Lean & Steady is operated by 854 Labs LLC, an Indiana limited liability company ("854 Labs," "we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and protect information when you visit leansteady.com or use the Lean & Steady iPhone app (together, the "Service").
Lean & Steady is available in the United States at launch and is intended only for people who are 18 or older.
1. Information We Collect
Account and contact information
When you create or use an account, we collect your email address, account identifier, and account status. If you choose Sign in with Apple, we receive the identifier and email address Apple provides, which may be an Apple private-relay address.
Plan, wellness, and app information
We collect the information you choose to enter or generate through the Service, including your plan inputs and targets; weight records; meal records; calorie and protein information; workout, rest-day, daily, and weekly check-ins; weekly reviews; notes; and time-zone information. This information can be personal and may be sensitive under some laws. Lean & Steady is not a medical service and does not create a medical record.
Photos and AI meal analysis
You may choose to upload a food photo or nutrition-label photo. We store the photo privately and send that food or nutrition-label photo to OpenAI to generate a meal or nutrition estimate. We also store the resulting estimate and related processing information in your account.
You may separately choose to upload private progress or check-in photos. These photos remain private in the Service. We do not send progress or check-in photos to OpenAI, use them for facial analysis, rate appearance or attractiveness, or perform automated body scoring.
HealthKit data
If you grant permission, we collect step-count data from Apple HealthKit. We do not request calories burned, workouts, weight, body measurements, sleep, or heart-rate data from HealthKit.
Subscription information
Apple processes iOS subscription purchases. We do not receive your full payment-card number. We receive subscription, purchase, and entitlement information from Apple and RevenueCat so that we can provide and manage your access to the paid Service.
Communications and support information
We collect the content of communications you send us and information about service emails, such as email delivery status, to provide support, security, and account communications.
Technical and operational information
We collect information needed to operate and secure the Service, such as device and operating-system information, app version, IP address, request and error logs, authentication events, and minimal first-party product events. Our website stores your chosen color-theme preference in your browser. We do not use advertising pixels, cross-app tracking, or website analytics cookies at launch.
2. How We Collect Information
We collect information directly from you when you create an account, enter information, upload a photo, use HealthKit features, purchase a subscription, or contact us. We collect technical and operational information automatically when you use the Service. We also receive limited information from Apple, RevenueCat, and our service providers to authenticate you, provide subscriptions, deliver email, and secure the Service.
3. How We Use Information
We use information to:
- provide, maintain, and personalize Lean & Steady;
- authenticate your account and synchronize your information;
- analyze food and nutrition-label photos when you ask us to do so;
- calculate and display your plan, logging, review, and subscription experience;
- deliver email OTP, login, security, account, trial-expiration, subscription, user-requested reminder, and material legal or privacy notices;
- troubleshoot, secure, monitor, and improve the Service;
- comply with legal obligations and resolve disputes; and
- protect the rights, safety, and property of 854 Labs, users, and others.
We do not use your information for behavioral advertising. We do not sell personal information or share it for cross-context behavioral advertising.
4. Our Basis for Processing
Where a privacy law requires a legal basis, we process information to provide the Service and perform our agreement with you; with your permission, such as for HealthKit access and optional photo uploads; to meet legal obligations; and for our legitimate interests in operating, securing, and improving the Service. You can withdraw a permission in iPhone settings or by stopping use of the related optional feature, although this may limit that feature.
5. How We Share Information
We share information only as described below:
- Supabase. We use Supabase for authentication, database, server functions, and private photo storage.
- OpenAI. We send only the food and nutrition-label photos you choose to submit for AI meal analysis, along with the information needed to process that request. We do not send progress or check-in photos to OpenAI.
- Apple. Apple provides Sign in with Apple, HealthKit when you authorize it, the App Store, and iOS subscription processing.
- RevenueCat. We use RevenueCat to manage subscription and entitlement information.
- Resend. We use Resend to deliver transactional and service-related emails.
- Cloudflare. We use Cloudflare for domain and public website delivery services.
