Privacy Policy

Last updated: July 20, 2026  ·  Effective: May 17, 2026

This Privacy Policy describes how Step Friend ("the App", "we", "us", "our") collects, uses, stores and protects your information when you use our mobile application available on the App Store and Google Play.

Step Friend is operated by Alejandro Sánchez from Mexico. If you have questions about this policy, you can reach us at [email protected].

1. Information we collect

1.1 Information you provide

When you create an account, we collect:

• Email address (required to register)
• Username / display name (chosen by you)
• Password (stored encrypted with bcrypt — never in plain text)
• Time zone (to correctly display dates and statistics)

This data is provided voluntarily by the user and is the minimum necessary to operate the service.

1.2 Health and physical activity information

With your explicit permission, the App reads data from:

• Apple HealthKit (iOS): steps, heart rate, workouts (walking, running, cycling, strength, etc.)
• Google Health Connect (Android): the same types of data

Important:

• The App only reads this data. It never writes to HealthKit or Health Connect.
• Health data is never shared with third parties for advertising purposes.
• You can revoke this permission at any time from your device settings.

Body metrics for calculators (optional, local only): some educational lessons include energy-expenditure calculators (BMR/TDEE) where you can enter your weight, height, sex and age. This data is used only for the calculation shown on screen; it is stored only on your device and never sent to our server or to third parties. Likewise, your year of birth (if you enter it) is stored locally to estimate your heart-rate zones during workouts, and never leaves your device either.

1.3 App usage information

For the game to work, we store:

• Your daily steps and imported workouts
• Your level progress, streak, and virtual coins
• Skins, outfits and items purchased or equipped on your axolotl
• Your Pro subscription status (if applicable)
• Your daily step goal (and its history when you change it)

1.4 Payment and subscription information

The App offers monthly and yearly Pro subscriptions. Payments are processed through:

• Apple In-App Purchase (iOS)
• Google Play Billing (Android)
• RevenueCat (the subscription processor we use to manage entitlements)

We never receive or store your payment information (card number, CVV, etc.). Apple and Google handle that directly. From RevenueCat we only receive your entitlement status (active / cancelled / expired).

1.5 Technical information

Automatically, we log:

• Device type and operating system (for support)
• App version
• Errors and crashes, including the error message, stack trace, request path and an internal technical identifier (an opaque ID tied to your account), to fix bugs

Error reports are processed by an external monitoring provider (Sentry — see Section 4). We configure that service so it does not receive your email, IP address or session tokens.

We do not use advertising tracking cookies and we do not track your location, nor do we use behavioral analytics or advertising tools.

1.6 Optional coaching questionnaire

The App may offer an optional questionnaire so you can request information about our personal coaching service (a separate service operated by Alejandro Sánchez, not part of the App's core functionality). Completing it is entirely voluntary — you do not need to fill it out to use the App.

If you choose to complete it, we collect the information you provide, which may include:

• Full name
• Phone number
• Email address
• Instagram username (optional)
• Your current fitness goals and what you find most challenging (free text)

We use this information solely to contact you and follow up about personal coaching, outside the App. We do not use it for advertising and we do not sell or rent it to third parties. If you delete your account, the responses associated with it are deleted automatically. If you submitted them in guest mode (without an account), you can request their deletion at any time by writing to [email protected].

These responses are stored on our own backend server (hosted on Railway — see Section 4) and are not shared with third-party advertising or marketing services.

1.7 Social features (friends, challenges and groups)

Step Friend includes optional social features. You do not need to use them to play. They only apply once you create an account and choose to connect with other people — in guest mode, no social data leaves your device.

When you use these features, the following information about you becomes visible to the specific users you connect with (the friends whose requests you accepted, the members of a group you joined, or the participants of a challenge you entered):

• Your username and display name
• Your axolotl (avatar, skin and its happiness/health level)
• Your step activity relevant to the feature: today's steps, your daily goal, your progress within a challenge, and your position (ranking) in a group or challenge
• Your streak and level
• The preset messages you send. Messaging between users is limited to a fixed list of predefined phrases — there is no free-text chat.

This is not a public profile: only people you have connected with can see it, and it is never shared with advertisers or used for advertising. Other users never see your email, password, location, health readings (such as heart rate) or the body metrics described in Section 1.2.

