Privacy Policy

Effective date: June 1, 2026  ·  Last updated: June 1, 2026

1. Who We Are

Steadwell (“we,” “our,” or “us”) operates the home management platform available at steadwell.app. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our Service. If you have questions, contact us at privacy@steadwell.app.

2. Information We Collect

Information you provide directly:

• Account information: email address and password (passwords are hashed and never stored in plain text)
• Home information: property address; home details you enter or confirm, such as year built, square footage, bedrooms, bathrooms
• Maintenance records: task names, descriptions, due dates, completion dates, costs, vendor names, and service notes
• Financial data: home expense amounts, categories, dates, and vendor information; utility bill amounts and usage figures; insurance policy details including carrier, policy number, premiums, and coverage amounts
• Warranty and asset records: appliance names, model numbers, purchase dates, warranty expiry dates, and related notes
• Uploaded files: documents, photos, and PDFs you choose to store in Steadwell (for example, deeds, permits, inspection reports, receipts, or insurance documents)
• Communications: messages you send us for support or feedback

Information retrieved from third-party sources:

• Property data from Zillow (via APIllow): When you enter your home address, we retrieve publicly available records including estimated home value, tax assessment history, sale history, lot size, school information, and neighborhood data. This retrieval is performed on your behalf to pre-populate your home profile.
• Address autocomplete from Geoapify: When you type your address, we query Geoapify to suggest and validate address formats.

Information collected automatically:

• Log data including your IP address, browser type, pages visited within Steadwell, and access timestamps
• Device information such as operating system and screen resolution
• Authentication tokens necessary to maintain your session

We do not use advertising cookies, cross-site tracking, or analytics platforms that share your data with third parties.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Steadwell Service
• Populate your home profile with publicly available property data
• Send maintenance reminders and service notifications (Pro plan)
• Process subscription payments and manage your account
• Respond to support requests and communications
• Detect and prevent fraud, abuse, or security incidents
• Comply with legal obligations

We do not use your data to serve you advertisements, and we do not sell, rent, or license your personal information to third parties for marketing purposes.

4. How We Share Your Information

Service providers (data processors):

• Supabase, Inc. — our cloud database, authentication, and file storage provider. Your data is stored on Supabase's infrastructure, which is SOC 2 Type II certified and uses row-level security to ensure one user cannot access another user's data.
• APIllow / Zillow Group — used to retrieve publicly available property data when you enter your home address. We send your address to this service on your behalf; it is not stored by them under your account.
• Geoapify — used for address autocomplete when entering a property address.
• Stripe, Inc. — payment processing for Pro subscriptions. Stripe handles all payment card data; Steadwell does not store card numbers.

Legal requirements: We may disclose information if required to do so by law, court order, or a valid governmental request, or to protect the rights, property, or safety of Steadwell or others.

Business transfers: If Steadwell is acquired or merged with another company, your information may be transferred as part of that transaction. We will notify you via email or in-app notice before your data becomes subject to a different privacy policy.

We do not share your personal information with any other third parties.

5. Data Retention

• Active accounts: Your data is retained for as long as your account is active.
• Deleted accounts: When you delete your account, we begin the deletion process within 30 days. This grace period allows you to recover your account if deletion was accidental. After 30 days, your personal data and uploaded files are permanently deleted from our systems.
• Backups: Encrypted database backups may retain data for up to 90 days following deletion before being purged.
• Legal holds: We may retain certain information for longer periods if required by law or to resolve disputes.

6. Data Security

We take the security of your data seriously and implement the following measures:

• Row-level security (RLS): Database policies ensure each user can only access their own records, enforced at the database level.
• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Data stored on Supabase's infrastructure is encrypted at rest.
• Password hashing: Passwords are never stored in plain text. Authentication is handled by Supabase's secure auth system.

No method of transmission or storage is 100% secure. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

7. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: You can view all data associated with your account directly within the Steadwell app.
• Correction: You can update or correct your information at any time from your account settings.
• Deletion: You can permanently delete your account and all associated data from Settings › Account › Delete Account. See Section 5 for retention timelines.
• Portability: You can export your data in a portable format from your account settings.
• Opt out of communications: You can unsubscribe from non-essential emails at any time using the link in any email we send.

To exercise any of these rights or for privacy-related requests, contact us at privacy@steadwell.app. We will respond within 45 days.

8. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request a disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: Steadwell does not sell or share your personal information for cross-context behavioral advertising. This right is not applicable to our current practices.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, email privacy@steadwell.app with the subject line “California Privacy Request.”

9. Children's Privacy

Steadwell is intended for use by adults 18 years of age or older. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected personal information from a child under 13, we will promptly delete it. If you believe we have collected information from a child under 13, please contact us at privacy@steadwell.app.

10. Third-Party Links

The Service may contain links to third-party websites or resources. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or in-app notice at least 30 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision. Your continued use of the Service after the effective date of a revised policy constitutes acceptance of the updated terms.