Last updated: October 14, 2026

This Privacy Policy describes our policies and procedures on the collection, use and disclosure of Your information when You use our Service and tells You about Your privacy rights and how the law protects You.

We use Your personal data to provide and improve our Service. By using our Service, You agree to the collection and use of information in accordance with this Privacy Policy. If You do not agree with this Privacy Policy, please do not use the Service.

California residents should review the section entitled "California Privacy Rights (CCPA/CPRA)." Users in the European Economic Area should review the sections entitled "Legal Bases for Processing (GDPR)" and "European Union (GDPR) Rights."

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

Important: We do not store full payment card numbers or bank account credentials on our own servers. These sensitive financial details are handled directly and securely by our Payment Processors.

Health and Fitness Data

To provide our fitness Challenge features, We collect health and fitness data from Your device, including but not limited to:

This data is collected through integration with Apple HealthKit on iOS and Android Health Connect on Android. We only access health data that You explicitly grant permission for Us to access.

We use industry-standard security measures, including encryption in transit (TLS) and at rest, to protect health and fitness data. Your data is transmitted securely and stored in protected databases.

Important Limitations on Use of Health Data:

We use health and fitness data ONLY to:

You can revoke our access to Your health data at any time through Your device's privacy settings (Settings > Privacy & Security > Health on iOS). If You revoke access, You will no longer be able to participate in Challenges that require fitness tracking.

Important: We rely on the aggregated step count reported by Apple HealthKit or Android Health Connect, and cannot independently verify the accuracy of data reported by Your devices, sensors, or any third-party application that writes to them. Step counts and activity metrics may vary between devices and tracking methods.

Health Data Disclosure (Apple HealthKit and Android Health Connect)

Steppa uses Apple HealthKit on iOS, and Android Health Connect on Android, to read step counts and activity data that You authorize through Your device's permission prompts. We request read access to step data only. We do not write any data to HealthKit or Health Connect. That data is only used to:

HealthKit and Health Connect data is never used for marketing, advertising, advertising measurement, or data brokerage, and is never used for other use-based data mining unrelated to providing the Service.

HealthKit and Health Connect data is never sold or shared with third parties except service providers acting strictly on our behalf (such as our database provider, and OpenAI when You ask our support assistant about Your steps).

You can revoke this access at any time: on iOS in Settings > Privacy & Security > Health > Steppa, and on Android in Health Connect > App permissions > Steppa. Revoking access will prevent You from participating in fitness Challenges.

Financial and Transaction Data

We collect and process financial information related to Your participation in paid Challenges, including:

We retain financial records as required by law, including for tax reporting purposes. For U.S. users, We may be required to report winnings of $600 or more per calendar year to the Internal Revenue Service.

Fair-Play Reviews and Proof You Send Us

If another player reports Your Account for cheating, or Our automated checks of step data flag it as unusual, a member of Our team may review it. Our automated checks only add an Account to the review list; a person decides whether to open a review. If We open one, We tell You by push notification and email and ask You to show how You walked the days in question.

To answer a review, or to appeal if Your Account is closed, You can send Us:

You choose what to send. The Application only uses the images You pick from Your photo library.

When You upload an image, We convert it to a JPEG no larger than 1,600 pixels on its longest side. This removes the extra information a phone stores inside a photo file, such as the place where it was taken. Before We store the image, a smaller copy is checked for prohibited content (such as nudity or violence) by OpenAI's image moderation. We store the image in private cloud storage with DigitalOcean in the United States. It is never public and can only be opened through a private link that expires.

Only Steppa staff who work on fair-play reviews, support, or quality checks can see what You send. We do not show it to other players, including anyone who reported You, and We do not give it to Our support chat assistant. We use it only to decide the review or appeal: to check that Your step counts came from Your own walking, and to keep Challenges fair for everyone else.

We keep the note and images You send for 180 days after the review or appeal is closed, and then delete them. This applies even if You delete Your Account first. We keep a record that a review took place, its dates, and the decision as a fraud-prevention record (see "Retention of Your Personal Data").

If You do not reply by the deadline, We send a final warning by push notification and email and give You more time. If there is still no reply, Your Account is closed automatically, without a person deciding at that moment. You can appeal from inside the Application, and a person reads every appeal. If the appeal succeeds, We reopen Your Account and return the balance the closure removed.

Fraud Prevention and Payment Fingerprinting

To prevent abuse of promotions, multiple-account fraud, and payment fraud, We collect and process:

This data is used solely for fraud prevention, security, and enforcement of our Terms and Conditions. It is not used for marketing or shared with advertisers.

Referral and Invite Information

If You refer a friend or share an invite code, We collect the information needed to operate the referral program, such as the referral code used, the connection between referring and referred Accounts, and the status of any associated Promotional Credits. We use this information solely to administer the referral program and to detect referral abuse. If an invite feature asks You to provide a contact's email address or similar information, We use it only to deliver the invitation and any related reminders, and the recipient may contact [email protected] to have their information removed.

