Privacy Policy - Stay Steady

Last updated: 18 October 2026

Stay Steady (“the App”) is developed by Data Consulting Services. This Privacy Policy explains how we handle your information when you use our app.

Our Privacy Commitment

Stay Steady is designed with privacy as a core principle. Your financial data stays on your device by default. The only data that ever leaves your device does so for clearly described reasons — optional sign-in for ML categorization contributions, optional iCloud sync (iPhone, iPad and Mac), optional anonymous analytics, optional crash reporting, an optional one-time model download for the on-device AI chat (Android only), and an error report you choose to email us after a failed import — and only to processors that are bound by GDPR-compliant data processing agreements. Two features contact a service that is not ours, and only when you ask them to: Refresh prices, with a price source you set up yourself, and Fetch now, with a service you subscribe to yourself that hands over your transactions. See “Prices of Your Positions” and “Transactions From a Service You Subscribe To” below.

Stay Steady is free to use. There is no Pro tier, no subscription, and no in-app purchases.

Information We Do NOT Collect

  • We do not store your transactions, budgets, or savings goals on our servers
  • We do not sell, rent, or share your data with advertisers or data brokers
  • We do not use advertising identifiers (IDFA / IDFV)
  • We do not read your device’s location. A crash report arrives with an approximate city; see Crash Reporting
  • We do not run third-party advertising or marketing SDKs
  • We do not require a marketing profile, name, or phone number
  • We do not connect to your bank, and the app never asks for your bank login. You can let the app fetch your transactions from a service you subscribe to yourself (see below)

Information You Provide

Account (Optional)

You can use Stay Steady fully without an account. If you choose to create one (to contribute category corrections that improve the on-device ML model), we collect:

  • An opaque user identifier issued by your platform’s sign-in provider (Sign in with Apple on iPhone, iPad and Mac; Google Sign-In on Android)
  • Your email when the provider passes it through (you may also use a relay address with Apple)
  • With Google Sign-In, the name and profile picture of your Google account, which Google passes along. The app does not use them

Authentication is handled by Supabase, our backend provider (see Third-Party Services below). We never see your sign-in password.

Data That Stays on Your Device

Financial Transactions

All imported transactions (from CSV, OFX, CODA, MT940, receipts, or manual entry) are stored locally on your device. On iOS this uses SwiftData with iOS Data Protection encryption; on Android this uses Room on top of Android’s file-based encryption. Your transactions are encrypted whenever your device is locked.

Savings Goals & Budgets

Your savings goals, budget limits, and financial preferences are stored locally on your device. This data never leaves your device unless you enable iCloud sync (iPhone, iPad and Mac).

Custom Categories & Learned Rules

Categories you create and category rules the app learns from your corrections are stored locally on your device.

App Settings

Your preferences (theme, notifications, alert thresholds, etc.) are stored locally. On iPhone, iPad and Mac, if you turn on Sync Settings, your spending-alert preferences sync via iCloud Key-Value Store; every other setting stays on the device.

iCloud Sync (Optional, Apple Devices Only)

How It Works

On iPhone, iPad and Mac, if you enable iCloud sync in Settings:

  • Transactions, goals, budgets, and custom categories sync to your private iCloud account via Apple’s CloudKit private database
  • Only you can access this data with your Apple ID
  • Sync is disabled by default — you must explicitly enable it
  • Sync uses the Apple Account your device is signed in to. It does not need Sign in with Apple or an account with us

The Android app does not sync across devices.

What Syncs

  • Financial transactions
  • Savings goals
  • Budget configurations
  • Custom categories and rules
  • Spending-alert preferences, if you turn on Sync Settings (via Key-Value Store)

Your Control

  • Enable or disable sync anytime in the app’s Settings
  • Disabling sync keeps existing local data
  • iCloud data can be deleted via Apple’s iCloud settings

Category Corrections (Signed-In Users Only)

What this is

When you correct a transaction’s category, that correction is shared to improve our ML categorization model. This happens only while you are signed in. Signing in is optional and the app is fully usable without an account — if you never sign in, no correction ever leaves your device.

