Privacy Policy

1. Introduction

Steady Circuit Ltd ("SteadyCircuit", "we", "us", or "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit this website, sign in to your SteadySync account, or use the SteadySync desktop application. Please read this policy carefully. If you disagree with its terms, please discontinue use of this site and the application.

This policy is designed to comply with the UK and EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). Sections 10 and 11 below set out your rights under each of these laws.

2. Scope

This policy covers:

• This website
• The SteadySync desktop application, for macOS, Windows, and Linux
• Your SteadySync account, sign-in, and billing

It does not cover the cloud storage providers you connect (Google Drive, Microsoft OneDrive, Dropbox, or Amazon S3 / S3-compatible services) — your use of those services is governed by their own privacy policies.

3. Information we collect

3.1 Account information

When you sign in to SteadySync, authentication is handled by our identity provider, Clerk. We receive your email address and a unique account identifier from Clerk. We do not receive or store your password — Clerk handles that on our behalf.

3.2 Billing information

If you subscribe to a paid plan, your payment is processed by a third-party payment processor. We do not store your full card number; we retain only what is necessary to manage your subscription, such as your plan, billing status, and renewal date.

3.3 Cloud storage credentials

When you connect a cloud storage provider (Google Drive, OneDrive, Dropbox, or S3) in the SteadySync desktop application, the resulting OAuth access tokens — and, for S3, your access key and secret key — are encrypted using your operating system's own secure credential storage (Keychain on macOS, Credential Manager on Windows, or libsecret on Linux) and stored only on your device. These credentials are never transmitted to, or stored on, our servers.

3.4 Telemetry and diagnostic data

The SteadySync desktop application sends limited, account-level diagnostic data to our servers so we can monitor the health of the service and diagnose problems. This includes:

• Which cloud storage providers you have connected (for example, "Google Drive: connected") — not any content from those accounts
• Aggregate counts of files by sync state (for example, how many files are synced, pending, or failed) — never file names, file paths, or file contents
• Sign-in and sign-out events
• Application error and warning messages, which are automatically filtered to remove access tokens, refresh tokens, passwords, and other credential material before being sent

We do not collect, and this telemetry never includes, the names, paths, or contents of the files SteadySync syncs on your behalf.

3.5 Website usage data

Like most websites, our servers automatically log standard technical information when you visit, such as your IP address, browser type, pages visited, and timestamps. We use this for security and operational purposes only.

3.6 Local-only data

Your light/dark theme preference is stored locally in your browser and in the desktop application. This never leaves your device.

4. Legal basis for processing (GDPR)

If you are located in the UK or the European Economic Area, we process your personal data on the following legal bases:

• Performance of a contract — to create and manage your account, provide the SteadySync service, and process billing.
• Legitimate interests — to maintain the security, reliability, and performance of our service (including the telemetry described in Section 3.4), which we have balanced against your privacy interests.
• Legal obligation — to comply with applicable law, such as tax and accounting requirements.
• Consent — where we ask for it specifically, which you may withdraw at any time.

5. How we use your information

We use the information we collect to:

• Provide, operate, and maintain the SteadySync service
• Authenticate you and keep your account secure
• Process subscriptions and billing
• Monitor service health, diagnose errors, and improve reliability
• Respond to support enquiries
• Comply with legal obligations

6. Sharing your information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We may share information with:

• Clerk, our identity and authentication provider
• Our payment processor, to handle subscription billing
• Our telemetry and observability infrastructure, which we operate ourselves, to receive the diagnostic data described in Section 3.4
• Our email delivery provider, to send transactional emails
• Professional advisers such as lawyers and accountants, where necessary
• Law enforcement or regulatory authorities where required by law
• A successor entity in the event of a merger, acquisition, or sale of assets

Your cloud storage credentials are never shared with us or any third party — see Section 3.3.

7. International data transfers

We are based in the United Kingdom. Where we or our service providers (such as Clerk or our payment processor) transfer personal data outside the UK or EEA, we rely on appropriate safeguards, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or transfers to jurisdictions recognised as providing adequate protection.

8. Data retention

We retain account information for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, or reporting obligations. Diagnostic and telemetry data described in Section 3.4 is retained only as long as needed for the operational purposes it was collected for, after which it is deleted or aggregated in a way that no longer identifies you. Cloud storage credentials are stored only on your own device and are removed when you disconnect an account or uninstall the application.

9. Security

We implement reasonable technical and organisational measures to protect your information, including encrypting cloud storage credentials at rest using your operating system's secure storage, and encrypting data in transit using TLS. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but strive to use commercially acceptable means to protect your data. See our Security page for more detail on how SteadySync is built to protect your credentials and files.

10. Your rights under GDPR (UK/EEA users)

If you are located in the UK or EEA, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Restriction — request that we limit how we use your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on our legitimate interests
• Withdraw consent — where we rely on your consent, at any time

To exercise any of these rights, contact us at hello@steadycircuit.com. We will respond within one month, as required by law. You also have the right to lodge a complaint with your local data protection supervisory authority — in the UK, this is the Information Commissioner's Office.

11. Your rights under CCPA/CPRA (California residents)

If you are a California resident, you have the right to:

• Know what personal information we have collected, used, disclosed, and shared about you, and the categories and sources of that information
• Delete personal information we have collected from you, subject to certain exceptions
• Correct inaccurate personal information we hold about you
• Opt out of the sale or sharing of your personal information — we do not sell or share personal information, so there is nothing to opt out of
• Limit the use of sensitive personal information — we do not use sensitive personal information for purposes that trigger this right
• Non-discrimination for exercising any of these rights

Categories of personal information we collect, as defined by the CCPA, include identifiers (such as your email address and IP address) and internet or network activity information (such as the diagnostic data described in Section 3.4). We do not collect any other CCPA-defined categories of personal information.

To exercise any of these rights, contact us at hello@steadycircuit.com or call +44 3300 245500. We will verify your request using the email address associated with your account, and respond within the timeframe required by law. You may also designate an authorised agent to make a request on your behalf.

12. Children's privacy

SteadySync is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately and we will take steps to delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated effective date. Your continued use of the website or application after any changes constitutes acceptance of the updated policy.

14. Contact us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: hello@steadycircuit.com
Phone: +44 3300 245500
Company: Steady Circuit Ltd (Company No. 16471673)
Registered office: 66 Paul Street, London, EC2A 4NA