Data Privacy & Security at Step Tracker

Encrypted in transit – every connection between the app, this website and our servers uses HTTPS. Plain HTTP requests are redirected to HTTPS, and our servers negotiate TLS 1.3 with strong modern ciphers.

Passwords are hashed – if you create an account with an email address and password, the password is stored only as a bcrypt hash. We cannot read it, and we will never ask you for it. If you sign in with Apple or Google instead, we never receive a password at all.

Access is restricted – our administrative tools sit behind authentication, and access to production data is limited to the small number of staff who need it to operate and support the service.

Managed hosting – our application and database run on servers hosted with DigitalOcean, in data centres with physical security and operational controls maintained by the hosting provider.

Data minimisation – Step Tracker can be used without an account. If you use it as a guest, your steps and goals stay on your device and are not sent to us.

Deletion you control – you can delete your account and its data from inside the app at any time, under Settings. Deletion is confirmed by a one-time code sent to your email, so that nobody else can delete your account for you.

Where you grant permission, Step Tracker reads step and activity data from Health Connect on Android or Apple Health on iOS. Granting that permission is optional and the app works without it.

We use this data to show you your step count, distance, calories and goal progress, and your history inside the app. Nothing else.

We never sell your health or activity data, and we never use it to target advertising.

You can withdraw this permission at any time in Health Connect, in Apple Health, or in your device settings. Step Tracker will keep working using your phone's own step sensor.

Access – you can ask us what personal data we hold about you, and we will tell you.

Correction – you can correct your profile details in the app, or ask us to correct anything that is wrong.

Erasure – you can delete your account and its data from within the app, or ask us to do it for you.

A copy of your data – there is no self-service export button in the app today. If you want a copy of the personal data we hold about you, email us and we will put it together for you.

Objection and restriction – you can object to, or ask us to restrict, how we use your data. You can also opt out of personalised advertising in your device settings, and on iOS by declining the App Tracking Transparency prompt.

Breach notification – if a personal data breach occurs that is likely to affect your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and tell affected users where the law requires it.

Where your data is processed – we operate from India, and our service providers may process data in other countries. Where data is transferred out of the EEA or UK, we rely on appropriate safeguards offered by those providers.

We use a small number of established service providers to run the app: Google Firebase for sign-in, crash reporting, analytics and push notifications; Microsoft Clarity for anonymised usage and session analytics that help us find and fix problems; Google AdMob to show advertising to users on the free tier; and RevenueCat to manage subscriptions.

Each of these providers handles data under its own privacy terms. Our Privacy Policy describes what each one receives and why.

If you subscribe, advertising is switched off and no ad requests are made.

Step Tracker is not a medical device and does not provide medical advice, diagnosis or treatment. Step and calorie figures are estimates from your phone's sensors and should not be relied on for any medical purpose.

Step Tracker is not a HIPAA covered entity or business associate. HIPAA applies to healthcare providers, health plans, healthcare clearinghouses and the vendors acting on their behalf. Step Tracker is a consumer fitness app that you choose to use directly, so HIPAA does not apply to it, and we do not claim to be HIPAA compliant. Information you enter here is not Protected Health Information under that law.

We do not offer two-factor authentication on user accounts today. If you would like the strongest sign-in available, use Sign in with Apple or Sign in with Google and enable two-factor authentication on that account.