Privacy

Steady Days — Privacy Policy

This site sells one digital guide, and it is built to know as little about you as that allows. This policy says exactly what we collect, who else touches it, where it is stored and what you can ask us to do about it. It covers our own systems; the page you are sent to in order to pay is hosted and operated by our payment provider, and what happens there is governed by their policy as well as this one.

Last updated: 5 November 2026. Questions: support@steadydays.store.

1. What we collect

When you buy. The checkout page belongs to Dodo Payments, which is the merchant of record for this guide. On that page you give them your name, your email address and your billing address, together with your card or wallet details. Your card number, expiry date and security code are entered into their payment interface and never pass through anything we wrote: what reaches us afterwards is the last four digits, the card network, the expiry month and year and the issuing country, because those arrive inside Dodo’s own payment notification.

What our order record holds. For each payment we keep one row in our own database: Dodo’s payment identifier, the payment status and the type and time of the newest event we received, your email address, your name, your billing country, the amount, the currency, the tax and settlement amounts, which product was bought, the payment method, and the notification itself as it arrived. That stored notification also contains the street, city, state and postcode you typed at checkout, the card details listed above, and Dodo’s own identifiers for you, your invoice and your checkout session.

How you found the buy button. We note which button on this page sent you to checkout, and if the link you arrived on carried a referral or campaign tag in its address, we keep that tag alongside the order. A referral tag is the one part of this we put in your browser: an address carrying ?ref= is saved in that browser’s local storage for 30 days, so the person who sent you still gets credit if you keep reading first and buy from another page. A newer referral tag replaces an older one, so the last link you arrived on is the one credited. Nothing else about your visit is stored on your device, the tag expires on its own, and clearing this site’s browser data removes it sooner. Campaign tags — the utm_ values marketing tools add to a link — are never saved; they are read from the address at the moment you click.

What we do not collect. This website sets no cookies, runs no analytics, advertising or tracking scripts of any kind, and keeps nothing on your device beyond the 30-day referral tag described above. There is no account, no login and no newsletter sign-up. The free Chapter 1 sample is given without an email address — we do not ask for one, so we do not get one. The replacement request page has no backend: it composes a complete message in your own email app and you send it, which means your answers are not submitted to or stored by this site.

2. The other parties your data passes through

Dodo Payments (dodopayments.com) — takes the payment, issues the receipt and invoice, emails the buyer the link that leads to the files, and keeps its own records of the transaction under its own legal obligations. Their checkout page also loads payment and fraud-prevention components from Stripe, Airwallex and Google Pay; we observed those on the page and do not control what they collect there.

Supabase (supabase.com) — hosts the database that holds our order records and runs the two small server functions behind checkout: the one that opens a payment session and the one that receives Dodo’s notification. Our project is in their Sydney, Australia region.

Google Fonts — this page loads its typefaces from fonts.googleapis.com and fonts.gstatic.com. That request comes from your browser, so Google sees your IP address and some information about your device as part of serving the fonts. It happens on a plain visit, before any purchase.

Your email provider — your receipt, the link to the two files and any replacement correspondence arrive by email, so your provider holds copies of what Dodo sent you.

We do not sell your personal data, we do not share it for advertising, and we do not hand it to data brokers. Beyond the parties above, we disclose it only where we are required to by law or to defend a payment dispute.

3. Why we keep it

One thing only: to be able to prove and support a purchase. The redirect back to this site after payment proves nothing on its own, so the notification we receive from Dodo is the sole thing we treat as evidence that you bought the guide. That record is what lets us send a replacement file, answer a “nothing arrived” question, resolve a chargeback, and keep accounting that stands up.

4. Where it sits, and who can read it

The orders table is deliberately unreachable from the website. Row-level security is enabled with no access policies and every public permission revoked, so neither a visitor’s browser nor an anonymous API call can read a single row. Two things touch it: the notification function, which writes with a server-only key, and us, through the hosting dashboard.

Payment and database secrets live in server configuration and are never part of the code the page downloads; we check the built bundle for that before every deploy. Traffic between your browser, our functions and Dodo is HTTPS. No website can promise absolute security, so we do not make that claim — we describe the controls instead of guaranteeing an outcome.

Two operational notes that follow from the above. When our notification function rejects a request whose signature does not verify, it records the requesting address from the incoming headers, because a rejected request is a security event. And delivery is not a file attachment: the emailed receipt points at a Dodo download page. The link in that receipt carried a session token we measured expiring exactly 30 days after the payment, and the file addresses that page generates expire within minutes. So the copy a buyer downloads and saves is the copy that lasts.

5. How long we keep it

We do not run an automatic deletion schedule on order records. They stay while we operate this store, because a file may need replacing long after the sale and because receipt and tax records outlive the transaction. Ask us to remove yours and we will delete the row we hold; some of the same information necessarily remains in Dodo’s records and in our hosting provider’s logs, which are theirs to retain and to delete.

6. Your rights and choices

Where the law where you live gives you rights of access, correction, deletion, restriction, transfer, or objection to processing, or the right to withdraw a consent, we will honour them — and we will verify it is you before acting. Write to support@steadydays.store and say what you want. Because we do not process your data for marketing or profiling, there is no such consent for you to withdraw that would change what we can do for you.

You can also lodge a complaint with the data protection authority in your country. If you would rather do that than write to us, that is your right and not a discourtesy.

Children. This site is written for parents and caregivers and is not directed at children. We do not knowingly collect personal data from children; if you tell us a child’s details have reached us, we will remove them.

7. If this policy changes

We will update this page and the date at the top. The version in effect at the time you buy is the one that applies to that purchase.

Contact: support@steadydays.store. Related pages: our Terms, License, Replacement Policy and Sample Policy.