Privacy Policy

Introduction

Steppers ("we", "our", or "the app") is a fitness app that lets you track your daily steps and compete with friends in teams. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data. This Privacy Policy is part of our Terms of Service.

The data controller responsible for your personal data is Guy Tepper, reachable at contact@steppers.game.

Data We Collect

Account Information

When you sign in with Apple or Google, we receive your name and email address (if provided by you) along with a unique account identifier. We use this to create and manage your account.

Health & Fitness Data

With your permission, we read your daily step count from Apple HealthKit (iOS) or Health Connect (Android). We only access step count data — we do not read any other health records, heart rate, sleep, or medical data. Step data is synced periodically, including in the background, so your teams always see up-to-date totals.

Team & Profile Data

When you create or join a team, we store your display name, team membership, and step totals so that team leaderboards and rankings work correctly.

Push Notifications

If you enable push notifications, we collect your device push token along with device details (device name, manufacturer, and OS version) so we can deliver notifications to the correct device. You can disable notifications at any time through your device’s settings.

Camera & Photo Library

During character creation, you may choose to take a photo or select one from your library. We use this image solely to generate your in-app character. The image is uploaded to our cloud storage and is not shared with other users or third parties.

Device & Diagnostic Information

We collect basic device details (device model, operating system, and app version) to help us diagnose issues and ensure compatibility.

Marketing & Attribution Data

To understand how people discover Steppers and to measure the effectiveness of our marketing, we use AppsFlyer. With its help we identify which campaigns and sources lead to new installs, using a device identifier and a small set of in-app events. We use this to attribute installs to our marketing and measure how it performs.

Advertising & Reward Data

Steppers offers optional rewarded ads through Google AdMob. When the app requests or displays an ad, Google and its advertising partners may collect your IP address (which can indicate approximate location), device and advertising identifiers, device and app information, diagnostics, and ad interactions such as impressions, taps, and video views. They may store or access information on your device to serve and measure ads, prevent fraud, and personalize ads where permitted by your consent choices and applicable law.

To verify a rewarded ad, we send Google your internal Steppers account identifier and an identifier for the reward card. Google sends us a signed confirmation when the ad reward is earned. We store the account identifier, reward card, ad unit, transaction identifier, and verification time to deliver the reward and prevent duplicate claims. We also record ad interactions and reward outcomes in our analytics to understand whether the feature is working.

We do not send your step counts, HealthKit or Health Connect data, or character photos to AdMob or its advertising partners, and we do not use health data to target ads.

How We Use Your Data

• Display your step count and team rankings within the app.
• Authenticate your account and keep it secure.
• Sync step data across your devices in real time.
• Debug and improve the app experience.
• Measure how our marketing campaigns perform and attribute new installs to the source that brought them.
• Provide optional rewarded ads, measure ad performance, verify earned rewards, and prevent duplicate claims.

We do not sell health data or use it for advertising. Advertising data is handled as described in Advertising & Reward Data above and Advertising Choices below.

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data under the following legal bases, as applicable:

• Contract performance — processing your account information, team data, and step data is necessary to provide the Steppers service you signed up for.
• Consent — we process your health & fitness data (step counts) and camera/photo data only with your explicit consent, which you can withdraw at any time through your device’s settings. We also request consent for advertising-related storage or access on your device where required, and for the collection, sharing, and use of personal data for personalized ads. You can change advertising consent as described below.
• Legitimate interest — we process device and diagnostic information to maintain app stability, fix bugs, and improve the user experience, and we process limited attribution data to measure and improve our marketing. We also verify rewarded ads and prevent fraudulent or duplicate reward claims. We have assessed that these interests do not override your rights and freedoms.

