Privacy Policy

What we collect, why, where it is kept, and how you can delete it.

Last updated: October 14, 2026 · EvolvLabs, LLC · steddyzen.app

The planner works without an account. Until you sign in, your planner stays on your device.
When you sign in, we keep a copy of your planner on our servers so your devices can share it.
We do not sell your data, show ads, use tracking or analytics tools, or train AI models on your data.
AI features send only the text they need, and only when you use them.
You can delete your account and your synced data from inside the app at any time.

1. Who we are

SteddyZen is operated by EvolvLabs, LLC, a Maryland limited liability company. EvolvLabs is the data controller for the information described in this policy.

EvolvLabs, LLC
6028 Monroe Ave, Sykesville, MD 21784, USA
(757) 304-0189 · hello@steddyzen.app

2. Scope

This policy covers the SteddyZen apps for phones and the web (the "Service") and this website, steddyzen.app (the "Site").

3. Information we collect

Nothing, if you do not sign in. The planner works on your device without an account. Your tasks, routines, notes and settings are then stored only on that device, and we do not receive them.
Account information. When you sign in with Google, Apple, Microsoft or a code we email to you, we keep an account ID we create, the provider you used, the provider's ID for your account, and your email address with whether the provider confirmed it. If you sign in with Apple, we also keep a token Apple issues, used only to remove SteddyZen's access at Apple when you delete your account. We do not ask for or keep your name.
Your synced planner. When you are signed in, we keep a copy of your planner so it can appear on all your devices: tasks and steps, routines, notes, captured thoughts, energy and mood check-ins, focus sessions and time records, medications and their reminders, and settings.
Account records. Sign-in sessions, the date your free trial started, and which version of our terms and this policy you accepted, and when.
AI requests. The text a feature needs, when you use it (see section 6).
Waitlist. Your email address, if you join the waitlist on the Site.
Technical logs. Our servers and our hosting provider record requests, including IP address, device and browser type, time, and which feature was used, for security and operations.

From Google, Apple and Microsoft we receive only basic account information: an account ID and your email address. SteddyZen's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use it

To provide the Service: to sign you in, sync your planner between your devices, produce the AI suggestions you ask for, send sign-in codes, and operate and secure the Service. We use your email address to join your sign-ins into one account. We use your waitlist email only to tell you when SteddyZen is available. We do not look at your planner for any other reason, and we do not use it for advertising or to train AI models.

5. Cookies and analytics

We use no advertising trackers and no analytics tools in the Site or the Service. The web app keeps your planner and your sign-in in your browser's storage so that it works; that data stays on your device until it is synced as described above. Our infrastructure provider may set functional cookies for security, such as bot mitigation.

6. AI features

Some features use AI: turning a brain dump into tasks, breaking a task into steps, suggesting steps for a routine, and suggesting a time for a task. Nothing is sent until you use one of them. We then send only what that feature needs: the text you wrote, the task or routine name, or, for a time suggestion, the task name, its length and the free times in your day. We never send the titles or details of your calendar events.

That text goes from our servers to Anthropic, PBC, the maker of the Claude AI model, either directly or through Google Cloud, which processes it to produce the suggestion under terms that do not permit using it to train models. Every suggestion is shown to you first, and nothing is added to your planner unless you choose it.

7. Voice

In the phone apps, speech is turned into text on your device, and the audio does not reach us. In the web app, SteddyZen uses your browser's own speech recognition. Some browsers, including Google Chrome, send that audio to their maker to turn it into text. We do not receive the audio.

8. Calendars

If you add a calendar link, our server fetches the calendar for your device and passes it straight through without storing it. Your calendar events are kept only on your device.

9. How we share information

We share information only with:

Service providers, each bound to process data only for us: Google Cloud (our servers and database, in the United States), Cloudflare, Inc. (hosting for the Site and the web app, content delivery, security), Resend (sign-in code emails), and Anthropic, PBC (the AI features, as described above).
Sign-in providers you choose: Google, Apple and Microsoft, which confirm who you are.
Legal and safety. When required by law, or to protect the rights, safety and security of EvolvLabs, our users or the public.
Business transfers. If EvolvLabs is involved in a merger, acquisition or sale of assets, subject to this policy's commitments.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

10. Data retention

Your account and synced planner are kept while your account exists.
When you delete your account, your account and synced planner are deleted from our database straight away, and copies in our database backups expire within 7 days.
Server request logs are deleted after 30 days.
Waitlist emails are kept until we have told you SteddyZen is available, or until you ask us to delete yours.
Your planner on your own devices stays until you remove the app or clear its data.

11. Your rights and how to exercise them

You can delete your account and your synced data at any time in the app, under You, and you can save a backup file of your planner from the app whenever you like. You can also ask us for access to, correction of, or deletion of personal information we hold about you by emailing hello@steddyzen.app.

12. EEA, UK, and Swiss residents (GDPR)

Where the GDPR or UK GDPR applies, our legal bases are performance of our contract with you (to provide the Service you signed up for), consent (for the waitlist), and legitimate interests (to operate and secure the Site and the Service). You also have the rights to restrict or object to processing, to data portability, to withdraw consent at any time, and to lodge a complaint with your supervisory authority.

13. California residents (CCPA/CPRA)

California residents have the right to know what personal information we collect, to access and correct it, to request deletion, and to opt out of sale or sharing. We do not sell or share personal information and have not done so in the preceding 12 months. We will never discriminate against you for exercising these rights.

14. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. In the EEA and UK, a person below the age of digital consent in their country needs a parent's or guardian's consent to use an account. If you believe a child has given us personal information, email us and we will delete it.

15. Health information

Some things you may record in SteddyZen, such as medications, mood and energy check-ins, relate to your health. We treat them as sensitive. We use them only to provide the Service to you, we never sell them or use them for advertising, and we never use them to train AI models. SteddyZen is a consumer planner and is not a HIPAA covered entity or business associate.

16. Security

Your data is encrypted in transit to our servers and encrypted at rest on them. It is not yet end-to-end encrypted, so our servers can read it. We plan to add end-to-end encryption for notes, mood check-ins and medications, and we will update this policy when we do. No system is perfectly secure; we work to protect your data in proportion to its sensitivity.

17. International data transfers

We are based in the United States and process data there. If you use SteddyZen from elsewhere, your information is transferred to the United States, where privacy laws may differ from those where you live.

18. Changes to this policy

We may update this policy. The date above reflects the current version. We will post changes on this page, and we will tell you in the app before a material change takes effect.

19. Contact us

Privacy requests and general questions: hello@steddyzen.app · Help with the app: support@steddyzen.app