A correction you turn into a rule with a condition (“Only when…”) is not shared, and neither is a later correction to a transaction that such a rule filed.

Data collected:

  • Merchant name (e.g., “Colruyt”, “Delhaize”)
  • Original category (ML prediction)
  • Your corrected category
  • Your account identifier
  • App version and ML model version

Data NOT collected:

  • Transaction amounts
  • Transaction dates
  • Account numbers, IBANs, or balances
  • Your name, email or location

How it works:

  • Sent via HTTPS to our training pipeline (hosted on Supabase, EU region)
  • Aggregated with corrections from other signed-in users to retrain the model
  • Never sold to third parties

Your control:

  • Signing in is what enables this. Creating an account is optional, and staying signed out means no corrections are sent.
  • Sign out to stop sending them. Settings → Account.
  • Delete your account (Settings → Account → Delete account) to remove your contributions from our servers.

Not anonymous, and we would rather say so. Corrections are stored against your account identifier — that is what makes the contributor profile and its counts possible. They are not tied to your name or email in the training data, but they are linked to your account and we can therefore delete them on request. Earlier versions of this policy described these contributions as anonymous, as coming from a randomly generated device identifier, and as gated behind a separate consent dialog. None of that matched the app, and this section was corrected on 2026-08-04.

Anonymous Usage Analytics (Optional)

If enabled, Stay Steady sends anonymous, aggregated usage events to Aptabase, an open-source, privacy-focused analytics provider hosted in the European Union.

What we collect (only if you opt in)

  • App launches, screen / feature opens (e.g. settings, savings goals)
  • High-level events (transaction added, goal created)
  • App version, OS version, device model, locale

What we never collect

  • Transaction amounts, merchants, descriptions
  • Account numbers or IBANs
  • IP addresses (Aptabase explicitly does not log them)
  • Advertising identifiers
  • Persistent device IDs
  • Any account or contact information

How it works

  • Analytics is off by default
  • A rotating session ID (a fresh UUID) is generated locally each time you use the app and resets after one hour of inactivity
  • Events are sent over HTTPS to https://eu.aptabase.com — Aptabase’s data processing happens entirely within the EU
  • You can turn analytics off (or back on) at any time in Settings → Privacy

Crash Reporting (Optional)

To improve stability, Stay Steady sends crash reports and performance traces to Sentry (EU region), unless you turn this off. They are not anonymous: each carries an identifier, described below.

What is collected

  • Stack traces and exception details when the app crashes or hits a recoverable error
  • App version, OS version, device model, and technical details of the device such as free memory, language and time zone
  • A random installation identifier made on your device, so that reports from one install can be told apart. When you are signed in, your account identifier instead
  • The city and country the report was sent from, which Sentry derives from the network address of the request. The address itself is not kept
  • Anonymized session replay (UI-only, with text and images masked) — iOS only, and only for sessions where an error occurred. Android does not record session replay at all.
  • Performance traces (e.g., screen load times) — sampled

What is NOT collected

  • Transaction content, merchant names, amounts, IBANs, or balances
  • Any text you typed into form fields (always masked in session replays)
  • Any image content (always blocked in session replays)

Your control

  • Crash reporting is on until you turn it off, in the app’s Settings, on both iOS and Android
  • Sentry data is hosted in the EU and is bound by a Data Processing Agreement

Reporting a File That Would Not Import (Optional)

When an import fails, Stay Steady can prepare an email to apps@dataconsultingservices.net so we can fix the import. The app only prepares the email in your own mail app — nothing is sent until you press Send yourself.

