Steady Privacy Policy
Effective October 26, 2026
Who we are and scope
Illa Rosa Mundi LLC operates Steady, an iOS app for adults aged 18 and older to organize personal medication, wellness, and progress records. This policy describes information processed by the Steady app and its supporting services. It does not describe unrelated tracking, cookies, or analytics a separate website operator may add to a website hosting this policy.
Illa Rosa Mundi LLC, 8 THE GREEN STE B, DOVER, DE 19901, United States. Email: grand@illarosamundi.com.
Information we collect
Steady does not offer insurance-document uploads or progress-photo uploads and does not access HealthKit, contacts, precise location, or your photo library to collect health information. Retired progress-photo records and active files are subject to permanent removal; historical policy archives do not describe current features.
• Account information: your email address, authentication identifiers, and any name you choose to enter. Clerk processes email/password sign-in, verification, password recovery, sessions, and authentication security information. Steady does not receive your plaintext password.
• Health and wellness records you choose to enter: medication and pharmacy-label text, prescribed schedules, dose logs, symptoms, nutrition entries and targets, strength sessions, hunger and food-noise check-ins, weight and body measurements, refill records, safety selections, and related notes.
• Consent and sync information: consent version and acceptance or withdrawal times, account identifiers, record update versions, and limited information needed to synchronize devices, prevent deleted data from being restored, and resolve conflicting edits.
• Reports you create: selected record sections and date ranges, expiring share-link identifiers, expiration and revocation information.
• Technical and support information: IP addresses, request and security logs, device or browser details associated with service requests, errors, and information you voluntarily send when contacting us.
• Advertising technical information: when enabled, Google AdMob and its consent SDK process the technical and ad-interaction information described in the advertising section. Steady does not supply health entries or account email for advertising.
How we use information
With your health-data consent, we use the records you enter to display and store your information, sync your signed-in devices, show trends, prepare exports and reports you request, and schedule local reminders you enable. We also process account and technical information to authenticate users, provide support, maintain security, prevent abuse, and meet legal obligations.
Steady does not diagnose conditions, recommend treatment, or calculate, convert, recommend, or change medication doses. It is not an emergency service or a healthcare provider and does not represent that it is a HIPAA-covered service.
Free access and non-personalized AdMob advertising
All Steady features are free, with no paid tier, access trial, or in-app purchase flow. In iOS builds configured for advertising, Steady uses Google AdMob (Google Mobile Ads SDK) to display non-personalized banner ads. Development and test builds use Google test ad units by default. Ads may be unavailable because of build configuration, consent choices, network conditions, or inventory. App features never depend on accepting or viewing ads.
Non-personalized does not mean no data is processed. Google may receive your IP address (and estimate general location), app and device information, app- or device-scoped identifiers permitted by your device/privacy settings, crash and performance diagnostics, advertisements displayed, and ad interactions. This information is used for ad delivery, measurement, fraud prevention, frequency controls, diagnostics, and related advertising operations under Google’s policies. Google learns that an ad request came from Steady, but Steady does not attach health entries, report content, account identifiers, names, email addresses, precise location, health-related keywords, or custom audiences to ad requests.
Steady requests non-personalized ads only, disables publisher first-party ID and publisher personalization, and does not request Apple tracking permission or access to the advertising identifier (IDFA). We do not sell health records, disclose them to advertisers, or use medication, symptoms, weight, nutrition, or other health entries for ad targeting. We do not send health entries to AI services or use geofencing to infer healthcare visits.
Google’s User Messaging Platform checks consent requirements before the Mobile Ads SDK is initialized or an ad is loaded. Where required and configured for the app, it presents regional privacy messages and records your choices. Non-personalized ads can still use local storage and require consent in some regions. If consent information cannot be refreshed, or the SDK does not permit an ad request, Steady skips ads without locking any feature.
You can turn off ads on this device in Settings → Advertising privacy. This stops new ad loading from Steady and does not delete information already received by Google. The same section reopens Google’s privacy-options form where it is required. This preference is device-local and separate from health-data consent; it may need to be set again after reinstalling or on another device. Google manages the storage and retention of its consent and advertising information under its own policies, including applicable legal, security, and fraud-prevention requirements. Contact Google for rights relating to data it controls; contact us for Steady records and support.
