1. Who is responsible for your data

Most of the Service is used inside a workspace that belongs to an organization, school or individual (the "workspace owner"). How responsibility is divided depends on the data:

Workspace content. For messages, files, meeting recordings, transcripts, attendance records and notes created in a business, education or general workspace, the organization that owns the workspace decides how that content is used. It is the data controller, and we process the content on its behalf as its processor. If you have questions about that content, contact the workspace owner first.
Account and security data. For your account, sign-in and security records, and our website, SteadyMeet is the controller.
Personal workspaces. If you create a personal workspace for yourself, SteadyMeet is the controller for its content.

2. Information we collect

Information from your sign-in provider

You sign in with Google, Microsoft, Apple, Facebook or your organization’s single sign-on (OIDC or SAML) provider. From that provider we receive your name, email address, whether the email is verified, your preferred language, and a unique account identifier. If your school or university signs you in, we may also receive your institution, your affiliation (for example student or staff) and the entitlements your institution sends. We never receive or store your password.

Profile and settings

Your display name, profile photo, time zone, language, theme and layout choices, notification and audio/video preferences, and privacy settings (such as read receipts, last seen and appearing offline). We also store your presence and status text, the people you have blocked or marked as priority contacts, and your phone number if you add one for text-message verification.

Security information

Two-step verification settings: authenticator secrets (stored encrypted), recovery codes (stored only as hashes) and passkey public keys.
Verification attempts: the method used, whether it succeeded, and when.
Sign-in sessions: your browser’s user agent, when the session started and was last active, and a keyed hash of your IP address. We do not store your raw IP address by default.

Content you create

Messages, reactions, attachments, workspace files, meeting notes, status updates (including who viewed them), and meeting invitations and schedule entries.

Meeting and call information

Attendance: the name shown in the meeting and when each participant joined and left.
Call history: who called whom, when, and whether the call was answered.
Recordings, but only when a host starts one. A recording is captured in the host’s browser and uploaded to our storage.
Transcripts, but only when a host turns on transcript saving for that meeting. Everyone in the meeting sees a notice while it is on.
In-meeting chat, polls and reactions. These are kept temporarily so the meeting works, and are not saved to your workspace history.

Audio and video pass through our media servers so they can reach the other participants. We do not store audio or video unless a host records the meeting.

Connected tools

If a workspace administrator connects Google Calendar or Google Classroom, we store an encrypted authorization token and the information needed to show and create events or classes.

Guests

Meeting guests who join without an account provide only the display name they enter. Guests invited to a conversation from outside the workspace are given access limited to that conversation.

Technical information

Our servers keep operational logs, including hashed IP addresses and, for emails we send, the recipient address. We also collect aggregate reliability metrics, such as device, operating system and browser categories and call quality, that do not identify you.

3. Captions, transcription and on-device processing

Live captions use the speech recognition built into your web browser. Depending on your browser, the browser vendor may process your audio on its own servers; Google Chrome, for example, sends audio to Google for recognition. That processing is governed by your browser vendor’s privacy policy. We do not send meeting audio to any speech-recognition or AI service.
Background blur and other video effects run entirely on your device.
We do not use your messages, recordings, transcripts or files to train artificial-intelligence models, and we do not use them for advertising.

4. How we use information, and our legal bases

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the legal bases shown for each purpose.

To provide the Service: signing you in, running meetings and calls, delivering messages and files, and showing you the people and content you have access to (performance of our contract with you or your organization).
To keep the Service and your account secure: two-step verification, session management, and preventing and investigating fraud, abuse and security incidents (our legitimate interest in a safe service, and compliance with legal obligations).
To communicate with you: meeting invitations, verification codes, notifications you have turned on, and important notices about the Service or these policies (performance of contract, and legitimate interests).
To keep the Service reliable, using aggregate metrics and logs to diagnose problems and plan capacity (legitimate interests).
To comply with the law and respond to lawful requests (legal obligation).
For optional features you or your workspace choose to enable, such as connected Google tools or text-message verification (consent or contract, as applicable). You can withdraw consent at any time.

We do not sell personal data, show advertising, or build advertising profiles.

5. Cookies and local storage

We use only the cookies and browser storage needed to run the Service. We do not use analytics, advertising or cross-site tracking cookies.

steadymeet_identity keeps you signed in. It lasts 30 days.
steadymeet_workspace remembers your current workspace. It lasts 30 days.
Short-lived sign-in cookies protect the sign-in process with your provider. Each lasts 10 minutes.
Local storage in your browser remembers your theme, language, layout, audio/video devices and recent emoji.
Session storage holds meeting host controls and pending verification steps. It is cleared when you close the tab.

