We run on subscriptions, not advertising. That means we never need to know who you are to make money; we only need to know whether Steel Magnolias is working as a community. This page is the plain-language inventory of everything we measure, everything we deliberately refuse to measure, and what will change as the product grows. It exists because our members deserve to check our claims, not just trust them. (The Privacy Policy is the legal version; this page is the readable one.)
01What we measure today
- Website analytics. Page views, clicks, and performance on steelmagnolias.app, tied to a random identifier, with your IP address anonymized before it reaches our analytics. Standard, boring, and it never follows you into the app.
- One anonymous count at the age gate. When someone does not pass the 18+ check, the app sends a single anonymous event so we can count blocked attempts. It carries a one-time random identifier tied to no account, name, or profile.
- Subscription lifecycle events (server-side). When Apple or Google tells our servers that a subscription changed (a trial started, became a paid membership, renewed, was cancelled, or was refunded), we record that step under a dedicated random analytics identifier. The event says which store, which plan and price tier (founding or standard), and which lifecycle step, plus a technical de-duplication key that identifies records of the same underlying change, so duplicate store deliveries can be recognized; when a membership ends, it also says whether the loss was voluntary or a billing failure. Nothing about content, and nothing about how the app is used. This is how we know, in aggregate, whether trials convert and whether members stay.
- Weekly community aggregates. We count, weekly and in aggregate, how many members contributed to the community: a count of contributing members, never a feed of who said what to whom. Private surfaces are excluded entirely (see below).
02The identifier, explained
The analytics identifier is a random ID minted for analytics and nothing else. It is never your name, email, account ID, or handle. It is never shown to you or to anyone else, never used to sign you in, and never used to connect you to other members. When you delete your account, we delete the analytics records held under it and sever the identifier itself, in both deletion modes.
03What we never measure
- Receipts emits nothing. Your private documentation is yours. No analytics event ever fires from Receipts: not a count, not a timestamp, nothing per-member. The same is true of direct messages, the app lock, and every crisis flow.
- No session replay, ever. We do not record your screen, your taps, or your scrolling. This is permanent, not a launch posture.
- No advertising identifiers, no third-party trackers, no cross-app tracking. Anywhere.
- Your stage is never in analytics. Where you are in your process (Unraveling, Rebuilding, Blooming) is yours to name in the app, and it is permanently excluded from every analytics system we run.
- No location tracking. The only location signal anywhere is the country/region level on website analytics, derived from an anonymized IP address.
04What the app measures, starting with version 1.0.3
Until app version 1.0.3, the app runs zero usage analytics. Starting with 1.0.3, the app records the events below, under the same dedicated random identifier and the same rules as everything else on this page. If you joined before this change, they take effect for your account 30 days after we emailed notice of it.
Every event is individually chosen and named; there is no automatic capture. This is the complete list:
- App opened (and whether it was a fresh start of the app).
- Welcome screen viewed and age check passed.
- Signup completed, with the sign-in method used.
- Onboarding steps completed: the identity step, your answer to the AI-features consent question (granted or declined, never why), and onboarding finished.
- How you heard about us: your answer to the optional question, or the fact that you skipped it. Skipping changes nothing.
- Paywall viewed and plan selected (annual or monthly).
- Launch-offer screen viewed, launch offer declined, and launch-offer redeem tapped (viewing and declining starting with version 1.0.4, the redeem tap starting with version 1.0.5; for members who hold a launch code). Only that the screen was seen, that it was declined, or that tapping redeem opened the store's redemption page. Never the code, and declining changes nothing about the offer.
- A message sent in community chat, with the surface it was sent in (The Oasis, a topic chat, or a Garden). Direct messages are excluded entirely. Never the message itself.
- A forum post or reply created. Never the title, never the text.
- A Garden created or joined.
- A Meadows session joined.
- A notification opened (which kind, never the content).
Beyond the labels named in the list above, each event carries only the platform (iPhone or Android) and the app version. Every label is a choice from a fixed list, never free text. On Android only, when the app was installed from a link in one of our own campaigns, Google Play passes along that link's campaign labels. We keep them only when they match the known values of our own campaigns; anything else is discarded. They describe our link, not you. Everything on the "What we never measure" list above still holds: the sensitive surfaces emit nothing, no content ever, no replay ever, and your stage is never in analytics.
05What changes next
When membership verification launches, our servers will also record the steps of the verification funnel (verification started, method chosen, automated decision, human review entered, verified, first post) under the same dedicated random analytics identifier. Never a photo, never anything about a face, and never the reason a check did not pass. The check itself, and the short list of what it stores, is described in the Privacy Policy under "When you verify your membership."
Questions? hello@steelmagnolias.app. A real person answers.