Who we are
Lars Martin Petersen, Frydenlundgata 8B, 0169 Oslo, Norway, is responsible for your data — the “data controller”, in the words of the law. Privacy questions go to hello@joinsteps.app.
What we collect
What you give us: your name, your email address, and a password — which we never see, as it is stored scrambled by our login provider. Optionally a daily step goal and your notification choices.
From your phone, with your permission: your total number of steps for each day, and your time zone, so your day starts and ends when it actually does. If you turn notifications on, a token that lets us send them to your phone.
As you use Steps: the teams you join, your streaks and achievements, and your place on leaderboards.
Automatically: our hosting providers log each request to our servers and to this website, including your IP address. This is ordinary infrastructure logging, used to keep Steps running and secure.
We never collect your location, heart rate, sleep, workouts, or any other health measurement — step totals only. There is no advertising identifier and no analytics or tracking software in the app or on this website.
On this website: if you send us a trial request or a support message, the form asks for your name and email address, plus your company and team size for a trial, or your message for support. Submissions are checked for spam by Cloudflare and emailed to us; the website itself stores nothing and sets no cookies of its own.
Why we use it, and our legal basis
To run your account, your teams and the leaderboards — because that is the agreement between us (GDPR Article 6(1)(b)).
To read and store your step counts — steps are health data, which the law treats as sensitive, so we rely on your explicit consent (Article 9(2)(a)), given when you allow Steps to read Apple Health. You can withdraw it at any time by turning that permission off in your iPhone settings.
To send you reminders and summaries — your consent, given when you allow notifications. Turn them off in the app or in your phone settings.
To keep Steps secure and working — our legitimate interest in a service that runs and is not abused (Article 6(1)(f)).
We do not profile you, and we make no automated decisions about you.
Who can see your steps
People on your team see your name and your daily step count — if your employer set the team up and is on it, that includes them. Turning off Display steps on leaderboard in your profile hides your numbers from leaderboards going forward, but your name stays on the team’s member list and your steps still count toward the team total.
Other Steps users see only a team’s name and its combined total in the global league — never who is on it, and never an individual’s steps.
Nobody else. We do not sell your data or share it with advertisers, and we never use your health data for advertising or marketing.
Who helps us run Steps
Supabase provides our database, login system and servers. Google and Apple deliver notifications to your phone — because a notification shows text on your lock screen, its content passes through them. Apple also distributes the app and provides Apple Health on your device. Cloudflare hosts this website, screens its forms for spam and delivers what you send through them to our inbox; it receives nothing from the app. Anthropic provides Claude, the AI assistant we use to run Steps day to day — setting up company teams, preparing invoices and checking each morning that the service is healthy. That work means it reads our database and our server logs, on our instruction and for those purposes only. Nobody else receives your data, except where the law requires it.
Where it lives
Your data is stored in Frankfurt, Germany, inside the EU. Requests from the app are handled by servers near wherever you are at the time, so if you use Steps outside Europe that request is processed there before the data is stored back in Frankfurt. Notification delivery involves Google and Apple, who operate internationally. This website is served from Cloudflare’s network, which has servers worldwide. Where data leaves the EEA, it is protected by the European Commission’s standard contractual clauses.
How long we keep it
Your account and step history stay for as long as your account exists — your history is the point of Steps. Delete your account and it goes. Server logs are kept briefly by our hosting providers and then discarded automatically. A message you send through this website stays in our inbox for as long as we need it to answer you.
Deleting your account
You can delete your account and your full step history at any time in the app: open Profile and choose Delete account. It is immediate and permanent.
Ask for a copy of your data before you delete. Deletion happens straight away, so once it is done there is nothing left for us to read — we cannot produce a copy afterwards. Email us first and we will send you your data as quickly as we can, and always within one month. Then delete whenever you are ready.
One trace remains after deletion, without your name. Leaderboards for periods that have already finished are frozen at the moment they closed. When you delete your account, your name and your account are removed from those frozen boards automatically; your daily step counts stay behind as an anonymous row, so your former teammates’ results and rankings for those weeks do not change. If your team was named after you, email us and we will rename it.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, or to send it to another service. You can also withdraw your consent at any time — revoking health permissions on your phone stops all syncing immediately. Email hello@joinsteps.app and we will respond within one month. If you are unhappy with how we handle it, you can complain to your national data protection authority — in Norway, Datatilsynet.
Children
Steps is not for children under 13, and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.
Keeping it safe, and changes
Traffic between the app and our servers is always encrypted, your login is stored in your phone’s secure keychain, and access to our database is limited to the people who run Steps and to the AI assistant described above, working on our instruction. No service can promise perfect security; if a breach puts your data at risk we will tell you and the authorities, as the law requires.
If we change something in this policy that matters, we will tell you in the app before it takes effect and update the date above. Questions? Write to hello@joinsteps.app and a human will answer.