Back

Privacy Policy

Last updated: 2026-10-09

Effective date: September 10, 2026

This Privacy Policy explains how Steele Labs LLC ("Steele", "we", "us", "our") collects, uses, discloses, and protects information when you use our website and messaging/voice services (the "Service").

0. Who the account holder is, and who the data is about

Steele is sold to parents. A parent or legal guardian holds the paying account, and the person the schoolwork information is about is their child. Those are two different roles, and this policy uses them throughout: the parent is the customer, the child is the subject.

An account holder must be at least 18. A child does not hold a Steele account of their own: a child does not sign up, does not sign in, and is not contacted by the Service. A parent adds a child to the parent's own account by name, and what Steele records about that child sits on the parent's account, where the parent can review it, correct it, or ask us to delete it. Section 10 says more about how we treat a child's information.

One thing worth being exact about, because it is easy to assume otherwise: Steele cannot reach a child's Google account on its own. We never ask for and never receive a student's password, and the Classroom permissions we use only ever return the signed-in person's own coursework. School data reaches a parent's account only after that access has been granted at Google's own consent screen, by signing in to the account that holds the schoolwork, which Steele asks to be the child's school account. It stops when the access is disconnected or the child is removed from the account.

1. Contact

If you have questions about this Privacy Policy, contact us at support@steelelabs.co.

2. What we collect

We collect information you provide directly, information generated by your use of the Service, and information from integrated services you connect.

2.1 Information you provide

  • Contact details: such as your phone number and/or email address.
  • Profile details: the name you share with Steele and, where you provide them, your age, grade, and school. Age is used to apply the protections required for minors.
  • Payment information: payments are processed by Stripe. We receive your subscription status and billing metadata; we never receive or store your full card number.
  • Message content: the text you send us, and any replies we send back.
  • Voice content: audio you send or stream to us, and transcriptions derived from that audio.
  • Support requests: information you include when you contact support.
  • Messaging consent records: if you choose Text me schoolwork updates after verifying your phone, we record that you did, when, which wording you were shown, the page you were on, and the IP address and browser that submitted it. Asking for or entering a sign-in code does not create this record. That record is the proof that we had your permission, so we keep it even if you later opt out.

Please do not submit sensitive personal information the Service does not ask for, such as Social Security numbers, government ID numbers, financial account credentials, or medical records.

2.2 Information collected automatically

  • Usage data: pages viewed, features used, timestamps, and interaction patterns.
  • Device and network data: IP address, browser type, device identifiers, and operating system.
  • Log data: diagnostics and error logs to keep the Service reliable and secure.

2.3 Information from integrations (Google)

If you connect a Google account, we receive access tokens and basic account information (such as your email address) as authorized by you, and we request only the access needed for the features you use:

  • Classroom(read-only: classroom.courses.readonly, classroom.coursework.me.readonly, classroom.student-submissions.me.readonly): see your classes and your own coursework, due dates, submission state, and grades, to track deadlines and build study help. Steele cannot see another student's work, and cannot submit or change yours.
  • Calendar (read-only: calendar.events.readonly): read the events on the connected parent and/or student Google account to show that schedule. This school connection cannot create, edit, or delete calendar events.
  • Family calendar sync (write, optional: calendar.app.created): if you turn on family calendar sync, Steele creates its own calendar, named Steele Family, on the parent's Google account, and keeps your children's schoolwork due dates and school events on it. Steele cannot read, change, or delete any of your other calendars or events with this permission. This is a separate, optional connection that you grant on its own: the school connection above never carries it. Turning sync off or disconnecting removes the events Steele put there and stops further updates, and you can delete the Steele Family calendar yourself at any time.

The first four are the school connection and are read-only. Family calendar sync is the only write, it is off until you turn it on, and it reaches nothing but the calendar Steele made. Steele does not request Gmail, Drive, or Google Docs access. If you connected Google before September 10, 2026 your account may still hold a wider grant, including Gmail; you can remove it by disconnecting Google in your dashboard or at myaccount.google.com/permissions.

The full list, scope by scope, with the reason Steele asks for each one, is at Steele and your Google account.

Limited Use.Steele's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described above; we do not sell or transfer it; we do not use it for advertising; and humans do not read it except with your consent, for security or to debug an issue you report, to comply with law, or in aggregated or anonymized form.

Calendar links you paste.You can paste a school, team or class calendar address (an iCal or .ics link) for a child. We treat that link as private and use it only to read that calendar. Steele fetches the address on a schedule and reads the events on it, which become part of that child's school calendar in Steele. The address is stored encrypted and is not shown again in full or shared; you can remove it at any time, which stops the reads. Only https addresses are accepted. Fetching it is a request to whoever publishes that calendar, so their own terms and logs apply.

The subscription link Steele gives you. Separately, Steele can give you a private link to subscribe to from your own calendar app. Anyone with that link can read the school schedule it covers. Replacing or revoking the link stops future access through the old URL, but calendar apps may retain previously downloaded events.

What that commitment means scope by scope, and what Steele will never do with Google data under any circumstances, is written out at Limited Use.

2.4 Information from integrations (Apple Health)

Apple Health is optional and off until you turn it on. It is granted on the iPhone, by iOS, in the Steele app: no website can request it, so the Health row on your dashboard opens the app rather than asking you here. If you allow it, the app reads a daily summary on your device and sends those summary numbers to us. It reads categories you allow, which may include:

  • Activity: steps, walking, running and cycling distance, flights climbed, active and resting energy, exercise and stand minutes, and time in daylight.
  • Heart and respiratory: heart rate, resting and walking heart rate, heart rate variability, VO2 max, blood oxygen, and respiratory rate.
  • Sleep and mindfulness: hours asleep and mindful minutes.
  • Body and vitals: weight, height, BMI, body fat, lean mass, waist, body temperature, blood pressure, and blood glucose.
  • Nutrition: calories, water, protein, carbohydrates, fat, sugar, fiber, and caffeine.
  • Mobility and audio: walking speed, step length, gait asymmetry, six-minute walk distance, and headphone and environmental audio exposure.
  • Workouts and basics: recent workouts, and characteristics such as age, biological sex, blood type, wheelchair use, and skin type.

