Privacy Policy

1. Who we are and what this policy covers

Stepaw (“Stepaw,” “we,” “us,” or “our”) is a walking and step-counting app that lets users turn eligible steps into Paw Coins and direct Stepaw’s donation pool among supported animal shelters. This policy applies to the Stepaw mobile app and the Stepaw website.

2. Information we collect

Health and fitness information

With your explicit permission, Stepaw reads the following from Apple HealthKit or Android Health Connect:

• step count;
• walking and running distance; and
• active energy burned.

Stepaw reads daily aggregate totals, including recent daily totals used to display your progress and history. These totals are sent to and stored in our backend so we can provide Paw Coins, streaks, challenges, leaderboards, and account continuity. We do not request or collect heart rate, medical records, workouts, precise location, or route data. Stepaw does not write data to Apple Health or Health Connect.

Anonymous account and profile information

Stepaw creates an anonymous account identifier when you first use the app. You do not need to provide a real name, email address, phone number, Apple ID, or Google account. We may store:

• your anonymous user ID and secure authentication session;
• your chosen username, language or locale, and country code;
• your daily step goal and measurement-unit preference;
• your selected shelter and onboarding status; and
• whether you participate in leaderboard features.

Activity, rewards, and social features

We store daily activity totals, step-conversion records, Paw Coin balances and history, streaks, challenge participation, referral codes and redemptions, and completed in-app reward tasks. Your username and aggregate step total may be visible to other users on leaderboards. Challenge participants may see the username and progress of other participants in the same challenge. We do not publish your underlying HealthKit or Health Connect records.

Device settings and local data

Your authentication session, notification preference, and measurement preference are stored securely on your device. Stepaw schedules reminders locally on your device after you grant notification permission. We do not collect your contacts, photos, microphone data, or precise location.

Advertising and technical information

Stepaw uses Google AdMob to show optional rewarded ads. Stepaw requests non-personalized ads. Google and its advertising partners may still process information such as your IP address, device and app information, advertising or app-instance identifiers, and ad impressions and interactions to deliver ads, limit repetition, produce aggregated reports, and prevent fraud and abuse. Stepaw does not send your health or fitness data, username, Paw Coin balance, or chosen shelter to Google for advertising.

Our service and website providers may also process standard technical data such as IP address, timestamps, request information, and security logs when you connect to Stepaw.

Contact form information

If you contact Stepaw through our website, we collect the name, email address, subject, and message you submit so we can respond to your inquiry. Our contact-form delivery provider processes this information on our behalf.

3. How we use information

We use information only as reasonably necessary to:

• measure and display walking progress;
• calculate eligible step conversions and Paw Coins;
• operate streaks, goals, challenges, referrals, and leaderboards;
• record your shelter choice and allocate the donation pool;
• provide donation reports and proof;
• send reminders you have permitted;
• respond to messages and partnership inquiries;
• maintain account security, prevent abuse, and troubleshoot errors;
• serve optional rewarded ads; and
• comply with legal obligations and enforce our rights.

We do not use health or fitness information for advertising, marketing, data mining, credit, insurance, employment, or eligibility decisions.

4. When information is shared

We do not sell your personal information or health data.

Information may be processed by:

• Supabase, which provides authentication, database, storage, and backend infrastructure;
• Google AdMob, which provides optional rewarded ads and related delivery, measurement, and fraud-prevention services;
• website and infrastructure providers, which process limited technical data needed to deliver and secure the service;
• contact-form delivery providers, which transmit website messages to our business email inbox; and
• authorities or other parties where disclosure is required by law, necessary to protect users or the service, or part of a corporate transaction subject to appropriate safeguards.

Service providers may use information only to perform services for us or as otherwise disclosed in their own privacy terms. We require providers handling Stepaw user data to apply protections consistent with this policy and applicable law. Health and fitness information is not shared with advertising networks.

5. Legal bases for processing

Where the GDPR, UK GDPR, or similar law applies, we rely on the following legal bases as appropriate:

• Consent for access to health data, notifications, and advertising technologies where consent is legally required;
• Performance of a contract to provide the Stepaw features you request;
• Legitimate interests in securing, maintaining, and improving the service, provided those interests do not override your rights; and
• Legal obligations where processing is required by law.

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal.

6. Health data commitments

Health and fitness data is sensitive. Stepaw accesses it only after the operating system presents a permission request and you choose what to allow. We do not sell it, use it to build an advertising profile, disclose it to data brokers, or combine it with advertising data. Ads are not selected using your step count, distance, active energy, Paw Coins, or shelter choice.

7. Data retention and deletion

We retain account-linked information while your Stepaw account remains active and as needed to provide the features described above. Security and transaction records may be retained for a limited period where reasonably necessary to prevent fraud, resolve disputes, or meet legal obligations.

You can permanently delete your Stepaw account from Profile → Privacy & Data → Delete Account & Data. This deletes the anonymous authentication account and production records linked to it, including your profile, daily activity totals, conversions, Paw Coins, and challenge or referral records. Removing the app from your phone does not by itself delete server data.

Limited residual copies may remain temporarily in service-provider backups or security logs until they are overwritten under normal retention cycles, unless longer retention is legally required. Public donation reports and shelter payment proofs are Stepaw business records and are not tied to your identity. Advertising data independently processed by Google is retained under Google’s policies and controls.

8. Your choices and rights

• Health access: revoke or change Stepaw’s permissions at any time in Apple Health settings or Android Health Connect.
• Notifications: disable reminders in Stepaw or your device settings.
• Account deletion: use the in-app deletion control described above.
• Privacy rights: depending on where you live, you may request access, correction, deletion, restriction, portability, or objection, and may complain to your local data-protection authority.

Because Stepaw accounts are anonymous, the in-app deletion control is the fastest and most reliable way to identify and delete your account. We may need limited information to verify other privacy requests.

9. Security and international processing

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including encrypted network connections, secure on-device session storage, access controls, and database authorization rules. No system can guarantee absolute security.

Stepaw and its providers may process information in countries other than your own. Where required, we use legally recognized safeguards for international transfers.

10. Children

Stepaw is not directed to children under 13. Where local law requires a higher age for valid consent, Stepaw is not intended for users below that age without authorization from a parent or legal guardian. If you believe a child has provided personal information improperly, contact us so we can investigate and delete it.

11. Changes to this policy

We may update this policy when Stepaw’s features, providers, or legal obligations change. We will post the revised policy here and update the “last updated” date. Where required, we will provide additional notice or request consent.

12. Contact us

For privacy questions or requests, contact Stepaw at hello@stepaw.app.