- Legal and safety recipients. We may disclose information when reasonably necessary to comply with law, respond to lawful requests, protect rights or safety, enforce our terms, or address fraud or security issues.
- Business transfers. If 854 Labs is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to applicable law.
Our service providers may process information only to provide services to us and under their applicable terms and data-processing commitments.
6. United States and International Processing
Lean & Steady is offered in the United States at launch. 854 Labs and its principal service providers operate from or process data in the United States. Information may be processed outside your state or jurisdiction. If we later make the Service available outside the United States, we will update this Policy and take any steps required by applicable law before doing so.
7. Data Retention and Deletion
We retain account information and user-owned content while your account is active, unless a shorter period is stated below or you request deletion.
- If you delete your account in the app, we remove your account and user-owned information from active systems promptly.
- We delete stored progress and check-in photos promptly as part of account deletion. If you discard or delete a meal photo, we begin deletion promptly. Unattached draft meal photos are scheduled to expire after seven days.
- Limited residual copies may remain in backups and operational or security logs for up to 30 days before automatic deletion or overwrite.
- We may retain information for longer when required for accounting, fraud prevention, disputes, legal compliance, or to establish, exercise, or defend legal claims. Apple, RevenueCat, OpenAI, and other providers may retain information under their own applicable policies and legal obligations.
Deleting the app from your device does not delete your account. Use the in-app account-deletion control or contact support if you cannot access it.
8. Your Privacy Choices and Rights
You can access, correct, or delete much of your account information in the app. You may also ask us to access, correct, delete, or provide a portable copy of your personal information, or to limit or object to certain processing where applicable law provides that right.
To make a privacy request, email privacy@leansteady.com. We may need to verify your identity before completing a request. If we deny a request, you may ask us to review that decision by emailing legal@leansteady.com. We will not discriminate against you for exercising applicable privacy rights.
We do not sell personal information, share personal information for cross-context behavioral advertising, or process personal information for targeted advertising. We do not use automated decision-making that produces legal or similarly significant effects about you.
9. Cookies, Local Storage, and Tracking
At launch, leansteady.com does not use analytics cookies, advertising cookies, advertising pixels, or cross-app tracking. The website uses browser local storage to remember your color-theme preference. Our providers may collect information necessary for security, delivery, fraud prevention, or operation of their services. You can control local storage and cookies through your browser settings, but doing so may affect site preferences or functionality.
10. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect information, including authenticated access controls and private, owner-scoped storage for photos. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe you have found a security issue, contact security@leansteady.com.
11. Children's Privacy
Lean & Steady is intended only for individuals who are at least 18 years old. We do not knowingly permit anyone under 18 to create an account or use the Service. If you believe a person under 18 has provided information to us, contact privacy@leansteady.com, and we will take appropriate steps to delete it.
12. Third-Party Services
The Service may link to or rely on third-party services, including Apple. Their privacy practices are governed by their own policies. We are not responsible for third-party privacy practices outside the services they perform for us.
13. Changes to This Policy
We may update this Policy to reflect changes to the Service, law, or our practices. If a change is material, we will provide notice through the Service, by email, or by another reasonable method before it takes effect when required by law. The "Effective date" above shows when this Policy was last updated.
14. Contact Us
Lean & Steady is operated by 854 Labs LLC, an Indiana limited liability company.
For privacy requests: privacy@leansteady.com
For account support: support@leansteady.com
For security reports: security@leansteady.com
For legal notices: legal@leansteady.com
You may also write to:
854 Labs LLC
c/o Northwest Registered Agent LLC
5534 Saint Joe Road
Fort Wayne, IN 46835
United States
15. Additional United States Disclosures
This Policy is designed for a United States launch. Some U.S. state privacy laws provide additional rights, including rights to know, access, correct, delete, obtain a portable copy, opt out of certain processing, and appeal a decision about a request. We honor applicable rights through the process in Section 8. We do not sell personal information or use it for targeted advertising.