Names you create: your username and any group name you create are visible to other users. You must not use names that are offensive, obscene, hateful or that impersonate someone else (see the Terms of Use).

Safety: you can block any user and report users or content you consider abusive, from within the App. When you block or report someone, we store that record so we can operate these safety features and review the report.

To connect with others, you search for a person by their username and send a friend request; a connection is only created once the other person accepts. We do not upload your phone contacts.

2. How we use your information

We use the collected data exclusively to:

1. Operate the App — save your progress, display your axolotl with its outfits, calculate rewards based on your steps.
2. Sync across devices — so that if you reinstall the App or switch phones, you don't lose your progress.
3. Process subscriptions — verify that your Pro subscription is active.
4. Send you transactional emails — email verification, password recovery, receipts. We do not send marketing unless you explicitly request it.
5. Improve the App — diagnose and fix errors from crash/error reports (see Section 1.5). We do not use behavioral analytics of individual users.

We do not use your health data for:

• Advertising
• Analysis of individual people
• Sharing with insurers, employers or third parties

3. How we store your information

3.1 Local storage

Most of your data lives locally on your device inside a SQLite database encrypted by the operating system. This includes your steps, progress, coins, and inventory.

3.2 Server storage

For cross-device sync, a copy of your progress is backed up on our backend server, hosted on Railway (a cloud infrastructure provider). The server only receives snapshots when a specific event occurs (purchase, customization, level-up, streak record) — we never do continuous polling nor track your activity in real time.

If you choose to use the App without creating an account (guest mode), no data leaves your device.

4. Sharing information with third parties

We share strictly necessary information with the following providers:

We do not sell or rent your information to anyone. Nor do we share it with advertisers.

If we integrate other providers in the future, we will update this policy and notify you.

5. Your rights

You have the right to:

• Access your data — You can view your profile information inside the App.
• Correct your data — You can edit your username, display name and time zone from your profile.
• Delete your account — You can delete your account directly in the App (Profile → Delete account), which erases your data from our server. You can also request it by emailing [email protected]; we will process the request within a maximum of 30 days.
• Export your data — You can request a copy of your data by contacting us.
• Revoke health permissions — You can disable access to HealthKit/Health Connect from your device settings at any time.

To exercise any of these rights, write to us at [email protected].

6. Children's privacy

Step Friend is not directed to children under 13. If you are under 13, you must not use the App or provide personal information.

If we discover that we have collected information from a child under 13 without verifiable parental consent, we will delete it immediately.

If you are a parent/guardian and believe your child provided us information, contact us at [email protected].

7. Security

We implement reasonable technical measures to protect your information:

• Passwords encrypted with bcrypt
• Authentication tokens with expiration (JWT)
• Encrypted HTTPS connections between the App and the server
• Restricted access to the server database

However, no system is 100% secure. If you detect a security issue, report it to [email protected].

8. Data retention

• Active account: we retain your data while your account is active.
• Deleted account: when you delete your account (from the App or by request), we erase your data from the server within 30 days (except minimal records required by tax or fraud-prevention law, kept for up to 5 years).
• Health data: deleted together with your account. We do not keep it separately.
• Coaching questionnaire responses: those associated with your account are deleted automatically when you delete it. Those submitted in guest mode (without an account) are kept until you request their deletion at [email protected].

9. Changes to this policy

We may update this policy occasionally. If we make significant changes:

• We will notify you within the App
• We will send an email to your registered address
• The "Last updated" date in the header will reflect the change

Continued use of the App after an update constitutes acceptance of the new policy.

10. Governing law

This policy is governed by the laws of the United Mexican States. Any dispute related to it will be resolved in the competent courts of Mexico City.

If you are a resident of the European Economic Area (EEA), the United Kingdom or California (USA), you may have additional rights under the GDPR, UK GDPR or CCPA respectively. To exercise them, contact us.

International transfers: our infrastructure and service providers (Railway, RevenueCat, Resend and Sentry — see Section 4) operate in the United States, so your data may be processed outside your country of residence, including outside the EEA and the United Kingdom. We take reasonable steps to ensure such transfers are subject to appropriate safeguards.

11. Contact

If you have questions, comments or complaints about this policy: