1. At a glance
Steadycost is an app for Mac, iPhone and iPad. It uses no tracking, no analytics and requires no sign-up. Your financial data stays on your devices and, if you use iCloud sync, in your own iCloud account. If you turn on the export to Calendar or Reminders, the app also writes the names of your costs into a calendar or a reminders list in your iCloud account or in another account on your device. We have no access to any of it. The only data that reaches us is feedback you send us yourself.
This privacy policy explains which data is processed when you visit the website steadycost.de and when you use the app.
2. Controller
Controller in the sense of the General Data Protection Regulation (GDPR) is:
Daniel Boberg
Klinkerwerkstraße 8
32549 Bad Oeynhausen
Germany
Email: kontakt@steadycost.de
3. Data processing inside the Steadycost app
3.1 Storage on your devices and in your iCloud
Everything you enter or import in Steadycost (costs, accounts, categories, tags, notes) is stored in the app's protected storage on your device. While iCloud sync is on, the app also syncs a few display settings (such as whether amounts show per month or per year and whether the introduction was shown) through iCloud key-value storage.
If iCloud sync is on (with Pro or during the trial, as long as you are signed in to iCloud; you can turn it off in the settings), Apple keeps this data in step between your devices through the private CloudKit database of your own iCloud account. We have no access to this database. Apple is responsible for iCloud; Apple's terms and privacy policy apply.
3.2 No telemetry, no analytics
Steadycost does not contain any tracking, analytics or crash-reporting SDKs and sends no usage data on its own. Recognising entries in Quick Add uses the Apple Intelligence language model on your device; nothing leaves the device. Reminders are local notifications. The export to your calendar uses Apple's calendar access, which you allow. It creates a "Steadycost" calendar in an account your device provides, such as iCloud, Google or Exchange, and otherwise locally. Likewise, the export to Reminders uses Apple's reminders access, which you allow, and creates a "Steadycost" list; it syncs through the account your device uses for reminders.
3.3 Data export
When you export data, for example as a CSV file, the file is saved to a location you choose.
3.4 Feedback from the app
With "Send feedback" you can write to us from inside the Steadycost app. Nothing is sent unless you send the report yourself. The report contains:
- your message and the kind of feedback (problem, wish or praise);
- optionally your email address, if you would like a reply;
- for a problem report, optionally a screenshot of the app window. It is off by default, can show amounts and other content of your window, and is shown to you before sending;
- while "Attach technical info" is on (preselected, can be turned off before each send), technical details: app version, build and channel (App Store, TestFlight), days since installation, platform, system version and device model, free disk space in rough steps, language, preferred languages, region, time zone and main currency, appearance and accessibility settings, subscription and sync status, counts (for example how many costs you have entered), the codes of recent errors, whether a crash or hang was recorded since the last report, and a random identifier you can reset in the settings. You see the exact values before sending. If a waiting report is sent later, only the number of dropped reports can still change. These technical details never include names of costs or accounts, amounts, notes or IBANs.
The optional reply address and the technical details are data you choose to provide in the form. They are linked to you, because the reply address and the install ID arrive together. They are not used for tracking and are deleted after the report has been handled.
The report is sent to steadycost.de over an encrypted connection (HTTPS). There, Cloudflare processes it as our hosting provider (Cloudflare Workers and Cloudflare Email Routing) and forwards it as an email to our mailbox, which is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server does not store the report and does not log its content. We use it to answer you and to improve the app. We delete the feedback email once your request has been dealt with. To prevent abuse of the form, your IP address (for IPv6 only the network, its first 64 bits) is stored with the time of every counted request to limit the number of requests. Every request that passes the basic format checks (POST, a valid app identifier, JSON, an allowed size) counts, not only valid reports, except a repeat of a report that has already arrived or is being sent right now. This only applies when the app sends its report identifier as a header. The IP address and these times are kept until one hour after your last counted request. A request refused because of the limit is not stored. So that a report the app sends again does not arrive twice, we store a hash (SHA-256) of its report identifier for 14 days. If the random identifier is sent, we store a hash of it to accept at most 20 reports a day per installation, until one day after your last report. We do not store the identifiers themselves. Legal basis is Art. 6 (1) (f) GDPR, and Art. 6 (1) (b) GDPR when you ask for a reply. If a report cannot be sent, for example without an internet connection, it waits on your device for up to 14 days and is sent again automatically; if more than 20 are waiting, the oldest is dropped. While a report is waiting, you can delete it in the settings under "Pending reports". After 14 days it is dropped, and also if our server finally refuses it. Only if you attach technical info does a later report carry the number of dropped reports, never their content.
3.5 Exchange rates
So the app can convert costs in other currencies into your main currency, it loads the euro reference rates of the European Central Bank directly from www.ecb.europa.eu. This happens at launch and when you return to the app, whenever new rates are due, even if you have no cost in a foreign currency (once per ECB publication day, after a failed try again at the earliest an hour later while the app keeps running, plus the rate history now and then, about once a year). Nothing about you or your data is sent and no cookies are stored. As with any website request, the ECB sees your IP address; the ECB is responsible for its processing. Legal basis is Art. 6 (1) (f) GDPR (up-to-date conversion of your costs).
4. Data processing when visiting this website
4.1 Server log files
When you visit this website, our hosting provider automatically processes information your browser transmits (IP address, date/time, requested URL, HTTP status, transferred data volume, referrer, user agent). Legal basis is Art. 6 (1) (f) GDPR. We keep no access logs ourselves, logging of our Worker is switched off. Cloudflare processes this information only to deliver the site and protect it from attacks, and deletes it under its own retention periods.
4.2 No cookies, no tracking
This website sets no cookies and uses no web analytics. A cookie banner is therefore not required.
4.3 Fonts
The website uses the "Mona Sans" font, which is self-hosted. No data is transmitted to third parties when loading the font.
5. App Store
Steadycost is distributed exclusively through Apple's App Store. For purchases, downloads and in-app purchases Apple processes your data as an independent controller. The app checks on your device, from purchase records signed by Apple, whether you have Pro. The app remembers when your trial started on your device and in your iCloud Keychain; we receive no data from this.
6. Email contact
If you contact us by email, your information will be used solely to answer your request (Art. 6 (1) (b) and (f) GDPR).
7. Your rights
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw consent (Art. 7 (3) GDPR)
To exercise your rights, simply send an informal email to kontakt@steadycost.de.
8. Right to lodge a complaint
The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
9. Data security
This website is served exclusively over encrypted HTTPS (TLS).
10. Changes to this privacy policy
We reserve the right to adjust this privacy policy.