Plain-language privacy.

When you sign up and use the program, we store:

• Account: email address (your sign-in identifier).
• Payment: handled by Stripe — we never see your card number. We store the Stripe customer + session identifiers so we can match a purchase to your account.
• Program activity:which Steps and Parts you've completed, your Self-Assessment answers, your tasks (the to-dos you save), your Steady Work responses, and your Journal entries.
• Calendar sync: only if you connect Google Calendar, we store the connected Google account email and encrypted OAuth tokens so we can mirror scheduled tasks to your calendar. To detect reschedules, we also read the minimum Google event metadata we need for sync — event IDs, status, start time, update time, and private extended-property metadata. We ignore unrelated events and do not store their details.
• Operational logs: error or mobile crash reports, which stay on infrastructure we operate (self-hosted GlitchTip). We use anonymized enrollment identifiers — never your email, never the body of a Journal entry, task, or Assessment answer. Mobile crash reports exclude request payloads, screenshots, and view hierarchy. Our public marketing pages use Umami (self-hosted, cookieless) to measure visits, traffic sources, and page interactions separately from your program data. We do not use any third-party analytics service.

The Steady Check at /quiz is a self-reflection questionnaire you can take before you have an account. Here is exactly what happens with it:

• What we keep: your email address, optional first name, and your trait profile (per-trait averages and an overall figure). We do not store your individual question-by-question answers — they are scored and discarded in the same request.
• How long: quiz records are deleted automatically after 30 days.
• Email:the address you enter is where we send your results and the link to Kevin's free video. We may also occasionally send practical ADHD resources, program updates, and an invitation when enrollment opens — the consent note on the quiz gate covers this, and you can unsubscribe at any time.
• Who touches it: the results email is delivered by Resend, our email provider. Everything else stays on infrastructure we operate. No advertising pixels, no session recording, and no third-party analytics run on the quiz pages.
• Deletion: email kevin@newtreecounseling.com from the address you used and we will delete your quiz records ahead of the 30-day schedule.

On the mobile app you can dictate a to-do or a piece of feedback instead of typing it. The speech-to-text runs on your phone's own recognizer, provided by iOS or Android — Steady's servers never receive your audio. For a to-do, we store only the text you choose to save, and that text is a task like any other: private to you and never shared with a Coach.

The mobile app has a feedback button. When you send feedback, we store the text you wrote or dictated, the screen you were on (with any task or lesson identifiers removed), and the app version — nothing else from the screen. Feedback is meant for the Steady team and is read by us to improve the product. We may write a short reply — it appears only in your own app, and the person replying never sees who sent the feedback. Both your feedback and any reply are included in your data export and deleted with your account.

If you ask Steady to break a task into smaller steps, the text of that task is sent to a model we run on our own infrastructure, which suggests candidate first steps. Your words are never sent to a third-party AI service, and the model is used only to split the task into steps, never to assess you. Nothing is saved until you review the suggestions and choose what to keep. The task text is processed in the moment, is not stored by the model, and is never sent to analytics.

The hard rule, the one that makes the rest of this policy meaningful: Kevin (your Coach) cannot read your Journal entries, your tasks, your Steady Work responses, or your Self-Assessment answers. Our systems enforce this in code, backed by automated tests; it is not a matter of trust.

What the Coach cansee is engagement metadata: which Steps and Parts you've completed and when, when you were last active on web or in the app, and counts (how many tasks, focus sessions, or journal entries exist — never what any of them say). This is how we notice someone is stuck and improve the program; the content of your work stays sealed.

Your data lives on our own servers, hosted in a United States data center operated by IONOS. Account details and program activity are stored in our database; files (handouts, lesson assets, data exports) live in our own S3-compatible object storage. Sign-in and sessions run on our self-hosted identity server. Encrypted backups are stored with Amazon Web Services (AWS) in the United States. Connections between your browser and Steady use HTTPS.

We use the following sub-processors to deliver the program. Each handles a narrow slice of data; none receives more than they need.

• IONOS — cloud infrastructure (a United States data center) hosting our self-operated database, file storage, sign-in, and the app itself.
• Amazon Web Services (AWS) — encrypted off-site backups (database dumps and a mirror of our file storage) and supporting deployment infrastructure, in the United States.
• Stripe — payment processing, billing portal, invoices.
• Resend — transactional email (account setup and invite links, export-ready notifications, lesson-ready notifications).
• GlitchTip (self-hosted) — web error monitoring and mobile native crash monitoring on our own infrastructure; crash data never leaves servers we operate. Session replay, mobile screenshots, and mobile view hierarchy capture are disabled.
• Google Calendar — optional two-way calendar sync only if you connect your Google account; receives the scheduled task text, time, and Steady link needed to create and update calendar events. Steady also reads limited event metadata from Google to reconcile changes, and does not store unrelated events.

Our database, file storage, sign-in, error monitoring, and web hosting run on software we operate ourselves — these are self-hosted, not separate third-party services. Analytics use Umami, which we also self-host; no analytics data leaves our infrastructure. If you do not connect Google Calendar, we do not send your program data to Google for calendar sync.

You can, at any time:

• Export a copy of everything we hold about you from /portal/me. The export is a JSON file delivered via a signed link.
• Delete your account from /portal/me. Soft-delete is immediate; you have 14 days to change your mind by emailing kevin@newtreecounseling.com. After 14 days, your account and all linked data are permanently purged.
• Cancel billing from /portal/me/billing (Stripe Customer Portal).
• Ask us questions — email kevin@newtreecounseling.com.

California and EU/UK residents: the rights above (access, deletion, portability) satisfy the corresponding CCPA / GDPR obligations. There is no sale or sharing of personal information for cross-context behavioral advertising.

When you delete your account, Stripe retains its own transaction history per its tax + fraud-prevention obligations. We delete our link to that history; Stripe keeps the underlying records under its own privacy terms.

We use a session cookie from our self-hosted sign-in (Zitadel) to keep you signed in. We do notuse third-party advertising cookies. Our public marketing landing page uses Umami (self-hosted analytics) to measure visits, traffic sources, and landing-page interactions; it does not set analytics cookies. If you opt out via your browser's Do Not Track signal, we honor it.

Steady is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, email kevin@newtreecounseling.com and we will close the account.

If we change how we use data in a way that affects you, we will update the “Last updated” date at the top of this page and email signed-in Enrollees ahead of the change taking effect.

New Tree Counseling, P.C. — Kevin Barr, LMFT.
kevin@newtreecounseling.com