How your data is held
The privacy page says what SteadyRange will not do with your readings. This page is the checkable half: where they run, who else can see them, and what happens when you ask for them back or ask for them gone.
Controls
Transport and storage
Every connection is HTTPS; there is no plaintext fallback. Records are held in a managed SQLite database that the provider encrypts at rest. Third-party device credentials — the tokens that let a connected scale or CGM account sync — are additionally encrypted in the application layer with AES-256-GCM before they are written, so a database dump does not hand anyone working credentials to your account elsewhere.
Authentication
Sessions are cookie-based, HTTP-only, and short-lived, with a five-minute signed cache in front of the session table. Passwords are hashed and are never stored or logged in the clear. Passkeys — Face ID, Touch ID, Windows Hello, hardware keys — are supported and are the stronger option: a passkey cannot be phished or replayed on another site. Email addresses must be verified before an account becomes usable, and disposable-address domains are refused at account creation.
Isolation between accounts
Every query that touches a health record is filtered by the authenticated user id — there is no shared pool and no cross-account view. Clinician access is separate and explicit: a practice sees a member's record only through a live enrollment plus a consent scope that member granted, and every read of a shared record is written to an append-only audit chain the practice cannot rewrite.
Shared clinician links
A clinician link is a long random token in the URL, and that token is the only credential — which is the point, because a doctor should not need an account to read one page. The link is never indexed, and it can be rotated or switched off from Settings, at which moment it goes dead. Treat it the way you would treat an emailed document: anyone holding the link can read that report.
Deletion means deletion
Erasing your data removes your readings, weights, medications, doses, activities, and notes from the live database; deleting the account removes the account row with them. Provider backups age out on their own schedule rather than instantly, so allow a short window for those copies to expire. Nothing is retained for analytics, resale, or model training — there is no second copy that survives the delete.
What is not claimed
SteadyRange is not a covered entity and does not offer a HIPAA business associate agreement. It holds no SOC 2 report and has not had a third-party penetration test. It is not a medical device and does not give treatment advice. Saying so plainly is part of the posture: a small product that names its limits is easier to evaluate than one that implies certifications it has never been through.
Who else touches your data
A small product runs on other people’s infrastructure. Pretending otherwise would be the dishonest version of a privacy claim, so here is the whole list and what each company can see.
| Company | What it does | What it can see |
|---|---|---|
| Vercel | Runs the application and serves every page. | Every request, in transit. Aggregate, cookieless page counts are retained; request payloads are not. |
| Turso | Hosts the managed SQLite database your records live in. | All stored records, encrypted at rest by the provider and reachable only with the service credential. |
| Resend | Delivers transactional email — verification, magic links, reminders, the weekly briefing. | Your email address and the contents of mail addressed to you. A briefing email contains your figures, which is why it is opt-in. |
| Stripe | Processes Plus subscriptions. | Your billing details. Card numbers never reach SteadyRange; the app stores a customer id and a subscription status. |
| Upstash | Caches sessions and enforces rate limits. | Session identifiers and request counters. No readings. |
| Axiom | Collects application traces so failures can be diagnosed. | Request timings, route names, and error text. Not reading values. |
Optional integrations you switch on yourself — a connected scale, a CGM import — add the provider you chose to this list for your account only, and drop off it when you disconnect them.
Who runs SteadyRange
SteadyRange is built and operated by one person — not a team, not a venture-funded company. There is no support tier between you and whoever wrote the code: the address below is read by the person who can actually fix the thing you are writing about.
That is deliberate, and it cuts both ways. A single operator means decisions about your data are not made by a growth team you will never meet — and it also means there is no 24-hour on-call rotation. Both are worth knowing before you trust a product with a medical history.
Reporting a vulnerability
If you have found a way to reach another member’s records, to open a report you were not given, or to bypass a consent scope, email hello@steadyrange.com with enough detail to reproduce it. You will get a human reply, not an autoresponder. Please do not run automated scans against the live service, and please do not access, alter, or keep anyone else’s data while demonstrating an issue — a description and a request path are enough.
There is no bug bounty programme, and no legal threat either. Good faith reports are welcome and will be credited if you want them to be.