Privacy Policy

Last updated July 21, 2026.

This policy explains how StepStreak ("we") handles information when you use the StepStreak iPhone app and website. Questions or privacy requests can be sent to support@stepstreak.com.

Apple Health data

With your permission, StepStreak reads step count and walking workout data from Apple Health to calculate daily goals, weekly walking minutes, XP, streaks, badges, and rankings. StepStreak never writes to Apple Health.

Raw HealthKit samples and walking workouts are processed on your iPhone. We do not send or store your raw HealthKit history. Weekly walking-minute details stay on your device. For social rankings and server XP, the app sends a derived eligible step total for a specific day. Manually entered steps and steps imported by third-party apps are excluded from eligible totals.

Information we collect

• Account: a pseudonymous Sign in with Apple identifier, encrypted Apple authorization token where provided, session identifiers, and account creation dates.
• Profile: your chosen username, daily goal, language, time zone, and country or region selected for Local League.
• Health-derived activity: eligible daily step totals, goal at submission, date, and integrity status used for XP and rankings.
• Social: friendships, requests, invite status, blocks, notification preferences, and milestone events.
• Safety: reports you submit, including an optional description, and moderation records.
• Device and integrity: push-notification tokens, app version, App Attest public-key records, and security/rate-limit events.

What we do not store

• Raw HealthKit history.
• Manually entered or third-party imported steps as leaderboard credit.
• GPS history or precise location trails.
• Your contacts, advertising identifier, or government name.

How information is used

We use this information only to operate StepStreak: authenticate accounts, calculate progress, provide friends and Local League rankings, deliver requested notifications, prevent fraud and spam, moderate usernames, respond to reports, secure the service, and provide support. Health and fitness information is not used for advertising, marketing, tracking, sale, or unrelated data mining.

What other people can see

Accepted friends and people on the same Local League board may see your chosen username, eligible daily step total, ranking, and selected milestone activity. They do not see your Apple ID, raw HealthKit data, manually entered steps, precise location, or report details. AI League rivals are fictional and processed locally in the app.

Service providers

Cloudflare processes and stores account, ranking, security, and website data on our behalf. Apple provides Sign in with Apple, Apple Health, App Attest, and push notifications. We do not sell personal information or share Health data with advertisers or data brokers.

Retention and deletion

Account, profile, eligible daily totals, XP, and social records are retained while your account is active. Expired sessions, rate-limit events, invitation challenges, and delivery records are removed on shorter operational schedules. Limited provider backups may persist temporarily after deletion.

You can delete your StepStreak account in the app under Profile > Delete account. This removes your server account, username, friendships, eligible daily totals, XP, push tokens, and associated social records, and StepStreak requests revocation of its Sign in with Apple authorization. Data already stored in Apple Health stays under your control in Apple Health. You can also export the app's locally cached daily history from Profile.

Your choices

You can change Apple Health access in iPhone Settings, control friend notifications in Profile, block or report another walker, leave friendships, choose your Local League region subject to its fairness lock, sign out, or delete your account. Contact us to request access, correction, or help with deletion.

Children

StepStreak's account and social features are not intended for children under 13, or a higher minimum age where local law requires it.

Security and international processing

We use encrypted network connections, hashed account identifiers, encrypted Apple authorization tokens, short-lived access sessions, App Attest, rate limits, and access controls. No service can guarantee absolute security. Cloudflare may process information in countries other than your own under its data-protection commitments.

Changes

We may update this policy as StepStreak changes. The date above identifies the latest version. Material changes will be communicated through the app or website when appropriate.