Privacy

Who is responsible

SteadyLean runs a gradual fat-loss programme at this address and in the SteadyLean iPhone app. For anything on this page, write to support@steadylean.me. There is a support page for everything that is not about privacy.

What is held about you

Only what the programme reads to do its work:

• The account. Your name, your email address and a hashed password, so that you can sign in and so that an administrator can let your account in.
• The body the plan is worked out from. Date of birth, sex, height, weight, target weight, activity level and the screening answers you gave at sign-up.
• The days you log. Weigh-ins, steps, sleep, the five ratings of the day, the food you record and the training sets you complete.
• The tape measure and the photographs, when you choose to record them. Both are optional and both are described below.
• What you write to us, when you use the message box on the home page or reply to an email.
• A trainer's notes, when a coach is attached to your account.

Health data from Apple Health

With your permission the iPhone app reads three things from Health: the latest body mass, the step count for the day and the sleep from the night before. They are read to prefill the day so that you do not type what your phone already knows.

The app never writes to Health. Health data is never used for advertising and is never sold or shared with anybody. You can withdraw the permission at any time in iOS Settings, under Privacy and Security, then Health; the programme continues to work and you type those numbers instead.

The camera

The camera is used for one thing: reading the barcode on a food packet so that its figures can be looked up and checked against the label before anything is saved. No photograph is stored, uploaded or logged — only the digits leave the camera. Typing the number is always offered as an alternative.

Progress photographs

Photographs are stored on a private disk, not in a public folder, and they are served only through a route that checks who is asking. Each upload is re-encoded before it is stored, which removes the EXIF data that a phone writes into a picture — including the coordinates of where it was taken.

They are shown to you, and to a coach only if you have given them. Nothing is shared by default.

What a coach can see

Being assigned a coach does not give them your record. The tape measurements and the photographs are two separate switches, on your own progress screen, and each one records the date you turned it on. Withdraw either and the next request for it is refused, including a page already open on their screen.

A coach reads the same trend, adherence and training figures your own screens show. They do not see anything the programme does not already put in front of you, except the measurements and photographs you have given them.

Security

Everything travels over HTTPS. Passwords are stored as a one-way hash, never in a readable form, and nobody at SteadyLean can read yours. Photographs are served through an authenticated route with caching switched off, so a withdrawal closes a URL that was already open.

Cookies and scripts

The site sets one cookie, and it is necessary: the session cookie that keeps you signed in and protects forms against cross-site requests. There are no advertising cookies and no analytics trackers.

One third-party script can appear on the public pages: the robot check that stands beside the message box and the sign-up form. It is loaded only when it has been configured for the site, and it exists because a form that a script can fill is worse than a page that loads a little slower.

Keeping it, and removing it

Your record is kept for as long as the account exists, because a trend with holes in it cannot be read. Nothing expires while you are using the programme.

You can delete the account yourself, without asking anybody: in the iPhone app under More, then Settings, then Delete my account, or on this website under Settings. Either one asks for your password again and then removes the account, its records, its photographs from the server and its device tokens. Deleting an account cannot be undone.

Age

The programme is for adults. The screening questions at sign-up refuse an account for somebody under eighteen, and that answer cannot be changed later.

Not medical advice

This app provides general fitness and nutrition guidance. It is not a substitute for medical advice.

Changes to this page

If what is collected changes, this page changes with it and the date at the top moves. Anything material is announced on the page rather than left for somebody to notice.