Steady: information pack for services

Steady keeps everything on the client's own phone or computer. There's no account, no server, no analytics and no tracking. Steady doesn't send client data to us, or to you.

01What Steady is

Intended purpose: Steady is a self-help tool for adults (18 and over) in recovery from alcohol or drugs, for tracking and reflection. People use it to count their days without using (called clean, sober or substance-free, as they choose), log uses and urges, keep morning and evening routines, write a plan for hard moments, work through the Twelve Steps or self-management worksheets, note appointments, and reach helplines.

It supports recovery. It isn't treatment or medical advice, and it isn't a replacement for professional support. It doesn't diagnose, treat, cure or prevent any condition, and it gives no dosing or tapering advice.

Realistic, not perfect. A slip is information, not a verdict. Total days never go down, and milestones stay once reached. There's no "streak broken" screen.
Works offline. No internet connection is needed.
Where it runs: Android, and Windows computers. It's coming soon to Google Play. iPhone is planned.
Not affiliated with Alcoholics Anonymous, Narcotics Anonymous or SMART Recovery. Copies given out don't include AA or NA literature.

02Where the data goes

Everything the client enters stays in Steady's own storage on their device: what they track, uses, urges and check-ins (with any mood and cravings), notes, routines, Step work, worksheets, their plan for hard moments, the people and appointments they add, and settings.
Nothing is sent anywhere. The app has no server to send to. The Windows app blocks every outside connection, and a test checks it makes none.
The client chooses when anything leaves the device: a backup file they save, a progress summary they print or share, a calendar entry they add, or a call or website they open. A summary holds only what they choose to put on it, and never their notes.
Reminders are set on the device. They only say "Morning routine", "Evening routine" or "Appointment", never what or where, so nothing private shows on a lock screen.
Deleting: Settings > Delete everything removes it all, including safety copies. On a phone, uninstalling the app deletes it too. On Windows, records stay in the person's profile after uninstalling, so a reinstall keeps them, until they choose Delete everything.

03Data protection

Our understanding, for your data protection officer to confirm. We don't receive, store or have access to any client's records. Your service doesn't receive them through Steady either. So:

Neither Lightkeeper Studio nor your service processes clients' records through Steady. The client holds them, on their own device.
There's no data processing agreement to sign for the app itself, because there's no processing on your behalf.
A subject access request to us or to you can't include Steady records, because neither of us holds any.
If you recommend Steady, note it in your own records as you would any self-help resource. Your DPO may still want a short screening note for your DPIA log.

Privacy policy: in the app (Settings > About) and on the website. It's the same text in both places.

What we do hold: for organisations, the contact and invoicing details you give us (names, work email, address, purchase order). For individuals who buy Steady Plus, the payment company handles the purchase. A licence key never contains a client's name or anything about them.

04Medical device and clinical safety

Not a medical device. Steady's intended purpose is self-help tracking and reflection. It makes no claims to diagnose, treat, cure or prevent any condition. It hasn't been registered with the MHRA, because we don't consider it a medical device. If your organisation sees it differently, please tell us.
Not a clinical system. Steady isn't connected to your clinical records, and staff don't use it to make decisions about care. If your clinical safety officer wants a DCB0160 assessment before you recommend it, we'll provide the information they need.
Medical safety wording in the app follows public health advice and always says to talk to a doctor or a drug and alcohol service.

05Safety and safeguarding

Support is one tap away on every screen, including the lock screen. It shows the emergency number first, then helplines for the client's country.
Helplines are included for the UK, Ireland, the US, Canada and Australia, and Find A Helpline for other countries. In the UK, people can say which part they're in: Scotland adds Know the Score, Wales adds DAN 24/7, and Northern Ireland adds Lifeline. Every number is checked against the service's own website before each release. The helplines were last checked on 23 October 2026, and support for family and friends on 3 November 2026.
For family and friends. Support ends with services for people affected by someone else's drinking or drug use, for each country, on the lock screen too.
My plan for hard moments. In Support, clients can write their own plan on a calmer day: signs they're struggling, what helps, places to go, how to make things safer, and who to call, ending with the crisis line for their country. It's free, and it's never on the lock screen.
Stopping suddenly. When someone tracks alcohol, benzodiazepines, pregabalin or gabapentin, or GHB/GBL, Steady warns that stopping or cutting down suddenly after regular heavy use can be dangerous, and says to talk to a GP or drug and alcohol service first.
After a break, Steady explains that tolerance drops fast and the overdose risk rises, says not to use alone or mix drugs, and explains naloxone.
Adults only. Setup asks for age. Anyone under 18 is shown support made for young people instead, such as Childline in the UK.
Your service in Support. With an organisation licence, your service's name and number show in Support, after the emergency number. They don't show on the lock screen, so someone picking up the phone can't see which service the client uses.
No judgement. Slips are logged as information. Steady never shows a failure screen.

Steady isn't monitored. Nobody sees what a client enters, so it can't raise an alert. It must never be part of a risk plan in place of human contact.

