Privacy policy

Who we are

SteadyCheck runs SteadyCheck, an independent Australian service. We are not part of, or affiliated with, the Australian Government, Scamwatch, the ACCC or any bank.

What we collect

• Account details — your name, email address, and (if you give them) phone number, state and postcode.
• What you send us to check — messages, screenshots, photos, letters and descriptions of phone calls.
• Safety information — your answers to safety questions, your Safety Setup progress, data-breach results for email addresses you ask us to watch, and emergency case details.
• Your code word — stored as a scrambled (hashed) value for checking, and an encrypted copy that only authorised staff can open, with a logged reason, before contacting you.
• Technical information — basic logs needed to keep the service secure (for example, IP addresses for rate limiting). We do not use advertising or tracking tools.

How we use it

To check suspicious messages and tell you what to do; to send alerts, reminders and answers; to provide tech help and remote support you ask for; to run family sharing you agree to; to bill you; and to keep the service safe.

Overseas processing by an AI provider (APP 8)

To help our team check messages quickly, the content of messages you send us — including text read from screenshots — may be processed by an artificial-intelligence provider (DeepSeek) whose servers are located outside Australia. Before anything is sent, we automatically remove your name, email address, phone numbers, address, card numbers, bank account numbers, tax file numbers and Medicare numbers from the text. Pictures you upload cannot be automatically cleaned, so our check form includes a "Hide my details" tool to black out personal details first. We ask for your agreement to this when you join. A person on our team reviews every answer, and we never tell you something is safe without a person checking it.

The overseas provider may not be subject to the Australian Privacy Principles. By agreeing, you acknowledge that APP 8.1 will not apply to that disclosure. You can withdraw your agreement at any time; if you do, we can still check messages by hand, but more slowly.

Other service providers

We use Supabase (database, login and file storage), Vercel (hosting, Sydney region), Resend (email), and — only if you use them — WhatsApp (Meta) and Stripe (card payments). Breach checks use the free XposedOrNot service (we send your email address); password checks happen entirely on your device.

How long we keep it

• Pictures and the full text of messages you send: deleted after 90 days. Our answer and anonymous totals are kept.
• Messages from people who aren't members: deleted after 7 days.
• If you delete your account, we remove your SteadyCheck information 30 days later.

Family sharing

Family contacts only see what you agree to: a monthly summary (counts and progress) and, if you choose, urgent alerts. They never see your messages or your code word unless you share a specific check. You can stop sharing at any time.

Anonymous statistics

Our public Scam Radar only shows totals that include at least 10 checks, and never shows anyone's messages.

Marketing email

We only send the weekly scam alert email if you ask for it. Every one has a one-click unsubscribe link. Answers, codes and safety alerts are not marketing.

Your rights

You can see, download and correct your information in Settings, and delete your account there too. You can also contact us to ask for access or correction.

Complaints

If you're unhappy with how we've handled your information, please see our complaints page. If we don't resolve it, you can contact the Office of the Australian Information Commissioner (OAIC).