Steady Hare

Privacy

Version 0.1, a draft for review. It describes the app as built today.

In short

Who we are

Steady Hare is operated by the maker of the app. Write to hello@steadyhare.ai for anything in this notice.

On your device

The app keeps your material, your plan, your answers and your progress in a database on the device. Page photos you take are processed on the device by Google's document scanner and text recognition. Nothing on the device is sent anywhere unless a feature below says so.

If you create an account

Sign-in uses an email address and a password, handled by Google Cloud Identity Platform, which stores the address and a hash of the password. We store the display name you choose and your date of birth, which is used only to confirm you are an adult. If the date of birth shows you are under 18, the account is not created and we keep only a salted hash of the attempt, so the same person cannot simply try again.

Each device you pair gets its own record and its own keys. We keep a log of actions in your account (who paired a device, who was invited, when access narrowed) as metadata only. It never contains your material or your answers.

Syncing between your devices

Your learning record is sealed on the device with keys that stay with you before it is synced. The server stores the sealed data and can see only what it needs to move it: which device sent it, when, and in what order. The facts about access (whether you were on track, when the apps you chose were narrowed) are stored readably, so that people you invite can see them.

AI processing

When the app writes questions from your material or checks an answer, the relevant text, and page photos you choose to send, go through our server to an AI provider's API (currently OpenAI). The provider's API terms do not permit it to use this data to train its models. Page photos are stored in a private bucket in our Google Cloud project and are removed when you delete your account. Spending on AI calls is capped per day and per month on our side.

People you invite

A partner, parent or instructor sees only what you chose to share, in reports computed on your device: progress, the state of your plan, and whether access narrowed. Individual answers are never shown to anyone else. You can revoke sharing at any time, and it stops at once.

Android permissions and why

PermissionWhy
Usage accessTo see which app is in front, so that the apps you chose can be narrowed when your plan says so. The app reads only which app is open, never what is inside it.
Display over other appsTo show the focus screen over an app you chose to narrow.
CameraTo photograph pages of your material. Asked when the camera first opens.
NotificationsTo tell you about your daily step and your plan.
InternetTo sync and to reach the AI service when you use those features.

This website

The site is served by Firebase Hosting, part of Google Cloud, which keeps standard request logs (address, browser, time) under Google's retention. The site sets no cookies and runs no analytics.

Keeping, exporting and deleting

Your data stays as long as your account does. You can export your complete learning record from the app at any time; the export is yours. Deleting your account, from the app, revokes every device and every share at once, and the server copies are purged afterwards, including backups once their retention window (30 days) passes. A small deletion marker, a salted hash with no name or email, is kept so that a restore from backup cannot bring the account back.

Children

Steady Hare does not knowingly create accounts for anyone under 18. The app itself can be used without an account at any age, but sharing and sync require one.

Changes

If this notice changes, the version number at the top changes with it, and the app will tell you when it matters. Questions: hello@steadyhare.ai.