Privacy Policy
Last Updated: October 8, 2026
Introduction
StepKey ("we", "our", or "us") respects your privacy. This policy explains how we handle your information. The Global sections apply only when the optional Global leaderboard is available.
1. Information We Access
1.1 Health Data (via Apple HealthKit)
With your permission, we read step count, distance, flights climbed, calories, and exercise minutes from HealthKit to calculate earned screen time and display your activity statistics.
Activity and screen time calculations run on your device. PostHog receives the minutes you choose when redeeming time, but not measured step totals or streaks as analytics fields. If Global is available and you choose to join and consent to sharing, we upload daily step totals, their date boundaries and time zone to our servers to calculate your leaderboard position. Available steps from the current year are imported, including steps before you joined. Other health metrics are not uploaded for Global. Health data is not sold or used for advertising. We only read data and never write to HealthKit.
1.2 Global Account (Optional)
Global uses Sign in with Apple. Signing in creates an account, but does not enroll you in the leaderboard or upload your steps. Enrollment requires a valid nickname, a country flag and your explicit tap on “Share steps & join” after the sharing notice. We record the participation time and consent notice version. We store your Apple account identifier, encrypted Apple authorization token, session records, chosen nickname, country flag, time zone and participation date. Global podium notifications are on by default for Global participants. If your device allows them, we also store an encrypted push token, its delivery settings and a record of which ranking notifications were evaluated or sent. Your nickname, flag, step totals and position are visible in the public leaderboard, including to people who are not signed in. Choose a nickname rather than your real name. Your flag is self-selected and is not verified location information. We do not request your Apple name or email for Global. Limited request identifiers are retained briefly to prevent abuse and are not published. You can change your nickname and flag or delete your account in the app.
1.3 App Settings and Onboarding Answers
The app stores preferences on your device, including step goals, screen time rules, blocked app selections and display preferences. Selected settings and onboarding interactions are also used for analytics. Your optional Global podium notification preference and delivery settings are stored on our server.
1.4 Screen Time
We use Apple's Screen Time framework to block selected apps on your device. Our analytics includes counts of selected apps and categories and related diagnostic data, not the names of the selected apps.
2. Data and Identifiers
Analytics events are associated with a persistent user identifier. Some settings are also saved as properties of that analytics profile. An account is not required for this association, and the analytics should not be understood as anonymous. The app sends its configured time zone.
3. Third-Party Services
3.1 Superwall
We use Superwall to manage subscriptions and paywalls.
Superwall may collect:
- Subscription status and purchase history
- Device type and OS version
- Paywall presentation, interaction and purchase events
- User or device identifiers used to associate these events
- Potentially IP-derived region, country and city
For more information, see Superwall's Privacy Policy.
3.2 PostHog (Analytics)
We use PostHog's EU service for product analytics and troubleshooting. It processes app interactions, selected settings and technical information linked to a persistent analytics identifier. This data is not anonymous. We do not send measured HealthKit steps, entered names or questionnaire answers to PostHog.
3.3 Reception (Support Chat)
Where the in-app support chat is available, StepKey uses Reception.sh for optional support. If you contact us, Reception processes your messages and any photos you choose to send, a device-based support identifier, app and device details, chat activity and, when enabled, a push token for replies. StepKey also provides limited app settings and subscription status or plan so our team can help with your request. Our team can read and reply to the conversation; optional review and subscription-offer cards and their opens are recorded. See Reception's Privacy Policy.
3.4 Apple Services
We integrate with Apple HealthKit, StoreKit, and FamilyControls and Apple Push Notification service (APNs). APNs processes the device token and notification payload, including podium results and step totals, to deliver enabled Global notifications. Apple services operate under Apple's Privacy Policy.
4. Data Storage
App settings are stored on your device, and selected settings and interactions are also processed by analytics services as described in Section 3. Core features do not require an account. Optional Global profiles and daily step totals are stored in our PostgreSQL database. Data is transferred over HTTPS; session secrets are stored securely and Apple authorization tokens are encrypted. Closed leaderboard results are stored while associated accounts exist. Global data is retained until you delete your account. Analytics data is processed as described in Section 3.
5. Data Deletion
Uninstalling the app does not automatically delete data already sent to analytics, subscription or support services. For requests to access or delete those data, including support messages and photos, contact [email protected]. Turning off Health access stops new HealthKit reads but does not delete earlier analytics events or profile properties. Uninstalling the app also does not delete your Global account. You can withdraw your consent to Global sharing by choosing Global profile → Delete account. This ends participation and removes your account, step totals and associated leaderboard records from our active database and revoke Sign in with Apple authorization. Signing out stops uploads from that signed-out device but retains your account and previously shared public rankings; it does not withdraw consent. Turning off Health access stops new reads but does not remove previously uploaded data. Backup copies are removed through normal backup rotation; restoration must preserve deletion requests. Account deletion does not delete your Apple Health data and does not automatically cancel an Apple subscription. You can manage HealthKit permissions in iOS Settings under Health, and Screen Time permissions in iOS Settings under Screen Time.
6. Children's Privacy
The analytics described above can operate without an account. If you are a parent or guardian with a question or deletion request concerning a child's information, contact [email protected].
7. Your Rights
All Users:
- Contact [email protected] for access or deletion requests
- Where Global is available, delete your Global account and associated Global server data in the app
EU Users (GDPR):
- Rights to access, rectification, erasure, and portability apply
- Where Global is available, you can edit your nickname and flag or delete your Global account in the app. Contact [email protected] for requests concerning analytics and other personal data, including access, correction, deletion and portability
California Users (CCPA):
- We do not sell personal information
- Contact [email protected] to request information or deletion; the Global controls described above apply to Global data
8. Changes to This Policy
We will indicate changes by updating the "Last Updated" date above. Significant changes will be communicated within the app.
9. Contact
Questions about this Privacy Policy:
Email: [email protected]
Website: https://stepkey.app