Privacy information
Review draft about current behavior
Last updated October 26, 2026. This page describes what the SteadySteps app and website actually do in the current code, with the directory intake described below and other optional pilots switched off. It is not legal approval, and external privacy and legal verification remains required before the app is released to the public.
Practice directory and introduction requests
The directory is for adults. Parent requests collect an adult first name, email, optional phone, contact preference, and service city/state. Practice applications also collect business identity, representative role, location, service setting, supervisor identity and credential details. Do not submit child names, diagnoses, clinical records, school records, or insurance member IDs. A request for ABA services can itself reveal sensitive information; the directory keeps these requests separate from mobile accounts and private parent tools.
SteadySteps staff can access requests for review and follow-up. Neon hosts the website PostgreSQL database in the United States; adult intake payloads are encrypted by the application. Resend processes recipients, email contents, private confirmation/status links, and delivery metadata. Our email outbox is encrypted and clears its message body after provider acceptance. Email-provider retention and database backups have their own retention; clearing the live record does not instantly clear those copies.
A general help request stays with SteadySteps. A named-practice request authorizes only that practice to receive the adult contact fields shown on the form, after email confirmation and staff review. No child records are sent. Requests do not subscribe you to marketing. Billing is off: SteadySteps charges neither parents nor practices for these introductions. Public links to ClueStep and Drawesome do not transfer family or request data.
Confirmation links expire after 48 hours. Unconfirmed contact data is eligible for cleanup after 48 hours; confirmed submissions after 90 days. The private status link allows cancellation before sending begins and clears the live contact payload. An email already being sent cannot be recalled. Cleanup runs through the staff maintenance workflow; overdue cleanup may remain until that workflow runs. Content-free audit and abuse-prevention records remain separately; rate-limit records are eligible for removal after two days. Contact support for access, correction, deletion, or a report about a practice.
The short version
- SteadySteps is a two-device family app. A parent uses an iPhone; a child uses an iPad that the parent pairs to the family account.
- A kid account is created only by a signed-in parent, through a pairing code the parent generates. A child cannot sign up, cannot enter an email or password, and cannot create an account alone. This parent-first pairing is how SteadySteps obtains verifiable parental consent before any child data exists.
- We do not sell family data, we do not show ads, and child data is never used to train AI.
- Most family data is kept until the parent deletes it. The retention table below says exactly what is kept and for how long.
What we collect, for parents and for kids
About the parent
- An email address and sign-in identity (email and password, Sign in with Apple, or Google Sign-In), plus the verified identity ID and sign-in times that the authentication service records.
- A parent PIN verifier used to confirm that an adult, not the child, is changing settings on a shared device.
- The parent phone's push-notification registration so a My Voice message can reach it.
- Content-free security records such as rate limits and one-time receipts that protect the account from abuse.
About the child
- A nickname or first name chosen by the parent, a visual theme, the My Voice choices the parent turned on, and spoken-label and review-before-send preferences.
- My Voice messages and help requests the child sends (for example “Help me”), the time they were sent, and the response the caregiver chose.
- If the parent turns on the optional token board: routines, which steps were marked done, tokens placed, finished boards, and the reward photo the parent took. Tokens start off for every new child.
- The kid iPad's push-notification registration, so a caregiver response can appear on the child's device.
We do not ask for a child's birth date, diagnosis, medical records, school records, photos of the child, or location. The website does not ask for or display exact birth date or gender. Older database columns named birthDate, gender, and diagnosisNote still exist in the website schema; they are marked deprecated, are not collected or shown, and a reviewed removal is still pending.
How a kid account is created
The parent signs in on their own phone, adds a child profile, and asks for a pairing code. The code lasts five minutes. Entering it on the iPad creates a child sign-in that is tied to exactly that parent and that child profile. The child sign-in can only write its own My Voice messages, help requests, and completion attempts; it cannot read other families, change settings, or reach any paid feature. If the parent deletes the child profile, the child sign-in stops working.
Who receives data
The family mobile apps use the services below. The separate website directory uses Hostinger, Neon, and Resend as described in the directory section.
- Google Firebase and Google Cloud — authentication, the family database (Firestore), Cloud Functions that run pairing and token-board logic, Cloud Storage for the reward photo, Cloud Messaging for push, and Crashlytics for crash reports. Google is the processor that holds the family record.
- Apple — Sign in with Apple when a parent chooses it, and the Apple Push Notification service that delivers push to iPhones and iPads.
- Google Sign-In — only when a parent chooses to sign in with a Google account.
- Hostinger — serves the website and processes directory submissions. Staff sign-in uses session cookies. Public pages load no analytics or advertising scripts. The host keeps ordinary server logs.
No artificial-intelligence vendor receives family data. The app's AI media features are switched off in the shipped code on both the device and the server, so no prompt, photo, message, or child record is sent to an AI provider. Child data is never used to train AI, and any future AI feature would need its own reviewed policy and a separate parent choice before it could be turned on.
Code also exists for features that are switched off and receive no data today: payments (Stripe), family video calling, sticker search, educational video playback, an adult email program, a parent community, provider messaging and booking, and website parent accounts stored in Postgres. Listing a capability or vendor does not mean it is enabled, approved, or receiving production data. This is a source inventory, not a verified production subprocessor list; the final vendor contracts and regions still need confirmation.