Because these are strictly necessary for the Service you request, they do not require consent. Clearing them will sign you out and reset your preferences on that device.

Inside your workspace

Other members can see your name, photo, and presence and status (subject to your privacy settings), plus the messages and files in conversations they belong to.
Workspace owners and administrators manage membership, roles and security settings.
People with meeting-management permission (owners, administrators, educators and managers, depending on the workspace) can access the workspace’s recordings, transcripts, attendance records and meeting notes.
Participants in a meeting, including guests and people from other workspaces, can see and hear what is shared in it. People from outside the host workspace are labeled as external.

Service providers

We use the following kinds of providers to run the Service. Each may only use your data to provide its service to us.

Cloud hosting, database and file storage (Railway).
Email delivery, through our email provider, or through your workspace’s own mail server if its administrator has configured one.
Network relay and discovery servers (Metered, and Google’s public STUN servers). These help connect calls when a direct connection is blocked. They see your IP address; relays pass on encrypted media they cannot read.
A content delivery network (unpkg) that serves emoji images. It receives your IP address when your browser loads them.
Your sign-in provider, and Google if your workspace connects Google Calendar or Google Classroom. Their own privacy policies apply to what they collect.

When you post a link, our server fetches that page to build a preview, so the linked site sees our server rather than you. Embedded content, such as a video, is loaded from its provider when you play it.

Other disclosures

When required by law, or when needed to protect the rights, safety or property of our users, the public or us.
As part of a merger, acquisition or sale of assets. This policy would continue to apply to your data, and we would tell you in advance.
With your consent or at your direction.

7. International transfers

Our providers may process data in countries other than your own, including the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

8. How long we keep information

Recordings and saved transcripts are deleted automatically 30 days after they are made. Download links expire after 24 hours. Download any copies you need to keep.
In-meeting chat, polls and reactions are discarded within 24 hours. Meeting rooms expire 24 hours after they end.
Status updates expire after the duration you choose (24 hours by default), and their media is removed within two days.
Verification codes and sign-in challenges expire within minutes.
Sessions end when you sign out or revoke them, or after 30 days.
Messages, files and notes are kept while the workspace exists. When you delete one, it is hidden from everyone immediately. We keep the underlying record so it can be restored or reviewed for security and abuse investigations, until you or the workspace owner ask us to erase it permanently.
Account data is kept for as long as your account exists. When you ask us to delete your account, we delete or anonymize it within 30 days, unless the law requires us to keep it longer.

9. Security

All traffic to the Service is encrypted in transit with TLS, and browsers are told to use HTTPS only (HSTS).
Calls are encrypted in transit with WebRTC’s standard DTLS-SRTP encryption between your device and our media servers. Calls are not end-to-end encrypted: our media servers decrypt the media in order to route it to other participants.
Sensitive secrets such as authorization tokens, authenticator secrets and mail-server passwords are encrypted at rest. Recovery codes and IP addresses are stored only as hashes.
You can protect your account with an authenticator app, passkeys, email or text-message codes, and your workspace can require two-step verification.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

10. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent at any time.

You can update your profile, language, time zone, notification and privacy settings, and review or sign out of your active sessions, at any time in your settings.
For access, deletion, export or any other request, email privacy@steadymeet.com. We may need to verify your identity, and we will respond within one month.
If your data belongs to a workspace owned by an organization, we may pass your request to that organization, because it decides how that content is used.
If you are in the European Economic Area, the United Kingdom or Switzerland, you can also complain to your local data protection authority.
If you are a California resident, you have the right to know, delete and correct your personal information, and we will not treat you differently for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

11. Children

Outside education workspaces, the Service is not intended for anyone under 16, or under the minimum age for digital consent where they live if that is higher.

Schools and other institutions that use education workspaces with younger students are responsible for obtaining any parental consent the law requires and for supervising how the Service is used. We process student data only to provide the Service to the school, and never for advertising.

If you believe a child has given us personal data without the required consent, contact us at privacy@steadymeet.com and we will delete it.

12. Changes to this policy

We will update this policy when our practices change, and revise the date at the top. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.

13. Contact us

Questions or requests about privacy can be sent to privacy@steadymeet.com.

Privacy Policy