When You open the Application for the first time after installing it, it checks Your device's clipboard once for a Steppa invite link, so the friend who invited You gets credit. If the clipboard holds anything else, We ignore it and never store or send it. Your device may ask You to allow this. If You decline, nothing changes except that You can enter an invite code manually instead.

Notification Tokens and Communication Preferences

If You enable push notifications, We collect Your device push notification token and Your notification preferences to send You transactional and (if You have not opted out) marketing communications about Challenges, results, and other Service-related information. We may also send You marketing communications by email about Challenges and Service features unless You opt out; every such email includes an unsubscribe link, and opting out does not affect transactional email such as receipts, security notices, or payout confirmations. Notification tokens are retained while Your Account is active and deleted when Your Account is deleted or You revoke push permissions.

Community Content and Information Visible to Other Users

The Service includes features that display certain information to other users of the Service:

Information shown to other users can be read, collected, or re-shared by others, and We cannot guarantee that other users will respect its confidentiality. Do not make public any information You consider private. We are not responsible for information You voluntarily disclose to other users of the Service.

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

Cookies and Tracking Technologies

Our websites (playsteppa.com and join.playsteppa.com) use essential cookies for basic functionality and one first-party cookie that stores a random visitor ID for 90 days. We use that cookie, together with the campaign tags and ad click IDs in the link that brought You to the site, to measure which of Our ads and links bring people to Steppa. We do not use third-party advertising or analytics cookies on Our websites.

Our mobile Application does not use cookies but may use similar technologies (such as device identifiers) for authentication, session management, fraud prevention, and to measure which ads led to an install (see "Advertising Measurement and Install Attribution").

Advertising Measurement and Install Attribution

We advertise Steppa on platforms such as Meta (Facebook and Instagram), Google, TikTok, and Apple. To learn which ads lead people to install and use Steppa, and to improve those ads, the iOS Application includes a software development kit (SDK) from Appstack, an attribution provider, and We share some of Your Personal Data with Appstack and, through Appstack, with those advertising platforms:

We never send Health Data, such as Your step counts, for advertising or attribution. Appstack attribution is not turned on in Our Android Application today.

Opting out. You can ask Us to stop sharing Your Personal Data with advertising partners at any time: email [email protected] with "Do Not Sell or Share" in the subject line, from the email address on Your Steppa account, or ask in the Application's support chat. Once We have confirmed the request is Yours, We stop sending events about You from Our servers to Appstack, including Your email address, and We confirm by reply. We act on a request within 15 business days. This opt-out does not stop Steppa Pro subscription events that RevenueCat sends to Appstack. On iPhone, declining the Application's tracking request, or turning off tracking for Steppa in Settings > Privacy & Security > Tracking, stops the SDK on Your device from contacting Appstack.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

We do not receive money for Your Personal Data. We do share some of it with Appstack and advertising platforms to measure and improve Our ads, as described in "Advertising Measurement and Install Attribution." Some U.S. state laws call this "sharing" for cross-context behavioral advertising, or "targeted advertising", and may treat it as a "sale". You can opt out as described in that section.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

Specifically:

What We Keep After You Delete Your Account

Deleting Your Account is immediate and cannot be undone. It removes Your profile — Your display name, username, profile picture, the last four digits of any saved card, and Your bank or payout details — along with Your step and health data, Your daily progress, Your Challenge participation, Your friend connections, Your conversations in the Application's support chat (including any screenshots You attached), and Your sign-in credentials. Once these are deleted We cannot restore Your Account, and support cannot recover it for You.

Two categories of record are not deleted, because We are required to keep them or need them to run the Service honestly. Neither carries Your name.

We also retain any emails You sent to Our support address, together with Our replies, as a record of Your requests and how they were resolved. If You would like those emails deleted as well, contact [email protected].

Retaining these records is permitted under Article 17(3) of the UK and EU General Data Protection Regulation, which allows Us to keep Personal Data where it is necessary to comply with a legal obligation or to establish, exercise, or defend legal claims. Equivalent exceptions apply under U.S. state privacy laws.

Deletion can be temporarily unavailable in two situations. The first is while You have a payout that We have started sending and that has not yet completed. Deleting Your Account at that moment would destroy the record We need in order to pay You. The payout finishes on its own, usually within a few business days, and You can delete Your Account as soon as it does. The second is while Your Account is under a fair-play review, or after it has been closed following one (see "Fair-Play Reviews and Proof You Send Us"). In that case You cannot delete Your Account in the Application, but You can still ask Us to delete Your data by writing to [email protected].

If Your Account was part of a fair-play review, the review record and anything You sent for it are kept for the periods described in "Fair-Play Reviews and Proof You Send Us," even after You delete Your Account.

Sharing Your Personal Data with Third Parties

We share Your personal data with the following third-party service providers who help Us operate the Service:

Except for advertising platforms, which receive events through Appstack as described in "Advertising Measurement and Install Attribution" and use them under their own terms, these service providers have access to Your Personal Data only to perform specific tasks on our behalf and are obligated to protect Your information and use it only for the purposes We specify. We do not permit our service providers to use Your individual-level health data for their own purposes, including advertising or the training of artificial intelligence models.

