits the message and does not store your data afterward. Twilio may retain message delivery logs (phone numbers and timestamps) for up to 13 months in accordance with their data retention policies and telecommunications regulations.

The app also sends optional check-in notification SMS messages to trusted contacts (if you enable this feature) via the same Twilio relay service, subject to the same retention practices.

5. Website Data

If you visit steadiday.com or submit the contact form:

• Contact form submissions: Your name, email, and message are received by us and retained for as long as needed to respond to your inquiry, then deleted.
• Website analytics: Pseudonymous and aggregated browsing data (such as pages visited, referral source, and general geographic region) is collected by Google Analytics and retained according to its configured retention settings and policies.
• Cookies: Our website uses cookies for analytics. You can control cookies through your browser settings.

5.5 Subscription Data

If you subscribe to SteadiDay Premium:

• Payment information: Processed and stored by the Apple App Store or Google Play Store — we never receive or store your credit card, billing address, or payment method
• Subscription status: Your pseudonymous subscription status (active, expired, trial) is managed by RevenueCat and stored locally on your device. RevenueCat retains subscription event data and an app user identifier according to its data retention policies.
• On your device: Subscription tier, purchase date, and expiration date are stored locally to manage feature access

6. Uninstalling the App

When you uninstall SteadiDay, all data stored by the app on your device is permanently deleted by your operating system. This includes all medications, tasks, contacts, health data, settings, and preferences. This deletion is immediate and irreversible.

If you have an account, uninstalling the app does not delete your synced server data. To delete all server data, use the "Delete Account" option in app settings before uninstalling, or contact us at support@steadiday.com.

7. Device Backups

Your SteadiDay data may be included in your device's standard backup:

• iPhone: iCloud or Finder/iTunes backups may include SteadiDay data. This is controlled by your iOS backup settings, not by SteadiDay.
• Android: Google backup may include SteadiDay data. This is controlled by your Android backup settings.

SteadiDay also offers an in-app "Export My Data" feature that lets you save a backup file to keep safe. This exported file is stored wherever you choose to save it and is under your control.

8. Your Control

Because your data lives on your device, you have complete control:

• View: All your data is visible to you within the app at any time
• Delete: Remove individual medications, tasks, or contacts from within the app
• Export: Save a backup of your data using the Export My Data feature in Settings
• Remove everything: Uninstall the app to permanently delete all SteadiDay data from your device
• Health permissions: Revoke health data access at any time through your device's privacy settings
• Account deletion: Delete your account and active synced, caregiver-sharing, check-in, and Safety Session records from within app settings. Limited provider records or backups may follow their own retention schedules.
• Subscription: Manage or cancel your subscription through the App Store or Google Play Store

For any questions about data retention, please contact us using the Feedback feature in the app or through our website contact form.