Privacy notice

Effective date: 13 October 2026

Who we are

SteadyKeeper is an Android app that reminds you when to take the medications you enter, and keeps a personal record of your reminders and doses. During the beta, the app appears on your phone under the name “Dose Reminder”. The beta is by invitation only.

SteadyKeeper is operated by Cory Newey, an individual. In this notice, “we” and “us” mean Cory Newey.

This notice covers the SteadyKeeper app, the server it connects to, and this website.

What we collect

We collect only what you give us and what the app needs to work.

Your account

Your email address. We create your invitation for the address you gave us, and your account uses that address.
Your password. We store it only as a one-way hash, never as the password itself.
Your phone’s time zone and language setting, read when you create your account, so reminders arrive at the right local time.
Your settings in the app, such as the symptoms you choose to follow.

What you record in the app

We treat everything in this list as health information, because medication names, notes and symptoms can reveal things about your health.

Your medications: the names you type, and any strength, form, instructions and notes you add.
Your doses and schedules: the label you give each dose, the amounts, and the times and days you set.
Your dose records: whether you marked a dose taken, snoozed or skipped, when, the amount, and any reason or note you add. This includes “as-needed” doses you record.
Your Diary: your rating of the day, your answers about the symptoms you follow (including any symptoms you add yourself), and your notes.
Your personal ratings of how much a dose helped. These are your own answers, kept for your own record.

Technical information

Sign-in sessions: when a session started, when it expires, and whether it was ended.
A server request log. For each request to our server it records the kind of request, the result, how long it took, a request number, and the random identifiers of your account and your sign-in session. It never records what you sent or what you received, so it holds none of your medications, doses or notes.
Our server reads your internet (IP) address in memory only, to limit repeated sign-in and password-reset attempts. The request log does not record it.

What we do not collect

No location, no contacts, and no advertising identifiers. The app does not ask for permission to read them.
No analytics, crash-reporting, error-tracking or advertising tools.
We do not ask you to tell us about any medical condition. What you type in a medication name, a dose label, a note or a symptom you add is up to you.

Why we use it

To set your reminders and keep your record of doses, Diary entries and ratings.
To show you what you recorded, and to let you export or delete it.
To sign you in, keep your account secure, and reset your password.
To keep the service running: to find faults, check that reminders and records reach the server, and investigate security problems.
To run the beta: to send invitations and to answer your questions.

We do not use your information for advertising, and we do not use it to give you medical advice. SteadyKeeper does not interpret your records.

Email we send

The app’s server sends two kinds of email, and only these: a password-reset link when you ask for one, and a notice that your password was changed. Each has a fixed subject and fixed wording. Neither contains any medication name, dose, schedule, time, record or note. A reset link works once, for 30 minutes.

If you forget your password during the beta, email us at steadykeeper.admin@gmail.com from your account’s address. We may need to confirm your address with our email provider first. If so, you will receive one message from Amazon Web Services asking you to confirm it, and then the email with your reset link.

During the beta, other messages to testers, such as invitations and answers to your questions, are sent by hand from steadykeeper.admin@gmail.com.

Where it is stored and who processes it

Your account and everything you record are stored on our server and database, run on Amazon Web Services (AWS) in the United States (the Oregon region). These service providers handle information for us:

Amazon Web Services: our server, our database and its backups. This is where your health information is stored.
Amazon Simple Email Service (part of AWS): sends the two password emails above. It receives your email address, the fixed message and, for a reset, the link. It receives no health information.
Google (Gmail): the mailbox steadykeeper.admin@gmail.com, which receives beta requests and any email you send us.

We do not use Google Firebase or any push-notification service today. Reminders are scheduled on your phone itself. Our certificate authority (Let’s Encrypt) and our domain registrar (Porkbun) receive none of your information.

Two others are not our service providers, but you should know about them: your phone’s maker and Google, which provide Android itself; and any app you choose when you share an export, which handles that file under its own terms.

How long we keep it

Your records: a rolling 18 months. Dose records (including as-needed doses and notes), Diary entries, day ratings, symptom answers and personal ratings are deleted automatically once they are more than 18 months old. The server checks every day. Export a copy if you want to keep them longer.
For as long as you have an account: your account, your settings, your current medications, doses and schedules, and the symptoms you chose to follow.
Password-reset links stop working after 30 minutes, and expired ones are deleted by the same daily check.
Backups: our database backups are kept for 7 days. A record deleted from the database stays in a backup until that backup expires.
The server request log: kept for 14 days. Older entries are deleted each day.
Deletion records: when an account is deleted, we keep a short record of it for 2 years: a one-way hash of the account’s random identifier, the dates, the number of records deleted, and the outcome. It holds no email address and no health information. We keep it longer than the account’s data, so that we can apply your deletion again if we ever restore a backup.
Email provider records: Amazon SES handles each email to deliver it. If an email to you bounces or is marked as spam, your address may stay on Amazon's do-not-send list; ask us and we will remove it.