What the email contains

  • By default, only the details of the error: the app version, your OS version and language, the file type and size, and an error code
  • No transactions and no part of your file

Attaching a masked copy (your choice)

You can choose to attach a masked copy of the file. In that copy, letters and digits in account numbers, amounts, names and descriptions are replaced; dates and the file’s layout stay, because those are usually what fails, as do a few column words and currency or bank codes. Before anything is prepared, the app shows you the masked copy exactly as it will be attached and asks you to confirm. Your original file is never sent.

What we do with it

  • We use it only to reproduce and fix the import, and we never share it
  • We delete the email and any attachment within 30 days after the fix ships
  • The support mailbox is hosted by Hostinger in France (EU)

Prices of Your Positions (Optional)

In Net Worth, an investment or pension item can hold positions: a name, a quantity and a price. You can always type the price yourself. If you would rather have the app fetch prices, you set up a price source in Settings: Alpha Vantage, EODHD or Twelve Data with a key you request from them, or a web address of your own. Stay Steady has no price source of its own.

Nothing is fetched until you tap Test in the price source’s screen or Refresh prices in an item. The app never fetches prices in the background.

What leaves your device, and to whom

  • To your price source: the symbol of each position that has one (for example IWDA.AS), together with your key for that source. The request goes straight from your device to the source. Like any website, the source also sees your IP address and the technical details a web request carries, such as the app’s name and version and your system’s version and language; on Android this includes your device model.
  • To the European Central Bank: when a price comes back in another currency than your environment’s, the app downloads the ECB’s public file of daily exchange rates. It is the same file for everyone and the request says nothing about your positions. The ECB sees your IP address and the same technical details.

What never leaves your device

  • Quantities, values, the names you gave your positions, and your net worth
  • We receive nothing. These requests do not pass through our servers, and they are kept out of crash reports and analytics.

Where the price source is kept

  • Your choice of source and your key are stored on that device only: in the system keychain on iPhone, iPad and Mac, and encrypted with the Android Keystore on Android
  • They are not synced through iCloud, not written to the app’s backup file, and not part of Android’s cloud backup or device-to-device transfer. You set the source up again on each device.
  • Remove it at any time: Settings → Price source → None. On iPhone, iPad and Mac the system keychain can keep an entry after an app is deleted, so remove the source first if you want it gone.

A service you choose

The price source is a service you pick and have your own agreement with. It is not one of our processors, and what it does with your requests is governed by its own privacy policy: Alpha Vantage, EODHD, Twelve Data. The ECB’s is here.

Transactions From a Service You Subscribe To (Optional)

Some services read your bank for you, with your consent, and hand your transactions to apps you choose through the open SimpleFIN protocol: Lunch Flow in Europe, SimpleFIN Bridge in the United States and Canada. If you have an account at one, you can connect it in Settings → Connection to a service (on the Mac: Data in the sidebar). You sign in to your bank at the service, never in Stay Steady. Stay Steady has no such service of its own.

Nothing is fetched until you tap Connect, and then only when you tap Fetch now. The app never fetches in the background.

What leaves your device, and to whom

  • To the service: once, the token it gave you, which it exchanges for an access address; then, with each fetch, that address and the date from which you want transactions. The request goes straight from your device to the service. Like any website, the service also sees your IP address and the technical details a web request carries.

What comes back

  • Your accounts at the service (their names, numbers and balances) and their transactions. The transactions are stored like imported ones: on your device, and with iCloud sync on, in your private iCloud. The app also keeps, on that device, which account at the service goes into which account here and which transactions it has fetched before.

What never leaves your device

  • Your transactions, budgets and anything else in the app: the service only gives, it receives nothing of yours.
  • We receive nothing. These requests do not pass through our servers, and they are kept out of crash reports and analytics.

Where the access address is kept

  • On iPhone, iPad and Mac: in the system keychain, and with iCloud Keychain on, on your other Apple devices too, so that they are connected without a new token. Your answers about transactions that wait for you travel the same way. It is not written to the app’s backup file.
  • Remove connection takes it out of the keychain on every device it reached. The access itself ends at the service: switch it off there.
  • On Android: encrypted with the Android Keystore, on that phone only, and left out of Android’s backup and device transfer. Your answers about transactions that wait for you stay on the phone too. Remove connection deletes it from the phone.

