PRIVACY NOTICE · OCTOBER 29, 2026

Clear about
what stays private.

This website

This informational site has no sign-up form, advertising, or analytics scripts. Cloudflare hosts it and processes normal connection information, such as IP addresses and security-related request data, under its own policies. Contacting support by email stores your message in the support mailbox. Never send recovery credentials or screenshots of private content to support.

Local protection

Visual Guard processes screen content locally on the Windows PC. Steadfast does not save screenshots, visual history, or incident reports, or email them to trusted contacts. The application retains settings and credential verifiers needed for protection and recovery.

Planned recovery email service

Automatic recovery email is being implemented and is not yet offered as a completed public service. The intended flow sends only enrollment confirmation and recovery-package emails requested during setup. The chosen trusted person must confirm before recovery credentials are sent.

The sending service temporarily processes the destination address, recovery codes, and, only for trusted-person-only mode, a generated password in memory to send through Amazon SES. A locally chosen password is never sent to the service. Steadfast does not persist raw recipient addresses, passwords, recovery codes, or email bodies in its own databases or request logs.

Temporary session state contains keyed fingerprints, code verifiers, expiry, and bounded attempt counters. Sessions expire after 15 minutes per step and are deleted on successful acknowledgment. Database cleanup can occur later, but an expired record cannot authorize a request. Keyed rate-limit counters have hourly or daily windows. They contain no raw email address or IP address.

Operational logs are configured for seven days without request bodies or secret values. Aggregate delivery and failure metrics contain no message content. No email archiving, open tracking, click tracking, or message retry queue is used.

Email providers and trusted recipients

Amazon SES and the receiving mail provider process the messages and may retain delivery, security, suppression, or compliance data. AWS suppression lists can retain bounced or complained-about addresses to prevent further sends. The trusted person's mailbox stores the recovery email until they manage or delete it. We cannot promise zero storage across the email chain or delete mail already delivered to another person's mailbox.

Delivery is configured to require encrypted transport; email is not end-to-end encrypted. Anyone with access to the trusted mailbox may be able to read its recovery credentials.

Questions