Privacy Policy

Last Updated: August 31, 2026

The short version

Your steps are social. Your data isn’t.

Steps Club exists to connect you with friends, not to collect things about you. Here’s the whole picture in about thirty seconds.

We never

Sell your data, or share it with advertisers
Collect your location — not where you walk, not your route
Store your contacts, or the phone numbers in them
Track you across other apps and websites
Use tracking cookies, or show you ads
Write anything back to Apple Health or Health Connect

We do collect

Your step count, from Apple Health, Health Connect, or your phone’s motion sensor
A display name, username, and photo — all chosen by you, never your legal name
An email address or phone number, to sign you in
Your walks, and the reactions and messages you send friends
How you use the app, so we can fix what’s broken

The things people ask us

Can anyone see where I walk?: No. We never receive your location — not your route, not the places you go. The app asks for location permission on iOS for one reason: it is the only way Apple lets us keep counting your steps while your screen is locked. The session is set up to receive no coordinates at all. How location works ↓
What happens to my contacts?: They never leave your phone in readable form. To show you which friends are already here, we scramble each phone number into an unreadable fingerprint, compare the fingerprints, and throw them away. We never store your address book. How contact matching works ↓
What can my friends actually see?: Your display name, photo, username, and step count. While you are on a walk, friends can see that you are walking and your live step count, so they can cheer you on. That stops the moment your walk ends. What friends see ↓
If I delete my account, is it really gone?: Almost all of it, immediately — your profile, steps, walks, photos, and phone number. Two things linger: a daily analytics copy we keep as dated history, and anything you sent into a friend’s feed. We will erase both by hand if you email us, and we would rather say so than promise more than we do. Exactly what gets deleted ↓

This summary is here to be read, not to replace what follows. The full policy below is the one that governs how we handle your data, and it covers things this card leaves out.

Welcome to Steps Club ("we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App"), our website (e.g. stepsclubapp.com), or our Service. It covers both the App and the website, including invite pages and shared invite links. We are committed to protecting your privacy and handling your data with care.

By downloading, installing, accessing, or using the Steps Club app or our website, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not use the App or the website.

This Service is provided by Nicholas Cernera.

CONTACT INFORMATION

For questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us:

Support Email: nick@cernera.design

We will respond to your inquiries as promptly as possible.

1. INTRODUCTION

This Service is provided by Nicholas Cernera.

2. INFORMATION WE COLLECT

We collect several types of information to provide and improve our Service:

2.1 Personal Information You Provide

When you create an account or use our Service, we may collect:

Display name — the name you pick for yourself, shown to friends and club members. We never ask for your legal name.
Email address
Phone number (used for phone-based sign-in via SMS one-time passcode, and/or to help friends find you via contact matching)
Profile picture and club logos (if you choose to add them) — see Section 2.10 for how the camera and photo library are used
Username
Authentication information (via Apple Sign In, Google Sign-In, email/password, or phone number verified with an SMS one-time passcode)

2.2 Health and Fitness Data

With your explicit consent, we collect health and fitness data from your device:

Step count data from Apple HealthKit (iOS) or Health Connect (Android)
Motion and step-counter data from your device's sensors. When you start a walk, we count your steps in real time using your device's built-in pedometer (Apple's Core Motion on iOS, the step-counter sensor on Android). This is a separate source from HealthKit and Health Connect, and it is what makes the live step count on your Lock Screen and in the walk view update as you move.
This data is used solely to track your daily step count and enable social features like leaderboards and step sharing with friends

We do not write data to HealthKit or Health Connect. We only read step count data that you have authorized us to access.

2.3 Usage and Analytics Data

We automatically collect certain information about how you use the App:

App usage data (features accessed, screens viewed)
Product interaction data for analytics purposes
Device information (device type, operating system version)
App version and build information

This section describes analytics collected inside the mobile app. Website analytics (including UTM attribution) are covered in Section 2.9.

2.4 Crash and Error Data

To improve app stability and fix bugs, we collect:

Crash reports and error logs
Technical diagnostic information
Performance data

2.5 Location Permission (iOS)

We do not collect, store, or transmit your location. Not your coordinates, not your route, not the places you walk. We ask for location permission anyway, and you deserve to know why.