Deleting your account and getting a copy

Delete your account

In the app, go to Settings → Delete my account. You enter your password to confirm. This permanently deletes your account and everything recorded in it: your medications, doses and schedules; the doses you recorded and your notes; your Diary, day ratings and symptom answers; your ratings of how much a dose helped; and your sign-in and email address. It cannot be undone. Reminders on that phone stop, and you are signed out.

The records are gone from our database when the deletion completes. Copies in our backups are removed as those backups expire, within 7 days. What remains afterwards: the deletion record described above; lines in the server request log that carry your account’s random identifier, for up to 14 days; and any copy you exported or shared yourself.

Get a copy of your data

In the app, go to Settings → Export my data. You can save one file with every record in your account (JSON), and three spreadsheet-ready files (CSV): your dose records, your Diary, and your personal ratings of doses. Sign-in details are left out. Records older than 18 months have already been deleted, so they are not in your copy.

An exported file is not encrypted. Once you save or share it, it is your copy, and the app or person you give it to controls it.

Other requests

You can also ask us by email to see, correct or delete your information, or ask a question about it. Send your request from your account’s email address. We reply within 30 days.

On your phone

Reminders show the label you give a dose. If you name a dose after a medication, the reminder shows that name. A general label such as “Morning meds” keeps the medication name out of the reminder. Reminder notifications are marked private, so a secure lock screen can hide their details.
Your phone keeps what it needs to remind you. The labels and times of upcoming reminders, and answers waiting to be sent, are stored on the phone. They are kept in storage the phone can read as soon as it starts, before you unlock it, so that reminders still sound after a restart.
Shared devices. Anyone who can unlock your phone can open SteadyKeeper and see what you have recorded. Reminders show the label you gave each dose, so if others see your phone, use a general label such as 'Morning meds'.
Signing out or deleting your account cancels that phone’s reminders and clears what the app stored for them.

Security

Here is what protects your information today, in plain terms:

The connection is encrypted. The app talks to our server only over HTTPS, using TLS 1.2 or later.
The server’s storage is encrypted by AWS. The database’s storage and the server’s disk are encrypted at rest, and the database cannot be reached from the internet.
The phone’s storage is encrypted by Android. This is Android’s own storage encryption. The app does not add its own encryption to your records.
Your sign-in is protected on the phone. The app encrypts its sign-in credential with a key kept in the Android Keystore. This covers the sign-in only, not your records. A phone with no screen lock cannot keep you signed in.
No Google Drive backup. Android’s automatic backup is turned off for this app, so the app’s data is not copied to your Google account.
Your account sees only your records. The database itself limits each signed-in account to its own rows.

No system is perfectly secure, and we cannot promise that your information will never be accessed without permission.

If something goes wrong

If we learn of a security incident that may affect your information, we will investigate it, act to contain it, and notify you and any authorities where the law requires us to. A notice will say what happened, what information was involved, what we did, what you can do, and how to reach us. We send it by email from steadykeeper.admin@gmail.com to your account’s email address.

Legal requests

We may disclose information when required by law, legal process, or a valid governmental request. Where legally permitted, we will provide notice to the affected user. We review each request and disclose only what is legally required.

If a user dies or cannot act for themselves

Requests concerning a user who has died or cannot act for themselves will be handled according to applicable law, and may require evidence of legal authority. We do not give a user’s information to someone only because they say they are a relative.

Adults in the United States only

SteadyKeeper is for adults 18 or over who live in the United States. It is not meant for children, and we do not knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its information.

Beta requests sent to our email address

To ask to join the beta, you email steadykeeper.admin@gmail.com, a Gmail mailbox. We ask for your name, your email address, and yes or no answers to three questions: whether you are 18 or over, live in the United States, and have an Android phone. Please do not include any health or medication information. We use your request only to decide on and send your invitation and to write to you about the beta.

We keep beta-request emails while the beta runs. If we do not accept a request, we delete it within 90 days. We delete the others within 90 days after the beta ends, or sooner if you ask.

No sale, no advertising, no marketing email

We do not sell your information or share it for advertising. We do not show advertising in the app, and we do not send marketing email. These are commitments.

HIPAA and health-data laws

SteadyKeeper is offered directly to you. It is not offered by, or on behalf of, a doctor, clinic, hospital or health plan. SteadyKeeper is not a health care provider or health plan and does not act for one, so we do not believe HIPAA applies. Some state health-data laws may. Either way, we treat what you record as health information, and this notice is written to describe it as such.

Changes to this notice

If we change this notice, we update this page and its effective date. We email testers before any significant change takes effect. If we want to use your information for a new purpose, or share it with a new kind of recipient, we will ask for your consent first.

Contact

Questions or requests about your information: steadykeeper.admin@gmail.com. This email address is our only privacy contact.

← Back to the home page