A service you choose

The service belongs to another company. You have your own agreement with it, it asks its own price, and it is not one of our processors; what it does with your data is governed by its own privacy policy: Lunch Flow, SimpleFIN Bridge. How to set it up: Fetch your transactions through a service.

On-Device AI Chat (Optional, Android Only)

The Android version of Stay Steady includes an optional in-app chat (“Ask Stay Steady”) powered by a Gemma 4 language model that runs entirely on your phone. The model file (~3.6 GB) is hosted by Hugging Face, which asks you to sign in to a Hugging Face account of your own and to accept the Gemma licence before it lets the file be downloaded. You do that on Hugging Face’s own page, which the app opens in a browser tab. It is separate from the optional account with us, and nothing of your Google account is passed on by the app. Once the model is downloaded, no further contact with Hugging Face occurs.

What Hugging Face receives

  • Your sign-in to your Hugging Face account, on their page. What that account holds is between you and Hugging Face
  • That Stay Steady asked, with your consent on that page, to see your basic profile there and to download licence-gated models on your behalf. The app does not read or keep your profile. It keeps only the access token Hugging Face returns, encrypted on your phone, and uses it for the download
  • A standard HTTPS download request when the model file is fetched, which like any web request shows your IP address

What Hugging Face never receives

  • Your transactions, merchant names, amounts, account numbers, or any other financial data
  • Any prompt or question you ask the AI chat
  • Any answer the AI returns
  • Anything about how you use Stay Steady after the model is downloaded

How it works

  • The on-device AI chat is off by default and requires an explicit one-time setup in Settings → Ask Stay Steady
  • During setup, you’re shown a disclaimer describing the download size and that the model stays on your device
  • The model file is downloaded once over HTTPS and cached on your device — Hugging Face is not contacted afterwards
  • Every chat request runs locally on your phone using the LiteRT-LM runtime. No prompt, no answer, and no transaction context ever leaves the device
  • Hugging Face’s own handling of OAuth metadata is governed by their privacy policy

Your control

  • You can skip the AI chat entirely and use every other feature of Stay Steady — import, categorization, journal, goals, budgets, insights — without ever signing in to Hugging Face
  • The downloaded model can be removed at any time via Settings → Ask Stay Steady → Delete model
  • You can sign out of Hugging Face in the same place, which removes the token from your phone
  • No account is created on our servers for this — the sign-in is between you and Hugging Face, and we never see your Hugging Face account, your email address or the token

Permissions We Request

Camera Access (Optional)

Stay Steady can use the camera to scan receipts. On-device OCR extracts merchant, amount, and date from receipt photos. All processing happens on-device — no images are sent to servers.

Photo Library Access (Optional)

If you prefer, you can select receipt photos from your library instead of taking new photos.

Biometric / PIN App Lock (Optional)

Stay Steady offers optional biometric or PIN app lock. Your biometric data is never accessed by the app — authentication is handled securely by the operating system.

Notifications (Optional)

Stay Steady can send local notifications. On iPhone and iPad, if you turn them on: savings milestones (Milestone Notifications), and a weekly check-in, a monthly review and a payday nudge (Coaching Rituals). On Android: the same weekly check-in, monthly review and payday nudge if you turn on Coaching rituals, and a progress notification while the optional AI chat model downloads; Android sends no savings-milestone notifications. The Mac app sends none. Budget alerts appear inside the app, never as notifications. All notifications are created on your device, never sent from a server. A savings milestone can name one of your goals or a round amount you have saved, such as €1,000; whether that text shows on the lock screen follows your device’s notification preview settings.