When you start a walk on iOS, the App asks for location permission and starts a location session in the background. iOS suspends apps shortly after you lock your screen, which stops the step counter mid-walk. An active location session is the mechanism Apple provides to keep the step counter running, so your steps keep counting while your phone is in your pocket. That is the only reason we start one.

The session is registered to receive no location readings at all — our code never receives a coordinate — and it requests the lowest accuracy iOS offers (roughly city-block level, using cell and Wi-Fi rather than GPS). iOS shows a blue indicator in your status bar while it runs, and we stop the session as soon as your walk ends.

Location permission is optional. If you decline it, walks still work normally while the App is open — your step count just stops updating when your screen is locked, and catches up when you reopen the App. You can change this anytime in Settings > Privacy & Security > Location Services > Steps Club. On Android we do not request location at all; the permission is explicitly blocked in the app's manifest.

2.6 Invite Links and Website

When you share a friend or club invite from the App, we create and store an invite record that may include your user ID, username, invite type, and for club invites the club ID. We use this to deliver the invite and measure attribution; invite links expire (e.g. within 48 hours). When you complete onboarding after arriving from an invite, we also store the inviting user's ID on your account record (as "invitedByUserId") so that referral analytics can credit the correct inviter.

When you open an invite link on our website (e.g. stepsclubapp.com), we may collect your IP address, screen size (width and height), and timezone to associate your device with that invite—for example, so we can recognize you after you install the App. Our servers derive your IP from the request; we do not require you to send it.

When you open the App after installing it, we may send screen size and timezone (and our servers may use your IP address) to match your app session to a prior invite click, so we can attribute the install to the correct invite and show you the right invite in the App.

If you tap "Have an invite link?" in the App, we read the clipboard only to detect Steps Club invite URLs and to open that invite in the App. We do not store or send raw clipboard content; we only use the parsed invite token to fetch and display the invite.

Our website may use cookies or similar technologies (such as session storage) in connection with invite pages to provide invite functionality. For other uses of cookies or similar technologies on our website, please contact us.

2.7 Feedback You Submit

When you submit feedback through the in-app review prompt, we collect the message you write and, if you opt in to a reply, the email address you provide. We also attach basic technical context (your user ID, authentication method, app version and build number, platform, OS version, and locale) so we can reproduce and respond to issues. Feedback is stored in our database and emailed to our team to review.

2.8 Device Contacts

If you grant contacts permission, the App reads phone numbers from your device's address book and sends normalized phone numbers to our servers over HTTPS so we can tell you which of your contacts are already on Steps Club. We do not store your contacts list or the raw phone numbers from your address book. On the server, each submitted number is hashed with SHA-256 and a secret salt, compared against our hashed index of Steps Club users' phone numbers, and discarded; we return only matched user profiles back to the App.

You can revoke contacts permission at any time through your device's privacy settings. Revoking permission stops future contact matching but does not remove prior match results from your device.

2.9 Website Analytics and Attribution

When you visit our website (stepsclubapp.com or our blog), we collect aggregate analytics about your visit to understand how people find and use the site. This includes: pages you view, approximate country and device type, the page that referred you, and — if applicable — campaign parameters from links you clicked to reach us (e.g. utm_source=linkedin).

We do not use tracking cookies for website analytics. We use a first-party identifier stored in your browser's localStorage for up to 30 days — it is not shared across sites and is not a tracking cookie — plus attribution data so we can credit the channel that first brought you to the site.

These events go to two places: PostHog (see Section 4.7) and our own servers. We send a copy of key events — pageviews, invite views, app store clicks, and blog reading milestones — to our own Google Cloud infrastructure, where they are stored alongside our app analytics so we can see a complete picture of how someone found us. These copies carry the same first-party identifier described above, never cookies or third-party IDs.

Because we do not use tracking cookies or persistent cross-site identifiers for website analytics, no consent banner is required under GDPR or CCPA in our interpretation of those laws.

2.10 Camera and Photo Library

If you choose to set a profile picture or a club logo, the App asks for permission to open your camera or your photo library. We only receive the single image you pick or take — we never browse, scan, or upload your photo library, and we do not read photo metadata such as where a photo was taken. The image you choose is uploaded to our file storage and becomes visible to friends and club members, as described in Section 6.4.

