Your plan.
Your choice to share.
This page describes the data handling implemented in the current version of Steady. It is not a claim of a certification or an independent security audit.
Public pages and sample numbers
The landing page is public. Its example numbers are illustrative. The sample planner runs separately from your saved account plan and does not replace it. Sample edits may be kept in this browser tab’s session storage.
Your signed-in plan
Steady uses ChatGPT sign-in. The service receives a site-specific user identifier and email for account access and display. It does not collect a separate Steady password. You may manually enter income, bills, spending, savings goals, household information, and investment holdings.
Saved financial plans are stored server-side. Every financial-data request checks sign-in and household membership. Household owners can invite viewers or editors, and can remove their future access. All members of a household can see its entire shared plan. An invitation does not make someone a site editor.
Account administration
Steady stores your account email, site-specific identifier, first observed activity, last API activity, and suspension status. The owner admin dashboard shows account records and aggregate usage counts, and can suspend or restore future account access. Administrative actions keep the administrator identifier, target account, reason, and time. The dashboard does not display household financial plan details. Deleting household financial records does not remove these account and administrative records.
Client AI help
When you accept the chat notice and send a message, Steady sends that message, recent chat from the current tab, the current screen name, and your household role to OpenAI to generate guidance. Saved financial plans, account identifiers, and other users’ records are not included automatically. Do not type sensitive financial information, passwords, or account numbers. Steady does not save chat transcripts server-side; recent conversation stays in page memory and is cleared when you switch households or reload. Requests use the provider’s store:false setting; provider handling and retention are governed by its applicable policies. Daily usage counters are retained for 30 days to limit cost and abuse. The bot can suggest navigation and support; it cannot change saved financial records, run owner actions, or submit support requests for you.
Owner assistant and approvals
The owner can use connected ChatGPT tools to read operational diagnostics and prepare supported action proposals. Proposals store the owner identifier, action, reason, approval status, expiration, and result. Approval requires a separate action in Owner Admin, expires after 15 minutes, and can be used only once. Diagnostic tools exclude customer financial plan contents. Embedded AI chat is not connected in this release.
Security monitoring
Steady groups suspicious path requests, denied admin or household access, excessive authenticated request volume, and caught API errors into security incidents. Records include rule, account identifier when available, target route, timestamps, count, outcome, investigation status, and owner notes. Anonymous probes are aggregated. The War Room does not receive verified IP addresses, geographic locations, device malware information, or ChatGPT login failure records. Security incidents and audited responses are retained until an operator applies a retention policy; raw operational events expire after 30 days. Automated monitors do not establish that a breach occurred.
Support and operational events
Support requests store your account identifier, subject, message, reply, status, and timestamps. The owner can read and respond to these requests. Do not include sensitive financial details. Denied administrator and household requests and caught API errors record an account identifier, route, event type, and time, retained for 30 days. These logs do not record request bodies or financial plan contents. Account observations are used for aggregate growth reports.
Full database snapshots
Owner-authorized database backups include account records, household plans and history, invitations, support requests, settings, and audit records. Snapshots are stored in a separate private object store and retained for 30 days. Deleted records may remain in retained backups until those copies expire. Scheduled owner tools return health and backup metadata, not customer financial contents.
Browser drafts and backups
Unsynced edits can be stored on your device so a failed save does not immediately lose them. Earlier versions of the planner may also have stored a plan in that browser. These browser records are not separately encrypted by Steady. Use care on shared devices.
The account service keeps up to 20 recent saved versions for recovery. You can export a JSON backup. Exported files, downloaded calendars, and copies other members already obtained are outside Steady’s control.
Deletion and household access
A household owner can use Account → Delete household financial records to remove the saved plan, retained plan versions, and unused invitations. Household account and membership records remain. You can also clear a device recovery draft. Clearing browser data does not delete the account plan.
Removing a member blocks future requests for that household. It cannot retract information the member already saw or exported.
External services and reminders
This version does not connect to banks, execute stock trades, or move money. Resource links open external providers’ websites, where those providers’ own practices apply. Calendar exports contain generic payday and bill reminders rather than bill amounts or provider names. Importing a calendar shares that file with the calendar service you choose.
No advertising tracker or marketing analytics has been added to this landing page. ChatGPT sign-in and the hosting platform have their own service operations and policies.
Enter only what you need
Do not enter bank passwords, full card numbers, Social Security numbers, or other government identifiers. Budget estimates are only as complete and accurate as the information you provide.