Privacy Policy
Last updated: October 13, 2026
SteadyLink makes short links that say where they go and keep working. This page says, in plain words, what we collect, who sees it, and how long we keep it.
SteadyLink is a product of 2morrow.ai, LLC, a Colorado limited liability company ("we"). Our address: 2morrow.ai, LLC, 2730 S Wadsworth Blvd Ste B #1013, Denver, CO 80227, United States. Questions: support@steadylink.app.
The short version
- We collect your email address to sign you in. There are no passwords. We send you a link or a code.
- When someone clicks a SteadyLink link, our redirect does not store their IP address or browser details.
- Every target address is checked before its link goes live.
- We don't sell your data. We show no ads.
What we collect
Your account. Your email address. When you sign in, we record the event: the time, whether it worked, and keyed hashes of the address you came from and of your browser's description (user agent). We store no raw IP address and no raw user agent.
Your links and targets. Your name, your account name, the names you give links (the words), the addresses they lead to with the checks' results, notes you add, and the email addresses of your team members.
Checks on targets. Before a link goes live, we:
- look up the address with Google Web Risk, which tells us whether Google lists it as unsafe;
- check for look-alike names and how old the domain is (we ask the public RDAP service at rdap.org, which sees the domain name);
- check that the page can be reached publicly. This means our system fetches the page, from Cloudflare's systems.
Reasons for a refusal are shown to you in plain words. We do not explain how our checks work.
Visits. We count visits. A visit record holds the link, the time, the website the visitor came from (host only), the country, a broad device type, and a one-way code that changes every day and whose daily key is destroyed within 48 hours. We never store the visitor's IP address or browser details.
Visitor pages. Our visitor pages set no cookies and store nothing on the visitor's device. Cloudflare handles the request at its edge and may keep short-lived logs under its own privacy policy.
Reports. Anyone can report a link without an account. A report holds the link, the reason, the text they write, and the time. It may also hold an email address if they choose to give one. We use that email only to tell them what happened. It is stored encrypted. We also keep a one-way code of the source address that changes every day, and a broad class of browser, to stop floods of reports.
Payments. Stripe processes payments for paid plans. We don't store your full card number. We keep your Stripe customer and subscription ids, your plan, billing interval, status and period dates. Invoices and payment details stay with Stripe.
Waitlist. If you join the waitlist, we keep your email address and the date you joined, to tell you about your place and the beta. The waitlist is held in our own database.
Archive copies. Copies of pages made by third parties are never shown publicly.
Feedback. You can send feedback by email or in a form in the app. We keep what you write and your email address.
Who handles your data
| Service | What it does | What it handles |
|---|---|---|
| Supabase | Database and sign-in | Account, links, targets, reports, login events |
| Cloudflare | Redirects; bot check (Turnstile) on sign-in and on the report page; page fetching | Link records, requests in transit, the bot-check signal |
| Vercel | Hosts the SteadyLink app | Pages and requests to the app |
| Amazon SES | Sends our emails | Your email address and the message |
| Google Web Risk | Safety list lookup | Target addresses |
| Stripe | Payments for paid plans | Payment details, billing email |
| RDAP lookup (rdap.org) | Domain age | Domain names |
| Google Gemini (only if the page-description feature is on) | A short description of a page | The page's public text |
If the page-description feature is on, the page's public text is sent to Google Gemini to write a short description. Google's paid tier does not train on it. It is never used to decide whether a page is safe.
We use these services only to run SteadyLink. They all run in the United States: our database and app hosting are in the U.S., email goes through Amazon SES in us-east-2, and Stripe and Cloudflare (on its worldwide edge) handle payments and redirects.
We may also disclose data when the law requires it or to protect people from harm.
How long we keep things
| What | How long |
|---|---|
| Account and links | Until you delete your account |
| Login events | 90 days |
| Daily visitor code | Its daily key is destroyed within 48 hours |
| Reports and decisions | 2 years after the report is closed |
| Reporter emails | Deleted 90 days after the report is closed |
| Email delivery records, including a record that an address bounced or complained | 1 year. The exception is a bounce or complaint: we keep it as a one-way fingerprint of the address for as long as the address stays suppressed |
| Payment records | 7 years (tax law) |
| Approved "this is my real address" fingerprints | 30 days |
| Waitlist | Until you are admitted, or 30 days after the beta ends |
| Records the law requires us to keep | As long as the law requires |
Your choices and rights
- Delete your account and data. During the beta, email support@steadylink.app from the address you signed in with. We do it within 30 days.
- See, correct or take a copy of your data. Email the same address.
- Stop emails. Notices about your account and links are part of the service. The monthly "all your links are fine" note can be switched off, and alerts can be turned off for an account. Feedback and waitlist emails have an unsubscribe link or stop when you leave the beta.
- Depending on where you live, you may have more rights: to see, correct, move or delete your data, or to object to how we use it. We do not sell personal data. We do not use it for targeted advertising. You may complain to your data protection authority. If you are in Colorado, you may also appeal a decision on your request by writing to us. To use any of these rights, email support@steadylink.app.
Security
We use encryption in transit. Sensitive items, such as reporter emails and visitor emails, are stored with envelope encryption: each item has its own key, sealed by a master key. No method is 100% secure.
Where data goes
We are in the United States, and your data is processed in the United States. If you use SteadyLink from elsewhere, your data goes to the United States.
Children
SteadyLink isn't meant for children, and you must be 18 to have an account. We don't knowingly collect their data. If you think a child has given us data, email support@steadylink.app and we will delete it.
Changes
If we change this policy in a way that matters, we post the new version on this page with a date, and email signed-up users before it takes effect.
Contact
2morrow.ai, LLC, 2730 S Wadsworth Blvd Ste B #1013, Denver, CO 80227, United States. Email: support@steadylink.app.