When you finish a walk you can save a share card — an image summarizing that walk — to your photo library. That asks for permission to add photos. Saving a share card writes to your library; it does not give us access to read anything already in it. Both permissions are optional and you can change them anytime in your device's privacy settings.

2.11 Walks and Social Activity

Steps Club is a social app, so some of what you do is recorded and shown to people you have connected with. We collect and store:

Your walk history — when a walk started and ended, and how many steps it covered
Live walk status — while a walk is in progress, the fact that you are walking and your live step count are published so friends can see you are out walking and join in. This stops when your walk ends.
Activity feed entries — milestones and events (finishing a walk, hitting a goal, joining a club) shown to your friends and clubs
Reactions and messages you send — emoji reactions and short preset messages (such as "Nice job!") that you send to friends and club members, along with who sent them and who received them

On iOS, your live walk may also appear on your own Lock Screen and in a home screen widget. That display happens on your device.

3. HOW WE USE YOUR INFORMATION

We use the collected information for the following purposes:

3.1 Core App Functionality

To provide step tracking and fitness features
To enable social features (friends, clubs, leaderboards)
To manage your account and authenticate your identity
To sync your data across your devices
To send you push notifications (step reminders, friend requests, club updates, etc.)

3.2 Service Improvement

To analyze app usage and improve our Service
To fix bugs and improve app performance
To develop new features and functionality

3.3 Communication

To respond to your support requests
To send you important updates about the Service
To notify you about friend requests, club invitations, and other social activities

3.4 Subscription Management

To process subscription purchases and manage your Pro subscription
To verify subscription status and unlock premium features

3.5 Invite Links and Attribution

We use invite data and the device-matching data described in Section 2.6 to:

Deliver and display invites (including sender username and profile picture, and for club invites the club name and logo) on the website and in the App
Attribute app installs to the correct invite link
Improve invite and referral flows

4. THIRD-PARTY SERVICES

We use third-party services that may collect, store, or process your information:

4.1 Firebase (Google)

We use Google Firebase services for:

Authentication (Firebase Auth)
Database storage (Firebase Realtime Database)
File storage (Firebase Storage for profile pictures)
Analytics (Firebase Analytics)
Cloud Functions (server-side processing)
Push notifications (Firebase Cloud Messaging)
Phone authentication via SMS one-time passcode (Firebase Auth)
Abuse prevention (Firebase App Check). To stop others from impersonating the App and abusing our servers, the App asks Apple or Google to confirm it is a genuine, unmodified copy of Steps Club running on a real device. This uses Apple's App Attest and Google's Play Integrity. It checks the app, not you — it does not identify you and collects no personal information.
Analytics storage (Google BigQuery). See Section 5.1 for what we keep there and why.

SMS messages for phone sign-in are delivered by Firebase Auth's upstream SMS carriers. Standard message and data rates from your mobile carrier may apply.

Your data stored with Firebase is subject to Google's Privacy Policy.

4.2 Sentry

We use Sentry for error tracking and crash reporting. Sentry collects technical diagnostic information to help us identify and fix bugs.

When you are signed in, we attach your user ID, email address, and username to the errors we send to Sentry. Without it, an error is an anonymous stack trace and we cannot tell whether one person hit a bug a hundred times or a hundred people hit it once — or follow up with you if you report a problem. Errors from our servers carry your user ID only.

Sentry's Privacy Policy

4.3 RevenueCat

We use RevenueCat to manage subscriptions and verify your subscription status. RevenueCat works with Apple App Store and Google Play Store payment systems. We do not receive or store your payment card details; all payment processing is handled by Apple or Google.

RevenueCat's Privacy Policy

4.4 Apple and Google

Apple HealthKit (iOS): Your health data is accessed through Apple's HealthKit framework, which provides privacy controls built into iOS
Health Connect (Android): Your health data is accessed through Google's Health Connect platform
Apple Sign In: If you use Apple Sign In, your authentication is handled by Apple
Google Sign-In: If you use Google Sign-In, your authentication is handled by Google, which confirms your identity and shares your email address with us. Your display name and username are still the ones you choose in the App.
Device motion sensors: Real-time step counting during walks uses Apple's Core Motion (iOS) or the Android step-counter sensor, as described in Section 2.2
Payment Processing: Subscription payments are processed through Apple App Store or Google Play Store

4.5 Resend

We use Resend to deliver transactional emails (such as account-related emails) and to route feedback you submit through the in-app review prompt to our team. When you submit feedback, the contents of your message and any reply email you provide are transmitted through Resend.

