Privacy Policy
Last updated 16 September 2026
Steery stores agent requests, human decisions, and session summaries you choose to create.
What we collect
| Data | Source | Why |
|---|---|---|
| Email address, name, profile picture URL | Google or GitHub, when you sign in | To identify your account and show who answered a request |
| Requests: the title, body, and payload your agent sends | Your agents | To show you the request and record the decision |
| Answers: your decision, any text you write, and the time | You | To return the decision to your agent and keep an audit trail |
| Session and workspace identifiers, API token hashes | Generated by us | To authenticate your agents and your browser session |
| Linked chat identities, message identifiers, encrypted bot credentials and chat signing keys | Telegram or Slack, when you connect | To deliver requests and authenticate replies |
| What you say to the Steery bot in Telegram or Slack before your account is linked | Telegram or Slack | To send it on once you finish the link; deleted when you do, or after one hour |
| Session summaries and sharing state | Your machine's summarizer and you | To serve an unlisted link once you approve the summary, until you revoke it |
| Product analytics: anonymous visits, feature use, outcomes, performance, and masked session recordings in the browser; signed-in activity links to your account ID, name, and email | Your browser, iPhone, and our service | To understand usage and improve the service |
| Usage events and automatic error reports, when enabled | The Steery iPhone app | To understand product use and diagnose problems |
No advertising, contact lists, or repository access. Google and GitHub provide your verified identity; agents choose what request content to send.
PostHog processes product analytics in the European Union. After sign-in, your account ID, name, and email connect your activity across web and iPhone. Session recordings are taken in the browser only and mask all text, form inputs, and images. The iPhone app records no sessions and sends no screenshots. Analytics exclude request content, responses, credentials, signing keys, and linked chat identities. Web analytics honor Do Not Track and remove query strings and fragments from page URLs.
The iPhone app captures screen visits, app lifecycle events, feature use, and crash diagnostics. Signing out resets the analytics identity. Capture is disabled in builds with empty analytics configuration.
Plausible processes page-visit analytics on our website and account pages. We do not pass account profiles, request content, or responses to Plausible.
What your agents send
Requests may contain commands, code, or sensitive data. Connected chat apps receive that content. Connect only accounts you trust.
Sharing a session summary
Before summarizing, your machine asks for a signed answer naming the runner and model that will read the session. It uses that runner's existing sign-in; the selected model provider receives the redacted session text under your account, subject to that provider's terms and possible charges. Steery does not configure or hold those provider credentials for this flow.
The runtime sends Steery the summary, not the transcript file. Known credential patterns and identifying details are redacted before and after the model, but this is not a guarantee that all sensitive information has been removed. The signed answer that lets your machine summarize also publishes the summary at its link.
A published link is unlisted, not access-controlled: anyone who has it can read and copy the summary. Pages ask search engines not to index them and browsers not to cache them, but those requests cannot prevent copies. Revoking a share deletes its stored summary and invalidates its link; it cannot erase copies others already made or data retained by your model provider.
How we store it
Data is stored on servers in the European Union. Transport uses TLS. Steery access tokens are hashed; provider credentials and chat signing keys are encrypted. The iPhone signing key stays on your iPhone. Hosted chat approvals trust your chat account and a Steery-held signing key.
Who we share it with
We do not sell data, advertise with it, or train models on it. Service providers:
- A European cloud hosting provider — server hosting
- Google and GitHub — sign-in, only at the moment you choose to sign in
- Telegram and Slack — requests and replies, only when connected
- PostHog (European Union) — product analytics, signed-in profiles, masked browser session recordings, and iPhone crash diagnostics
- Plausible — website and account-page analytics
We disclose data otherwise only if legally compelled.
How long we keep it
Requests and decisions remain until you delete your account, which you can do yourself in the app at any time. Browser sessions expire after 30 days. Disconnecting stops future chat delivery; it does not erase messages already held by Telegram or Slack, and neither does deleting your account.
Session summaries remain until the share is revoked or the account is deleted. Revocation removes the summary and its public link; the share's status and timestamps remain so you can see that it was withdrawn.
Your choices
- Delete your account in the app: Settings → Delete account on iPhone, or Account → Delete account on the web. It is immediate and permanent: it deletes your sign-in identities, browser and app connections, two-factor enrolment, and every phone and chat account that answers for you. If you are the only person in your workspace, the workspace is deleted too, with its agent keys, requests and the responses recorded on them, sessions, tags, artifacts and published summaries — those links stop resolving at once. Nothing is recoverable afterwards.
- Get a copy of your data: email the address below.
- Revoke agent keys in Agents, and your phones and chat accounts in Signers.
- Revoke our access to your identity provider from your Google or GitHub account settings.
If you are in the EEA or UK, you have the right to access, correct, export, restrict, and erase your personal data, and to complain to your local supervisory authority. Our legal basis for processing is performance of a contract with you, namely providing the service you signed up for.
Children
Steery is a developer tool and is not directed at anyone under 16.
Changes
Material changes update this date and are communicated to affected users.
Contact
Questions and data requests: privacy@steery.dev. Deleting your account does not need us: it is in the app, under Settings on iPhone and Account on the web.