Cookie Policy

1. Introduction

This Cookie Policy explains how Stead uses cookies and similar tracking technologies when you access and use our application. We are committed to transparency about our data practices.

Key principle: We use a single essential cookie and no third-party cookies. We do use privacy-first product analytics to improve the app, but it stores its data in your browser's local storage (not cookies), carries no personal information, and can be switched off. We never use advertising or cross-site tracking. Our approach prioritises privacy and security.

2. What Are Cookies?

Cookies are small text files stored on your device (computer, phone, or tablet) when you visit a website or use an application. They are typically used to store information about your preferences, login status, or browsing history.

Other similar technologies include:

• Local storage: Browser-based storage for UI preferences, more persistent than cookies.
• Session storage: Temporary storage cleared when the browser session ends.
• Web beacons: Invisible pixels used to track user behaviour (we do not use these).

3. Cookies We Use

4. Local Storage

We may use browser local storage to store non-sensitive user preferences:

• Dark Mode Preference: If you toggle dark mode, your preference is saved locally so the app renders in your chosen theme on your next visit.
• UI State: Some UI state (e.g. sidebar expanded/collapsed) may be stored locally for convenience.
• Analytics identifier: Our product analytics (PostHog) stores a random, non-identifying analytics id in local storage instead of a cookie, so your usage can be understood across visits without cross-site tracking. It contains no personal information and is removed if you turn analytics off in Settings → Privacy. On our public pages it is only ever stored if you have said yes — decline, and nothing is written there at all.

Important: Your preference local storage (dark mode, UI state) stays on your device and is never sent to us. The analytics identifier is shared only with our analytics processor (PostHog, EU) as part of anonymised usage events, and only while analytics is enabled. You can clear local storage at any time via your browser settings without affecting the Service.

5. Third-Party Cookies and Tracking

We do NOT use:

• Advertising, retargeting, or cross-site tracking pixels.
• Facebook Pixel or any ad-network tags.
• Third-party marketing or data-broker cookies.
• Third-party cookies of any kind. We set exactly two cookies, both first-party and both described above: the authentication cookie that keeps you signed in, and — if you have answered the question on our public pages — the one recording that answer.

We do use privacy-first product analytics (PostHog) to understand how the app is used and improve it. This is not advertising: it stores a random, non-identifying id in your browser's local storage (not a cookie) and carries no personal information. On our public pages we ask before it runs at all; inside the app, where you have an account, it is on by default and can be turned off at Settings → Privacy. Either way we honour your browser's “Do Not Track” and Global Privacy Control signals. See Section 6 for details.

We do not sell, trade, or share your data with advertisers or data brokers. Your financial data stays private and is not used for profiling or marketing.

6. Error Monitoring & Product Analytics

We use Sentry to collect error reports and crash data. In our configuration Sentry does not set cookies — error reports are sent only when the application encounters an error. This data is:

• Limited to technical error diagnostics, not user behaviour tracking.
• Configured to exclude sensitive data (passwords, tokens, email addresses).
• Governed by Sentry's privacy policy: https://sentry.io/privacy/

We use PostHog (hosted in the European Union) for privacy-first product analytics — understanding which features are used and where people get stuck, so we can improve the app. It is configured to be as private as possible:

• No cookies — it stores a random, non-identifying id in your browser's local storage.
• No personal information in events — never your name, email, transactions, or amounts; page addresses are stripped of identifiers before recording.
• Session recording and automatic page-content capture are switched off.
• Analytics requests are sent to our own subdomain (e.steadapp.com.au) instead of directly to PostHog, so privacy/ad-blocking tools don't silently drop them. This is transport only — it collects nothing extra; in transit the requests pass through Cloudflare (PostHog's content-delivery network) before reaching PostHog in the EU.
• On our public pages we ask first. Until you answer, PostHog is not loaded, nothing is requested from it and nothing is stored in your browser. If you say no, the same remains true, and we keep only the note that you said no. You do not need an account to make or change that choice.
• One thing is counted either way — and it is not about you. We keep a running total of how many times each public page was opened, per day, together with a single word for roughly how people arrived: whether they came from a search engine, from social media, from another of our own pages, straight to us, or from somewhere else. That is all it is: a date, which page, one of those five words, and a number.
• We deliberately do not record which site you came from — only which of those five kinds it was, and that is worked out inside your own browser, so the address of the page you came from is never sent to us at all. Five words shared by everyone who arrives the same way cannot point at a person, which is why there is nothing in this to ask permission for and nothing in it to opt out of. We keep it because otherwise we would only know how many people who agreed to analytics visited, which tells us very little about how many people we actually reached.
• If you accept and later create an account, the visit that brought you here can be joined to that account, so we can tell how many people who read about Stead went on to sign up. That joining is the reason we ask, and it only ever happens for someone who said yes.
• Inside the app you can opt out at any time at Settings → Privacy, and everywhere we honour your browser's “Do Not Track” and Global Privacy Control signals — if either is switched on we do not ask and do not load analytics at all. All of these stop analytics entirely, before anything is sent to that subdomain: PostHog is not loaded in your browser, so nothing is requested from it and nothing is stored in your local storage.
• One thing is recorded even with analytics off: the fact and time that you changed this setting, and nothing else. It is how we can show we honoured your choice, and it keeps a deliberate opt-out from being read as an account that simply went quiet. See the Privacy Policy for detail.
• Governed by PostHog's privacy policy: https://posthog.com/privacy

7. How to Manage Cookies

Browser Settings: You can control cookies via your browser settings. Most browsers allow you to:

• Block all cookies (note: this will prevent you from logging into Stead).
• Delete existing cookies.
• Block cookies from specific sites.
• Set privacy preferences (e.g. block third-party cookies only).

See your browser's help section for instructions. Browsers commonly include options for Chrome, Firefox, Safari, Edge, and others.

Important: The authentication cookie is essential to the Service. If you disable it, you will not be able to log in or use Stead.

8. Cookie Consent and GDPR Compliance

EU Users: Under the General Data Protection Regulation (GDPR) and the ePrivacy rules, consent is generally required before storing non-essential information on your device. Our only cookie is the essential authentication cookie, which is set without consent as it is strictly necessary to provide the Service.

Our product analytics does not use cookies — it stores a random, non-identifying id in local storage. We operate it on a privacy-first, opt-out basis: it is limited to anonymised product-improvement data with no personal information, you can turn it off at any time at Settings → Privacy, and we honour your browser's “Do Not Track” signal (which disables it automatically). We do not use it for advertising or any third-party purpose.

If you are an EU resident and have concerns about cookies or data processing, see our Privacy Policy for information on your rights and our contact details.

9. Data Retention

Cookies: The authentication cookie expires after 24 hours. When you log out, the cookie is deleted immediately.

Local Storage: Local storage persists until you manually clear it via browser settings or until you uninstall the app (on mobile).

10. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in our technology or practices. We will update the "last updated" date at the top of this policy. Significant changes will be communicated via email or a prominent notice on the Service.

11. Contact

If you have questions about our cookie practices or wish to exercise your privacy rights, please contact us:

Email: support@steadapp.com.au