What we do not read. We do not read clinical health records, we never write anything back to Apple Health, and we do not read it in the background: the app sends a summary only while you have it open. We do not use it for advertising, we do not sell it, and we do not use it to develop or train Steele as a product.

Where it goes. We use it to answer you when you ask, and to make your daily brief and check-ins fit the day you are actually having. To do that, the summary is sent to the AI provider that generates that response, under the same terms as the rest of your message content: those calls are routed through OpenRouter to the AI model that answers that request, as described in Section 5. Apple Health cannot tell us that you declined a category rather than having no data in it, so Steele treats every number as approximate and does not give medical advice or diagnoses.

Turning it off. Disconnect Apple Health from the Health section of your dashboard settings, or from the Health screen in the app. Either one deletes the stored summary. To withdraw the iOS permission itself, open the Settings app on your iPhone and go to Privacy and Security, then Health. Deleting your account deletes the summary with it.

3. How we use information

  • To provide, operate, and maintain the Service.
  • To respond to your requests and messages.
  • To authenticate you (including sending one-time passcodes, where applicable).
  • To personalize your experience and keep context (preferences, history, and settings).
  • To operate, debug, and monitor Steele's own systems (reliability, security, and performance). This does not include using information received from Google APIs to develop, improve, or train Steele as a product. Google user data is used only to provide the user-facing features listed in the Google integrations section.
  • To prevent fraud, abuse, and security incidents.
  • To comply with legal obligations and enforce our terms.

4. SMS/MMS & voice communications

If you opt in to receive SMS/MMS messages, we may use your phone number and message content to communicate with you, including sending verification messages, service notifications, and replies to your messages. Message frequency varies. Message and data rates may apply.

You can opt out of SMS/MMS at any time by replying STOP. For help, reply HELP or contact us at support@steelelabs.co.

5. How we share information

We do not sell your personal information. We may share information in the following circumstances:

  • Service providers: with vendors who help us run the Service (hosting, databases, analytics, communications, security). They are permitted to process data only for our instructions.
  • Messaging and telecom providers: to deliver SMS/MMS or voice services (for example, Twilio and carriers), which may process message metadata and content as needed to deliver communications.
  • Integrations you enable: when you connect third-party services, data may be exchanged with those services per your authorization.
  • Legal and safety: if required by law, subpoena, court order, or to protect rights, safety, and security of users and the Service.
  • Business transfers: if we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction.

When you connect Google, information received from Google APIs is processed on our behalf by:

  • Fly.io: application hosting.
  • Supabase: database.
  • OpenRouter: every AI request we make goes through OpenRouter, which passes it to the AI model that answers that request (for example, a model from OpenAI, Anthropic, or Google). We do not send your content to any AI company directly. Which model answers a given request can change.

Every AI request we send through OpenRouter is set to exclude providers that collect or train on the data, so the AI models that answer you may not use your data or your child's data to train their models.

They are permitted to process that information only on our instructions, to provide the user-facing feature you asked for in that request.

6. Cookies and similar technologies

Steele sets two first-party cookies, one to keep you signed in and one to count how many visitors become users, and loads no third-party analytics, advertising or tracking script at all. Each one, what it holds and how long it lasts is in the Cookie Notice. You can also block cookies in your browser, though blocking the sign-in cookie will keep you signed out.

7. Data retention

We retain information for as long as reasonably necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary depending on the type of data and how it is used. You can disconnect Google at any time from your dashboard, which revokes Steele's access, and you (or your parent or legal guardian) can request deletion of your account and Google-derived data by contacting us; we delete it within 30 days except where retention is required by law. Apple Health is held differently and briefly: we keep only the most recent daily summary, each one replaces the last, Steele stops using a summary once it is more than 36 hours old, and disconnecting deletes it immediately.

Deletion happens in two stages, in this order. We delete from the live Service first, on the timeline above. Deleting there does not instantly remove the record from our encrypted backups, which are held on a rotating schedule, so it is purged from those within 30 days after the live deletion. That second window runs from the live deletion rather than from your request. Nothing is restored from a backup into the live Service after a deletion request except to recover from an incident, and we re-apply the deletion if it is.

8. Security

We use reasonable administrative, technical, and physical safeguards designed to protect information. However, no method of transmission or storage is 100% secure.

9. Your choices & rights

  • Opt out of SMS: reply STOP.
  • Access/updates: you may request access to or correction of certain information.
  • Deletion: you may request deletion of certain information, subject to legal requirements.

To make a request, email support@steelelabs.co.

10. Children's privacy

Steele is built for parents, and the account holder is always the parent or legal guardian. A child does not create an account, does not sign in, and is not contacted by the Service. The parent is the account owner and may review, change, or request deletion of everything on the account, including anything they have recorded about a child, at any time by contacting us. The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13 without the consent required by law, we will delete it.

11. International users

If you access the Service from outside the United States, you understand that information may be processed in the United States and other countries where our providers operate.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date will reflect the most recent changes. Where a change is material, we will say so in the product or by email or text before it takes effect.

13. Who to contact

The controller of this information, and the company behind Steele, is:

Steele Labs LLC, a Wyoming limited liability company
EIN 42-3465149
Mailing address: 32 West Way, Old Greenwich, CT 06870
support@steelelabs.co