SteadyFile

Legal

Privacy Policy

Last updated: October 13, 2026

This policy explains how SteadyFile handles information for the public site, research surveys, the browser-local workspace, and optional accounts. SteadyFile is designed around data minimization, user control, and no access to your file for anyone else.

Translations are provided for accessibility and convenience. If there is any inconsistency, the English version is the reference version unless a reviewed local version is published.

Request metadata

Hosting providers may process basic request metadata such as IP address, user agent, URL, timestamps, and error details for security, reliability, and abuse prevention.

Survey responses

If you choose to answer a SteadyFile research survey, your responses are processed by Tally. Do not include the names of employers, landlords, coworkers or family members, medical details, or anything that could identify you unless a question explicitly asks for it and you choose to provide it.

Browser-local workspace content

The current private workspace saves draft records in your browser by default. That content stays on your device unless you export it, import it into an account feature, clear browser storage, or choose another save path.

Account backup data

If you sign in, SteadyFile stores a copy of your structured workspace (profile fields, timeline entries, people, record references and their fingerprints) so it is available on your other devices, plus your Packet Pass record. It also keeps a history of your timeline entries: each version, with a time set by the server, so your packet can show when an entry was first recorded and whether it changed. Edits add a version rather than replacing the old one. When you delete an entry, its earlier wording is erased and only the fact and time of the deletion remain. Original files are never stored. You can download this data or delete your account from the account page at any time.

Signing in with Google or an email link

Sign-in is passwordless. With Google, SteadyFile receives only your name, email address, profile photo and, for Google Workspace accounts, the organization's domain (used only to warn you if you are signing in with a work account). Signing in does not give SteadyFile access to your Gmail, Drive, contacts or calendar. With an email link, SteadyFile uses your email address only to send the sign-in link.

Google Drive (optional)

If you choose Save PDF to Google Drive or Choose from Google Drive, Google asks you to allow SteadyFile limited Drive access (the drive.file permission). It covers only files you pick in Google's file picker and files SteadyFile saves for you, never the rest of your Drive. The transfer happens directly between your browser and Google: the file does not pass through or get stored on SteadyFile servers, and the access token stays in your browser tab. A picked file is copied into your browser on that device, like any attached copy. You can remove SteadyFile's access at any time in your Google Account under Security, Third-party apps. Files saved to a work or school Google account may be visible to the organization that runs it, so SteadyFile warns you before using one.

Sharing and processors

SteadyFile uses third-party infrastructure to operate the site and product, including hosting, authentication/database services, payments, email and survey tooling. Current processors may include Vercel, Supabase, Stripe, Google and Tally, depending on which feature you use.

  • We do not sell or rent user data.
  • We do not build access to user files for employers, landlords or anyone else.
  • We do not use advertising trackers, ad pixels, session recording or data-broker sharing.
  • We do not sell or share personal information for cross-context behavioural advertising.
  • We do not ask users to upload original evidence files in the current browser-local workspace.
  • If you choose to keep a copy of a file with a record, it is saved in your browser on that device only. It is not uploaded or synced, and it is added to your packet PDF on the device. Clearing your browser data or removing the copy deletes it.

Cookies and analytics

SteadyFile runs its own analytics so we can see which pages help, where people get stuck and whether the site is fast. It never reads what you write in your file, and it is never linked to your account or email. You can change your choice at any time with Cookie settings at the bottom of every page.

Needed for the site to work

Always on. Your privacy choice (cc_cookie, 6 months), your sign-in if you sign in, your Packet Pass if you buy one (sf_packet_pass, 1 year), and your draft file and language in this browser's storage.

Anonymous counts

Always on, with no cookie and no identifier. We count page views, button and link clicks, downloads and browser error types, with a broad source (for example search or reddit, never the full address you came from), campaign tags, device type, browser family, operating system, and country with province or state from the hosting provider's IP lookup. The IP address itself is not stored with these counts.

Analytics (only if you allow it)

A random visitor id (sf_vid, 13 months) and session id (sf_sid, 30 minutes idle) in our own cookies, so we can count return visits and sessions, plus time on page, scroll depth, which part of the app you open, and page speed. Vercel Web Analytics and Speed Insights, which set no cookies, also run only with this choice.

  • Analytics are off until you allow them. The banner offers Allow and No thanks with equal weight.
  • If your browser sends a Global Privacy Control signal, we treat it as a no and do not show the banner. You can still opt in from Cookie settings.
  • We do not respond to the older Do Not Track header, because it has no common standard; Global Privacy Control is honoured as above.
  • Turning analytics off deletes the analytics cookies and the analytics rows recorded under this browser's visitor id.
  • Analytics rows are kept for 13 months, then deleted automatically. They are stored with Supabase in our own database and read only by SteadyFile staff through aggregate reports.
  • Search and sign-in codes, checkout ids and anything after a ? or # in an address are dropped before anything is recorded, except campaign (utm) tags.
  • We record when you make a cookie choice (the choice, the banner version and a random consent id) so we can show that consent was given.

Your controls

You can export your file from the workspace at any time. If you have an account, you can download everything it holds as JSON or delete the account and its synced data from the account page.

Retention

Browser-local content remains in your browser until you delete it. Account records are retained while your account is active and are deleted after account deletion, subject to backup cycles and legal obligations.

Legal process

SteadyFile may disclose information if required by valid legal process. We will try to notify affected users when legally permitted.

Contact

For privacy, access, correction, export, deletion, or security questions, email hello@steadyfile.com.