Resend's Privacy Policy

4.6 Vercel Analytics

We use Vercel Analytics to count pageviews and measure Core Web Vitals (page performance) on our website. Vercel Analytics is cookieless and collects aggregate, non-identifying visit data.

Vercel's Privacy Policy

4.7 PostHog (Analytics)

We use PostHog to understand how visitors move through our website — which pages they view, which calls-to-action they click, and which campaigns drive the most app installs. Our PostHog configuration does not use cookies and does not record session replays. Events are associated with a first-party identifier stored in your browser's localStorage for up to 30 days (see Section 2.9); we do not use cross-site identifiers or sell this data. Event data is stored on PostHog Cloud (US region).

We send these events to hop.stepsclubapp.com — a subdomain of this site — which forwards them to PostHog. Routing through our own domain means ad blockers and privacy extensions drop fewer events, so our numbers are more accurate. It does not change what we collect or who we share it with. PostHog runs this forwarding on Cloudflare's infrastructure, so events pass through Cloudflare in transit.

PostHog's Privacy Policy

5. DATA STORAGE AND SECURITY

5.1 Data Storage

Your data is stored on secure servers provided by Google Firebase (Google Cloud Platform). Data is stored in the United States, but may be processed in other locations where Google operates data centers.

Our analytics copy. Once a day we copy account records into Google BigQuery, a Google Cloud analytics database, so we can understand how Steps Club is being used and how it changes over time. That copy includes your user ID, display name, username, profile picture link, step history, daily goal, friend and club counts and IDs, subscription status, platform, and account dates. It does not include your email address, your phone number, or your contacts.

Because this copy is taken daily and kept as a dated history, it holds snapshots of your account as it looked on past days. This is our own infrastructure, not a third party's — the data stays inside our Google Cloud project, is not sold, and is not shared with anyone. See Section 7.2 for what happens to it when you delete your account.

5.2 Security Measures

We implement appropriate technical and organizational measures to protect your information:

Data encryption in transit (HTTPS/TLS)
Salted hashing for phone numbers used in contact matching, with the salt held in Google Secret Manager (see Section 5.3)
Device attestation to block impersonated copies of the App (see Section 4.1)
Secure authentication methods
Access controls and authentication requirements

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

5.3 Hashed Phone Index

To enable privacy-preserving contact matching, we maintain a server-side index of SHA-256 + salted hashes of Steps Club users' phone numbers. The salt is stored in Google Secret Manager and is never exposed to clients. When you delete your account or remove your phone number, your entry is removed from this index.

6. DATA SHARING AND DISCLOSURE

We do not sell your personal information or health data.

We may share your information only in the following circumstances:

6.1 With Your Consent

When you explicitly consent to sharing (e.g., sharing your step count with friends or club members)
When you share a walk card or invite link to another app you choose

6.2 Service Providers

With third-party service providers who perform services on our behalf (Firebase and Google Cloud, Sentry, RevenueCat, Resend, Vercel, PostHog, and Cloudflare, each described in Section 4) and who are bound by contractual obligations to keep your information confidential.

6.3 Legal Requirements

When required by law, court order, or governmental regulation
To protect our rights, privacy, safety, or property, or that of our users
In connection with any legal investigation

7. YOUR RIGHTS AND CHOICES

You have certain rights regarding your personal information:

7.1 Access and Correction

You can access and update your profile information directly within the App's settings, including your display name, username, profile picture, and phone number. To remove a phone number entirely, use the App's settings or contact us.

7.2 Account Deletion

You can delete your account at any time through the App's settings, at Settings > Delete Account. Deletion is permanent and cannot be undone.