See https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites for Google’s data practices, and https://adssettings.google.com/ for additional Google advertising controls. Disabling ads in Steady does not change settings in unrelated apps or services.
If you subscribed using an older version, removing subscriptions from this app does not itself cancel an existing Apple subscription or issue a refund. Manage existing subscriptions and refund requests through Apple. Apple and RevenueCat may retain historical transaction information under their own policies and legal obligations; no purchase is required for access to this version.
Storage, service providers, and sharing
Steady keeps a local copy on your device and syncs records to your account on the Steady server while you are signed in, connected, and have current health-data consent. Other devices retrieve changes when the app loads or returns to the foreground. Offline changes may remain on a device until a successful sync. Device backups may include local records; anyone with access to your unlocked device and app may be able to view them.
Clerk provides customer authentication. Replit provides app hosting, database, and supporting storage infrastructure. These providers process information needed to deliver and secure their services. We may disclose information when legally required, to protect rights and safety, or in connection with a business transfer subject to applicable privacy obligations. We do not send health records to Apple or RevenueCat for billing.
You choose whether to export records or create a report link. Anyone with an active report link can view the selected information without signing in. Links expire after seven days by default and can be revoked sooner. We cannot retrieve copies already downloaded, photographed, printed, or otherwise retained by recipients.
Our service providers may process information in the United States and other countries where they operate. Protections may differ from those in your location; applicable transfer requirements still apply.
Reminders and device permissions
Notifications are optional and require iOS permission. Reminder text avoids your medication name and dose. Local reminders are scheduled on the device; delivery is affected by device settings and is not guaranteed. You can change reminders in Plan and notification permission in iOS Settings. Reminders are not a substitute for your prescriber’s instructions.
Retention, withdrawal, and deletion
Records remain in your active account until you delete them, successfully withdraw health-data consent, or delete your account, subject to necessary security and legal retention. Free access does not expire.
You can export supported records, revoke report links, delete records, withdraw health-data consent, or delete your account in the app. Withdrawal stops syncing immediately. When deletion succeeds, synced health records and report links are deleted and this device attempts to clear its copy. If deletion cannot complete, records may remain until you retry; syncing stays off.
After consent withdrawal, a limited sync-control record retains the account identifier, consent version, and acceptance/withdrawal times until you accept consent again or delete the account. Account deletion removes active records and the Clerk sign-in identity and sessions. A content-free deletion sync marker remains for 30 days to prevent stale devices from silently restoring deleted records.
Other devices learn of deletion when they reconnect. Reconnect them within the 30-day marker window. Steady cannot remotely erase offline device copies, external exports, or information already retained by a report recipient.
Provider-managed backups, recovery history, security logs, and any historical transaction records follow provider retention schedules and legal obligations. Replit documents 30-day application-log retention and database recovery history of up to 28 days, depending on the configured window. Steady keeps no separate archive of deleted health records or uploads and does not promise immediate erasure of every infrastructure backup.
Your privacy rights
Depending on your location, you may have rights to access, copy, correct, delete, or restrict processing of your information; withdraw consent; object to processing; request information about recipients; or appeal a privacy decision. Email grand@illarosamundi.com to make a request or appeal. We may verify your identity and will respond within applicable legal deadlines.
We do not unlawfully discriminate against people exercising privacy rights. Withdrawing consent for information necessary to a feature can prevent that feature from working. You may also complain to the relevant state attorney general, consumer-protection authority, or data-protection regulator.
Security and children
We use HTTPS, account-scoped authorization, authenticated access, and abuse controls to protect information. No electronic service can guarantee absolute security. Protect your account and device and avoid unintentionally sharing active report links. Contact us if you suspect unauthorized access; legally required security notices will be provided.
Steady is intended only for adults aged 18 and older. We do not knowingly collect children’s information. Contact us if you believe a child has provided information so we can investigate and remove it.
Policy changes and contact
We will publish policy changes with an effective date and provide appropriate notice of material changes. We will obtain renewed consent where required before applying materially different health-data practices. Historical consent wording and linked policy revisions remain available in the app where verified archives exist.
Illa Rosa Mundi LLC, 8 THE GREEN STE B, DOVER, DE 19901, United States. Email: grand@illarosamundi.com.