How long we keep it
Where the code has no automatic expiry, the table says “until the parent deletes it” rather than inventing a period. No “keep forever” default has been approved; periods will be shortened as deletion tooling ships.
| Data | About | Current behavior |
|---|---|---|
| Parent account (email, sign-in provider, verified identity ID) | Parent | Kept until the parent requests account deletion. Deletion is a request path today, not a self-service button. |
| Parent PIN verifier | Parent | Kept with the parent account until the parent deletes it. |
| Pairing code used to connect a kid's iPad | Parent and child | Expires five minutes after it is created and cannot be reused once claimed. |
| Kid profile (nickname, visual theme, My Voice choices, speech and review preferences) | Child | Kept until the parent deletes the child profile. |
| My Voice messages and help requests, with the caregiver's response | Child and parent | Kept until the parent deletes them. There is no automatic expiry today. |
| Token board, routines, completion records, board history, reward photo | Child and parent | Kept until the parent deletes them. Finished boards are kept on purpose so the family can look back at them. |
| Push-notification delivery records (content-free) | Parent | Marked to expire 14 days after creation. Automatic cleanup of expired records is not yet confirmed in production. |
| Device registration for push (device ID, platform, app version, push token) | Parent and child device | Only registrations updated within the last 30 days receive push. The record itself is kept until the parent deletes it or signs out of that device. |
| Crash reports (platform, app version, crash details) | Device | Held by Google Firebase Crashlytics under Google's standard retention. SteadySteps has not configured a custom period. |
| Website visits to public pages | Visitor | SteadySteps runs no analytics on public pages. Staff sign-in uses session cookies. The hosting provider keeps ordinary server logs under its own retention. |
| Support and privacy-request email | Parent | Kept in the support mailbox until the request is closed and the message is deleted. |
Why information is used
- To sign in a parent, pair the child's device to the right family, and protect the account from abuse.
- To deliver a child's My Voice message to the parent's phone and show the caregiver's response on the child's device.
- To show the token board the parent set up, record which steps were done, and keep finished boards for the family.
- To fix crashes and keep the service reliable using the minimum practical operational evidence.
Uses SteadySteps prohibits
Current product policy prohibits selling family data or using child data for advertising. The current source has no third-party advertising integration. Child messages, Help or My Voice events, distress, refusal, silence, diagnosis, behavior or ABC records, progress, media, and household conflict must not be used for ads, provider lead scoring, sales email, service marketing, or individualized pricing. Repository evidence cannot by itself prove every production or organizational practice; external privacy and legal verification remains required.
We also prohibit using child completion records to rank siblings or caregivers, using any record for automated diagnosis or psychiatric inference, using household access history to compare caregivers, and using family content for AI training or product analytics. If an email program is ever enabled, email choices must not be inferred from child messages, diagnosis, distress, refusal, activity, behavior records, media, or household conflict.
Who can see information inside SteadySteps
- The signed-in parent sees the family record. The paired child device sees only that child's My Voice choices, board, and the caregiver's responses.
- SteadySteps staff may need limited access to a specific family record to answer a support request or investigate a safety or security problem. Purpose-bound, time-limited access and a complete audit procedure are still open work.
- No provider, coach, community member, or other family can see a family's record. The current model links one parent account to a child and does not provide a two-household permission model.
Your choices
- Use a nickname for the child instead of a full name.
- Choose My Voice options and accessibility preferences with the child. Leave the token board off if the family does not want it.
- Turn push notifications, camera, and photo access on or off in iOS Settings. A reward photo is optional.
- Delete a child profile, a routine, or a reward photo in the app where a delete control is shown.
How a parent asks for export or deletion
Email support@steadysteps.app from the parent account's email address, or use the deletion-request control in the app's parent settings. Say whether you want a copy of the family's data, deletion of one child profile, or deletion of the whole account. Do not include a child's diagnosis, photo, video, audio, My Voice or Help message, routine, schedule, behavior, custody, location, or event details, and do not send passwords, sign-in codes, authentication tokens, payment details, or meeting links.
Being honest about where this stands: an email or the in-app control starts a request only. SteadySteps does not yet have a complete self-service export or a proven end-to-end deletion process across Firebase Authentication, Firestore, Storage, device state, backups, logs, and processors. This repository does not prove staffed mailbox coverage, identity-verification operations, or a response-time commitment; no response or completion time is promised. See the support page for the request paths.
Laws that may apply
FTC Health Breach Notification Rule. SteadySteps is not a HIPAA covered entity; if the app is treated as a vendor of personal health records because families store health-related information in it, the FTC rule would require us to notify affected parents, the FTC, and in some cases the media after a breach of that unsecured information.
Washington My Health My Data Act. For Washington residents, information in SteadySteps that reveals a child's health or disability status may be “consumer health data,” which requires consent before it is collected or shared for anything beyond providing the service the parent asked for, and gives the parent a right to have it deleted.
Children's privacy. SteadySteps is designed for parent-managed use with a child under 13 on the paired device, so the Children's Online Privacy Protection Act (COPPA) is relevant. This review draft does not claim compliance with HIPAA, COPPA, FERPA, state privacy law, custody law, or professional-records requirements; those conclusions depend on the final operating model, contracts, safeguards, and external legal review.
Children, sensitive details, and professional care
Avoid entering medical, diagnosis, trauma, custody, medication, or crisis details in any free-text field. SteadySteps is not emergency care, medical advice, diagnosis, or a replacement for AAC or professional support.
Contact
To initiate a privacy, access, correction, deletion, export, or support request, you may draft an email to support@steadysteps.app. Email is not emergency or clinical crisis support.