What is deleted right away:

Your account record — profile, username, email address, step history, walk history, goals, and settings
Your profile pictures
Your sign-in credentials
Your membership in every club and your place on every friend list
Your phone number and your entry in the hashed phone index, so you stop appearing in other people's contact matches
Your pending friend requests and your entry in our search index

What can survive deletion, and for how long — we would rather tell you than promise more than we do:

Our daily analytics copy (Section 5.1). That copy is kept as a dated history, so snapshots of your account from past days remain in it after you delete. We record your deletion and exclude you from our reporting, but the historical rows are not erased on request today. If you want them removed, email us and we will do it manually.
Things you posted into other people's feeds. Reactions, messages, and activity entries you sent to friends or clubs live in their records, not only yours, and are not removed when you delete. They keep showing the name and picture you had when you sent them.
Crash and error reports (Section 4.2). Reports already sent to Sentry stay there until Sentry's retention period expires and they age out automatically.
Subscription records held by Apple, Google, or RevenueCat. Deleting your Steps Club account does not cancel a subscription — you cancel that through the App Store or Google Play, and those companies keep their own transaction records.
Anything we are required to keep by law.

If you want a full erasure, including the analytics history, email us at nick@cernera.design and we will take care of it by hand.

7.3 Analytics Opt-Out

You can opt out of analytics data collection through the App's privacy settings. This will disable Firebase Analytics for your account.

7.4 Health Data Access

You can revoke access to your health data at any time through your device's privacy settings:

iOS: Settings > Privacy & Security > Health > Steps Club
Android: Settings > Apps > Steps Club > Permissions > Health data

7.5 Push Notifications

You can manage push notification preferences through your device settings or within the App.

7.6 Location, Motion, Camera, Photos, and Contacts

Every one of these is optional, and you can grant or revoke each one independently in your device's settings — on iOS under Settings > Privacy & Security, on Android under Settings > Apps > Steps Club > Permissions.

Location — declining it means your step count pauses while your screen is locked during a walk (Section 2.5)
Motion — declining it means walks fall back to HealthKit or Health Connect and your live step count won't update in real time
Camera and photos — declining them means you can't set a profile picture or club logo, or save walk share cards (Section 2.10)
Contacts — declining it means we can't tell you which of your contacts already use Steps Club; you can still add friends by username or invite link (Section 2.8)

Revoking a permission stops future collection. It does not by itself remove data we already hold — use account deletion (Section 7.2) or email us for that.

8. DATA RETENTION

We retain your information for as long as your account is active or as needed to provide you with our Service. When you delete your account, we will delete or anonymize your personal information within a reasonable time period, except where we are required to retain information for legal purposes.

Invite records and invite-click (device-matching) data are kept only for limited periods: invite records typically expire within a short window (e.g. 48 hours), and data used to match a post-install app open to a prior invite click is retained only for a short period (e.g. a few hours) and is deleted or overwritten after use as described in our product.

We may retain certain other information:

As required by law or for legitimate business purposes
To resolve disputes and enforce our agreements
Our daily analytics copy (Section 5.1) is kept as a dated history with no fixed expiry, so it holds snapshots of accounts as they looked on past days, including after deletion. Section 7.2 explains how to have yours removed.
Website analytics events are retained by PostHog under its own retention policy, and in our own analytics storage

9. CHILDREN'S PRIVACY

Our Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at nick@cernera.design and we will take steps to delete such information.

If we become aware that we have collected personal information from a child under 13, we will delete that information promptly.

By using our Service, you represent that you are at least 13 years of age.

10. INTERNATIONAL USERS

If you are using our Service from outside the United States, please be aware that your information may be transferred to, stored in, and processed in the United States and other locations where our service providers operate. By using our Service, you consent to the transfer of your information to the United States and processing in accordance with this Privacy Policy.

11. CALIFORNIA PRIVACY RIGHTS

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including:

The right to know what personal information we collect, use, and disclose
The right to request deletion of your personal information
The right to opt out of the sale of personal information (we do not sell personal information)

To exercise these rights, please contact us at nick@cernera.design.

12. CHANGES TO THIS PRIVACY POLICY

We may update our Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date at the top of this Privacy Policy. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted.

Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated Privacy Policy.

13. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Email: nick@cernera.design

Steps Club Privacy Policy
Service provided by Nicholas Cernera
Last Updated: August 31, 2026

View Terms & Conditions →Back to Home