06Security

Network	The app's security policy blocks all network requests. The Windows app also refuses every outside connection, and a test checks it makes none. The Android app asks only to show notifications, to keep reminders after a restart, and for the standard internet permission that the app framework includes. It sends nothing.
PIN lock	Optional, but setup recommends one. New PINs are 6 to 12 digits. It locks the app after the person has been away, and the PIN itself is never stored, only a salted hash (PBKDF2-SHA-256, 150,000 rounds).
Records on the device	With a PIN, the records are encrypted on the device with a random key of their own (XSalsa20-Poly1305, from TweetNaCl). That key is encrypted with one made from the PIN (PBKDF2-SHA-256, 150,000 rounds, random salt), so the PIN is needed to read them, and we never have it. When records are first encrypted, the Windows and Android apps also clear old, readable copies from their own files. A forgotten PIN can't be reset, so without a backup the records are gone for good, and the app says so. Without a PIN, the records aren't encrypted.
Backups	A file the client saves themselves. An ordinary backup isn't encrypted, and the app tells them to keep it private. With Steady Plus (Security+), they can lock it with a password: it's encrypted on the device with AES-256-GCM, using a key made from the password (PBKDF2-SHA-256, 600,000 rounds, random salt). The password isn't kept anywhere, so a forgotten one can't be recovered. Opening a locked backup is always free. No backup includes the PIN.
Damaged or doctored data	Every record is checked when it's loaded. Anything damaged is set aside, never run, and never lost. Safety copies are kept when records are repaired or restored.
Licence keys	Checked on the device against our public key. No internet is needed, and nothing is reported back.
Updates	Through Google Play, and new installers for Windows.
Testing	More than 450 automatic checks of the app and website: records never lost, damaged backups can't break the app, safety warnings show, nothing connects out, and more.

07Accessibility

Three text sizes (Standard, Large, Larger), plus the device's own text and zoom settings.
Light and dark mode, following the device or set by hand. Animation is reduced when the device asks for it.
Plain UK English with short sentences, written for people who may be in distress or find reading hard.
Works from a 320px-wide screen at every text size. Keyboard focus is always visible, and goes back to where you were when a panel closes.
Everything works from the keyboard. While a panel is open, screen readers stay inside it. Charts have a plain-words summary and a "Show as a list" table.
Every colour theme keeps text at a contrast of 4.5:1 or more, in light and dark. Days with a use are marked by more than colour alone.
Short ideas to tap under the boxes people write in, for anyone who finds a blank box hard to start.
Checked with axe-core (WCAG 2.2 A and AA) and by keyboard on each screen, with automatic checks.
Our accessibility statement, on the website, says what works and what isn't right yet. This pack, the leaflet and the client cards are tagged PDFs, so screen readers get their headings and reading order.
Not yet done: an independent accessibility audit, and testing with screen reader users. We'd welcome feedback from your service users.

08Licences and what we hold

Organisation licence: one key for all your clients, priced by how many people you support in a year, not by sites. You tell us the number: Steady never counts anyone. You give clients the key, for example by email or text, and in Settings they tap Enter a licence key and paste it in.
What clients get with the key: everything in Steady Plus that helps their recovery. That's charts and patterns from their check-ins (Insights+), a gentle note before their usual hardest time (Heads-up+), a progress summary to print or share at appointments (Progress+), the money they haven't spent (Savings+), letters to their future self (Letters+) and password-locked backups (Security+). Safety information, Support and tracking are free for everyone, with or without a key.
The personal extras are left for clients to buy for themselves if they'd like them: milestone cards (Celebrate+), medallions (Medallions+), keepsakes round their plant (Garden+), a look back at their year (Year+) and colour themes (Themes+). Their own key works beside yours.
What the key holds: your service's name, an optional phone number and note for Support, and the last day it can be entered. Nothing about any client.
When a licence ends, clients who've entered the key keep everything it opened. New clients need a new key.
Clients' records are never affected by a licence: entering, removing or ending one never changes what they've saved.
Invoices and purchase orders are welcome. A free 3-month pilot is available for early organisations.

09Summary against the NHS DTAC areas

The NHS Digital Technology Assessment Criteria (DTAC) cover five areas. This is a short summary, not a full DTAC submission. We'll complete the full form if you need it.

Area	Summary
Clinical safety	Not a medical device or clinical system (section 4). Safety wording and signposting throughout (section 5).
Data protection	No personal data is collected, by us or by you, through the app. Everything stays on the client's device (sections 2 and 3). ICO: no data protection fee is needed (the ICO's own checker, October 2026).
Technical security	No network access, records encrypted with a PIN, checked records and automatic testing (section 6).
Interoperability	Steady doesn't connect to other systems, by design. Clients can save their own backup file, and add appointments to their own calendar.
Usability and accessibility	Plain English, three text sizes, light and dark mode, small screens, and a published accessibility statement. An independent audit isn't done yet (section 7).

10About us and contact

Steady is made by Lightkeeper Studio, a small independent developer in the UK, run by a sole trader.

Get in touch

Email: hello@lightkeeperstudio.co.uk

Website: steadyrecovery.com. Scan the code to open it.

Steady supports recovery. It isn't medical treatment or a medical device, and it doesn't give medical advice. Steady is not affiliated with Alcoholics Anonymous, Narcotics Anonymous or SMART Recovery.