Network Access (Optional)

Network access is used for:

  • Account sign-in (only when you choose to sign in)
  • iCloud sync (iPhone, iPad and Mac, if enabled)
  • Category corrections (only while signed in)
  • Anonymous usage analytics (if enabled)
  • Crash reporting (if enabled)
  • AI chat model download (Android only, optional)
  • Prices of your positions (only when you tap Test or Refresh prices, with a price source you set up)
  • Transactions from a service you subscribe to (only when you tap Connect or Fetch now)

The app’s core functionality (manual entry, file import, on-device categorization, budgets, goals) works fully offline.

How Your Data Flows

[Bank statement / receipt / manual entry]
                    ↓
            [Local Storage]      ←─ Optional (Apple devices) ─→ [Your Private iCloud]
                    ↓
        [On-device ML categorization]

[Sign in with Apple / Google Sign-In] → [Supabase Auth (EU)]

[Optional: anonymous events]      → [Aptabase EU]
[Optional: crash reports]         → [Sentry EU]
[Optional: ML category feedback]  → [Supabase EU]
[Optional (Android): AI chat]     → [Hugging Face OAuth + one-time model download]
                                    then runs entirely on-device
[Optional: failed-import report]  → [Your mail app] → [Our support mailbox, Hostinger EU]
                                    you send it; never the original file
[Optional: Refresh prices]        → [The price source you set up] and [ECB exchange rates]
                                    symbols only, straight from your device; nothing to us
[Optional (Apple devices): Fetch now] → [The service you subscribe to]
                                    your transactions come back to your device; nothing to us

Data Security

On-Device Protection

  • Database encrypted by the operating system (iOS Data Protection / Android file-based encryption)
  • Data encrypted whenever your device is locked
  • Optional biometric/PIN lock for app access
  • PIN stored as SHA-256 hash in the platform keychain / keystore

iCloud Security (Apple devices only)

  • Uses Apple’s private CloudKit database
  • End-to-end encrypted in transit
  • Only accessible with your Apple ID

Network Security

  • All requests use HTTPS (TLS 1.2+)
  • No personal identifiers transmitted with anonymous data

Data Retention and Deletion

Your Control

  • Delete individual transactions anytime
  • Delete all data in Settings
  • Data is permanently deleted when you delete it
  • Uninstalling the app removes all local data

iCloud Data (Apple devices only)

  • Managed through Apple’s iCloud settings
  • Disabling iCloud sync in app does not delete iCloud data
  • Delete iCloud data via Settings > Apple ID > iCloud > Manage Storage

Error Reports You Email Us

An error report you send after a failed import, and its masked attachment if you chose to add one, is deleted within 30 days after the fix ships. Email apps@dataconsultingservices.net to have it deleted sooner.

Account Deletion

If you created an account, you can delete it directly from inside the app (Settings → Account → Delete account). Server-side data — auth record and any ML feedback contributions — is removed within minutes. For an alternative path or questions, see the dedicated Account Deletion page or email apps@dataconsultingservices.net. We action requests within 30 days as required under GDPR.

Children’s Privacy

Stay Steady does not knowingly collect any information from children under 13. The app does not require any personal information to function.

Third-Party Services

Stay Steady relies on a small set of carefully chosen processors. All are bound by Data Processing Agreements; none receive your raw transaction data unless explicitly listed here.

ProcessorPurposeRegionData sharedPrivacy Policy
Apple iCloud (Apple devices only, optional)Private CloudKit sync of your dataApple regionsYour transactions, goals, budgets — only if you enable syncapple.com/legal/privacy
SupabaseAuthentication, edge function for ML feedback submissionEU (Frankfurt)Platform user identifier, optional email, the name and picture of a Google account, ML correction events (if you opt in)supabase.com/privacy
Hugging Face (Android only, optional)Distribution of the open-source Gemma 4 chat model when you enable in-app AI chatEU/USYour sign-in to your own Hugging Face account, on their page, and the download request for the model file. Nothing from your Google account and nothing about your finances — see the “On-Device AI Chat” section above for the full flow.huggingface.co/privacy
Sentry (if crash reporting is enabled)Crash reports and performance tracesEUStack traces, app/OS and device metadata, an installation or account identifier, an approximate city, masked session replays of error sessionssentry.io/privacy
Aptabase (if analytics is enabled)Anonymous usage analyticsEUAnonymous events, app/OS metadataaptabase.com/legal/privacy
Hostinger (only if you email us an error report)Hosting of the support mailbox apps@dataconsultingservices.netEU (France)The error report you choose to send after a failed import, optionally with a masked copy of the file — never the original. Deleted within 30 days after the fix ships.hostinger.com/legal/privacy-policy