Disclosure of Your Personal Data

Law Enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other Legal Requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. Our primary data hosting infrastructure is located in the United States. This information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ from those of Your jurisdiction.

Where We transfer Personal Data of users located in the European Economic Area, the United Kingdom, or Switzerland to the United States or other countries that have not received an adequacy decision, We rely on appropriate safeguards such as Standard Contractual Clauses with our Service Providers, alongside supplementary technical and organizational measures. The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

Our Service may give You the ability to delete certain information about You from within the Service, including the ability to delete Your Account.

You may update, amend, or delete Your information at any time by contacting Us to request access to, correct, or delete any personal information that You have provided to Us. We will respond to verified requests within the timeframes required by applicable law.

Please note, however, that We may need to retain certain information when We have a legal obligation or lawful basis to do so, including the financial, fraud-prevention, tax, and unclaimed-property records described under "Retention of Your Personal Data." For exactly what is removed and what is kept when You delete Your Account, see "What We Keep After You Delete Your Account" above.

Security of Your Personal Data

The security of Your Personal Data is important to Us. We implement industry-standard security measures to protect Your information, including:

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

Legal Bases for Processing (GDPR)

If You are located in the European Economic Area (EEA), We process Your Personal Data based on the following legal grounds:

Your Privacy Rights

Access and Control

You have the following rights regarding Your Personal Data:

To exercise these rights, contact Us at [email protected]. We may need to verify Your identity before fulfilling a request. You may also designate an authorized agent to make a request on Your behalf, subject to verification.

California Privacy Rights (CCPA/CPRA)

If You are a California resident, You have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Categories of Personal Information collected in the preceding 12 months: identifiers (name, email, phone, device identifiers, IP address); financial information (transaction history, balances, hashed payment fingerprints; full payment credentials are handled by our Payment Processors); health and fitness data (step counts, activity records); commercial information (Challenge entries, payouts); internet or network activity (Usage Data); geolocation inferred from IP address at a coarse level; and inferences used solely for fraud prevention. We collect these categories from You, Your device, Apple HealthKit, Android Health Connect, our Payment Processors, RevenueCat, and Appstack (which tells Us which ad, if any, led to Your install), for the purposes described in "Use of Your Personal Data," and We disclose them to the Service Providers listed in "Sharing Your Personal Data with Third Parties." In the preceding 12 months We have shared identifiers (Your email address, Steppa user ID, Appstack install ID, and device identifiers) and commercial information (checkouts, Challenge entry payments and amounts, and Steppa Pro subscription events) with Appstack and, through it, advertising platforms such as Meta, Google, and TikTok, for advertising measurement. We have not received money for Personal Information.

Global Privacy Control: We treat an opt-out preference signal such as Global Privacy Control as a request to opt out of sale and sharing where We can link it to You. Our websites have no sign-in and send nothing to advertising partners, so a signal received there has nothing to change; to opt out for Your Steppa account, use the email or support chat request described above.

To exercise Your California rights, email Us at [email protected] with "CCPA Request" in the subject line. We will verify and respond to Your request within the timeframes required by law (generally 45 days, extendable once by an additional 45 days with notice).

Other U.S. State Privacy Rights

If You reside in another U.S. state with a comprehensive privacy law (for example, Virginia, Colorado, Connecticut, Texas, or Oregon), You may have similar rights of access, correction, deletion, portability, the right to opt out of targeted advertising and the sale of Personal Data (see "Opting out" under "Advertising Measurement and Install Attribution"), and the right to appeal a refusal. To exercise these rights or appeal a decision, contact [email protected] with "Privacy Request" in the subject line.

European Union (GDPR) Rights

If You are located in the European Economic Area (EEA), You have rights under the General Data Protection Regulation (GDPR), including:

You also have the right to lodge a complaint with Your local supervisory authority. To exercise Your GDPR rights, contact Us at [email protected].

Data Breach Notification

In the event of a data breach that affects Your Personal Data, We will notify You and any applicable regulators without undue delay, in the manner and within the timeframes required by applicable law. Where notification to You is required, it will describe, to the extent known:

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy, and any recipient will be required to honor commitments at least as protective as those in this Privacy Policy with respect to previously collected Personal Data.

Children's Privacy and Age Restrictions

Our Service does not address anyone under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18.

Participation in paid Challenges requires users to be at least 18 years old. We rely on user self-attestation of age at registration and may, at our discretion, require additional verification. If You are under 18, You may not use the Service or participate in Challenges.

If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us immediately. If We become aware that We have collected Personal Data from anyone under the age of 18, We will take steps to delete that information and terminate the account.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy. Use of information We collect is subject to the Privacy Policy in effect at the time such information is used.

Contact Us

If You have any questions about this Privacy Policy, You can contact Us:

Data Protection Contact

For privacy-related inquiries, data protection matters, or to exercise Your privacy rights, You may contact our Data Protection contact at: [email protected]

Please include "Privacy Request" or "Data Protection" in Your subject line to ensure prompt handling of Your inquiry.