Third-Party Services

We use the following third-party services to operate and improve the app:

• Firebase (Google) — authentication, database, cloud functions, and push notifications. See Firebase Privacy.
• PostHog — product analytics, error monitoring, and diagnostics. To help us improve the app experience, PostHog may collect information about how you use and navigate the app, such as screens viewed and general interaction patterns. To help us identify and fix issues, it may also collect crash information, error reports, and device details. See PostHog Privacy Policy.
• RevenueCat — in-app purchase processing. If you make a purchase, RevenueCat handles the transaction on our behalf. See RevenueCat Privacy Policy.
• AppsFlyer — mobile marketing attribution and analytics. AppsFlyer helps us measure which campaigns lead to new installs and how those users engage, using a device identifier and in-app events. See AppsFlyer Services Privacy Policy.
• Google AdMob & advertising partners — rewarded ad delivery, measurement, personalization where permitted, fraud prevention, and reward verification. Google’s User Messaging Platform manages advertising consent choices. The consent message provides a list of advertising partners and their purposes. See Google’s Privacy Policy and how Google uses information from apps that use its services.

Advertising Choices

In the EEA, the United Kingdom, and Switzerland, Google’s consent message lets you consent, decline, or manage advertising purposes and partners before ads are requested when consent is required. You can revisit these choices, object to processing based on legitimate interest, or withdraw consent at any time through Settings → Ad privacy choices in Steppers, wherever that option is required and available. Withdrawing consent does not affect the lawfulness of processing before withdrawal. Depending on your choices, ads may be non-personalized, limited, or unavailable. You can continue using Steppers without choosing to watch rewarded ads.

On iOS, we separately ask for Apple’s App Tracking Transparency permission before accessing the advertising identifier for tracking. You can change this permission in your device’s Settings → Privacy & Security → Tracking. Granting or declining this permission is separate from your choices in Google’s consent message.

Data Storage & Security

Your data is stored in Firebase (Google Cloud) and transmitted over encrypted (TLS/SSL) connections. Access to user data is restricted to authenticated users through security rules. We do not store health data on your device beyond temporary caches.

International Data Transfers

Your data may be transferred to and processed in the United States and other countries outside the European Economic Area (EEA) through our third-party service providers (Firebase/Google Cloud, PostHog, RevenueCat, AppsFlyer, and Google AdMob and its advertising partners). These transfers are protected by appropriate safeguards, including the service providers’ compliance with Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the EU–U.S. Data Privacy Framework.

Data Retention

We retain your account and step data for as long as your account is active. If you delete your account through the in-app account settings, we will delete or anonymize your personal data within a reasonable period, except where we need to retain limited records for legal, security, fraud prevention, backup, or processor compliance purposes.

We retain ad reward verification records to deliver rewards and prevent duplicate or fraudulent claims under the same retention principles. Google and advertising partners retain data under their own privacy policies; Google’s consent message provides information about partner purposes and retention periods.

Your Rights

You can:

• Revoke health data permissions at any time through your device's settings.
• Change or withdraw advertising consent through Settings → Ad privacy choices where available.
• Delete your account and associated data through the in-app account settings.
• Access or export the data we hold about you by contacting us.

If you are located in the EEA, the United Kingdom, or Switzerland, you also have the right to, as applicable:

• Rectification — request correction of inaccurate personal data we hold about you.
• Restriction — request that we restrict the processing of your personal data in certain circumstances.
• Objection — object to processing based on legitimate interest. We will stop processing unless we have compelling grounds that override your rights.
• Data portability — receive your personal data in a structured, commonly used, machine-readable format.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Lodge a complaint — you have the right to lodge a complaint with your local data protection supervisory authority if you believe your data is being processed unlawfully.

To exercise any of these rights, contact us at contact@steppers.game.

Children's Privacy

Steppers is not directed at children under 13 (or under 16 in jurisdictions where GDPR or local law sets a higher age of digital consent). We do not knowingly collect data from children under these ages. If you believe a child has provided us with personal data, please contact us so we can remove it.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page.

Contact Us

If you have questions about this Privacy Policy or your data, please reach out at contact@steppers.game.