StedySecurity
How Stedy handles your data
Stedy holds things about your home: what you eat, what you spend and who does what. Here is how it is protected, who processes it and how to report a problem.
Hosted in the EU
The API and the database run in the EU on Railway, and product analytics use PostHog's EU cloud. The services outside the EU that we rely on for sign-in, email, bot protection and site analytics are listed below.
HTTPS only
Every connection uses HTTPS. stedy.app sends a strict HSTS header, so browsers never fall back to plain HTTP.
No passwords to leak
You sign in with Google, so Stedy never stores a password. API keys for your AI tools are stored only as hashes and can be revoked in Settings.
Your data, your call
Download all your data as JSON from Settings at any time. If you delete your account, it is removed for good after 30 days.
Who processes your data
Every service that handles your data, what it does for Stedy, what it sees and where it runs. Each name links to the provider's data processing terms.
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Sign-in with Google | Name, email address, profile picture | Global (SCCs) | |
| Railway | Hosting for the API and the PostgreSQL database | Everything you store in Stedy | EU |
| Vercel | Hosting for this site and the web apps | IP address, request logs | Global edge network |
| PostHog | Product analytics and error tracking | Usage events; session replay only after you accept cookies in the app | EU |
| Google Analytics | Analytics for stedy.app, loaded only after you accept cookies | Cookie identifiers, pages visited, device and browser, IP address | Global (SCCs) |
| Cloudflare Turnstile | Bot protection on the contact and roadmap forms | IP address, browser and device signals | Global (SCCs) |
| Resend | Email: replies to the contact form, roadmap updates and household invites | Email address, message content | Global (SCCs) |
This is the complete list, and it changes whenever a provider is added or removed. The privacy policy covers the legal basis and how long data is kept.
Report a vulnerability
Found a security problem? Email security@stedy.app. The details are in our security.txt (RFC 9116).
- A first reply within 72 hours
- Safe harbour for good-faith research
- Credit if you want it
If something goes wrong
If a breach puts your personal data at risk, I report it to the supervisory authority within 72 hours of finding out, as GDPR Article 33 requires, and email the people affected.
- A direct email to affected accounts
- A public write-up when it helps
- The hole is closed before details are published, where possible