These services are contacted by your device directly, only when you tap Test or Refresh prices, or Connect or Fetch now, and are not processors of ours. No data passes through us on its way to them, so we have no agreement with them about it.

ServicePurposeRegionWhat it receivesPrivacy Policy
The price source you set up (optional: Alpha Vantage, EODHD, Twelve Data, or an address of your own)The prices of your positionsDepends on the sourceThe symbols of your positions, your key for that source, your IP address and the technical details of a web request. Never quantities or values.The source’s own, linked under “Prices of Your Positions”
European Central Bank (only when a fetched price is in another currency)Public daily exchange ratesEUA download of a public file. Your IP address and the technical details of a web request; nothing about your positions.ecb.europa.eu
The service you subscribe to (optional: Lunch Flow, SimpleFIN Bridge or another SimpleFIN service)Your transactions, fetched when you tap Fetch nowDepends on the serviceIts token once, then the access address and a start date, your IP address and the technical details of a web request. Nothing of yours from the app.The service’s own, linked under “Transactions From a Service You Subscribe To”

We do not use Google Analytics, Firebase Analytics, Meta SDK, advertising networks, payment processors, bank-sync providers, or any tracking SDK that builds a cross-app or cross-site profile of you.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

  • Updating the “Last Updated” date at the top
  • Posting the new policy on this page

For material changes (new processors, expanded data collection), we will also surface an in-app notice on next launch.

Your Rights

Under GDPR (EU/EEA residents) and similar laws, you have the right to:

  • Access: All your in-app data is accessible within the app. For account or ML feedback data held server-side, email us.
  • Deletion: Delete all in-app data directly within the app. For account/server deletion, use the in-app Delete account action.
  • Portability: Export your data as CSV or PDF anytime from within the app.
  • Rectification: Edit any transaction or goal in the app.
  • Objection: Disable iCloud sync, analytics, crash reporting, and ML feedback at any time.
  • Lodge a complaint: With your local data protection authority. In Belgium, this is the Gegevensbeschermingsautoriteit / Autorité de protection des données.

Contact Us

If you have questions about this Privacy Policy or Stay Steady:

Email: apps@dataconsultingservices.net

Website: https://dataconsultingservices.net/apps/staysteady/

Summary

QuestionAnswer
Do you collect my personal data?Only what this page describes: an optional sign-in, analytics if you opt in, and crash reports unless you turn them off. No tracking SDKs.
Where is my financial data stored?On your device. Optionally in your private iCloud (iPhone, iPad and Mac). Never on our servers. An error report you email us after a failed import sits in our support mailbox until the fix ships — never with your original file.
Is my data encrypted?Yes — OS-level encryption on device, TLS 1.2+ in transit, EU-hosted processors.
Do you sell my data?No. We do not have it to sell.
Can I delete my data?Yes, anytime in the app. Account/server data: in-app Delete account.
Do you use analytics?Only if you opt in (Aptabase, anonymous, EU).
Do you show ads?No.
Do you connect to my bank?No, and the app never asks for your bank login. It can fetch your transactions from a service you subscribe to yourself, when you tap Fetch now. Nothing passes through us.
Does the app look up prices online?Only when you tap Refresh prices, at a price source you set up yourself. It gets the symbols of your positions, never quantities or values. We get nothing.
Do you sell a Pro subscription?No — Stay Steady is free.

Stay Steady. Stay in control. Your money, your data, your privacy.