Privacy Policy

1. Who we are

StepStation ("StepStation," "we," "us") is a walking and treadmill-desk tracker available at stepstation.app and in its installable desktop and mobile apps (together, the "Service"). StepStation is operated by Ethan Gale, who is the controller of the personal information described here. You can reach us at support@stepstation.app.

2. Information we collect

Information you give us

Payment information

Payments are handled by Stripe. Your card details go directly to Stripe and never reach our servers. We receive only limited information from Stripe: a customer ID, your plan, subscription status, billing dates and, where applicable, the country of your billing address.

Information collected automatically

Our hosting provider records standard technical logs when you use the Service, such as IP address, browser type, device type, pages requested and error details. We use these to operate, debug and secure the Service. We do not currently use third-party analytics or advertising trackers. If we add privacy-respecting product analytics in the future, we'll update this policy first.

3. How we use your information

• Provide the Service: record and sync your walks across devices, calculate stats, goals, streaks and badges, and show group leaderboards.
• Manage your account and subscription: authenticate you, process payments and trials, and grant Pro, Founder or Teams features.
• Communicate with you: send service emails (account confirmation, receipts, billing notices) and, if enabled, reminder and weekly recap emails. Each recap email has an unsubscribe link.
• Keep the Service safe and working: prevent fraud and abuse, fix bugs, and improve features.
• Comply with law: keep tax and accounting records, and respond to lawful requests.

We do not use your information for automated decisions that have legal or similarly significant effects on you, and we do not use your activity data to train AI models.

4. Legal bases (EEA, UK and Switzerland)

If data-protection law in these regions applies to you, we rely on:

• Performance of a contract: providing the Service and your subscription.
• Consent: optional features such as wearable sync, body-weight data and marketing emails. You can withdraw consent at any time in Settings.
• Legitimate interests: security, preventing fraud, and improving the Service, balanced against your rights.
• Legal obligation: tax, accounting and legal requests.

5. Who we share it with

We share personal information only with service providers that process it for us under contract ("processors" or "service providers"), with other users where you choose to share, or when required by law.

Other users. When you join a group, members can see your display name, profile photo and the group-related activity totals shown on the board. If a group admin connects a chat webhook, group updates may be posted to that workspace.

Legal and business transfers. We may disclose information if required by law or to protect rights and safety. If StepStation is involved in a merger, acquisition or sale of assets, your information may be transferred; this policy will continue to apply to it.

We do not sell personal information and do not share it for cross-context behavioral advertising, as those terms are defined under California law.

6. Device storage & cookies

StepStation stores your settings, theme and (in guest mode) your walk history in your browser's local storage so the app works offline. Our authentication provider stores a session token so you stay signed in. These are strictly necessary for the Service. We do not use advertising or cross-site tracking cookies. Stripe may set its own cookies on its checkout pages for fraud prevention.

7. How long we keep it

• Account and activity data: until you delete it or delete your account. Deleted data is removed from active systems within 30 days and from backups within 90 days.
• Billing records: as long as required for tax and accounting law, typically 7 years. These are held by Stripe and us.
• Technical logs: short-term, generally no longer than 30 days.
• Guest data: stays on your device until you clear it. We never receive it.

8. Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, export (portability), restrict or object to processing of your personal information, and to withdraw consent. Many of these are built in:

• Export: Settings → Modify History → Export.
• Correct or delete walks: edit or remove them in the app, or erase all history in Settings.
• Delete your account: email us from the address on your account and we'll delete it within 30 days. Please cancel any active subscription first.
• Emails: use the unsubscribe link in any recap email, or turn emails off in Settings.
• Wearables: turn off sync in Settings and revoke access in the provider's app.

For anything else, email support@stepstation.app. We'll respond within 30 days (45 days where U.S. state law allows), and may need to verify your identity first. We won't discriminate against you for exercising your rights. If you're in the EEA or UK, you may also complain to your local data-protection authority.

9. U.S. state privacy rights

Residents of California and other states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others) have the rights described above. In the last 12 months we have collected the categories listed in Section 2: identifiers, customer records, commercial information (plan and purchase history), internet activity (technical logs) and, if you provide it, health-related activity and body-weight information. We collected them from you, your devices and the services you connect, for the purposes in Section 3, and disclosed them only to the providers in Section 5.

We do not sell or share personal information, we use sensitive information only to provide the Service you request, and we honor Global Privacy Control signals. Washington and Nevada consumer-health laws: we collect consumer-health data only to provide the features you request, we don't sell it, and you can access or delete it as described above. You may use an authorized agent to make a request. If we deny your request, you may appeal by replying to our decision email, and we'll respond within the time the law requires.

10. Security

We use industry-standard safeguards, including encryption in transit (HTTPS/TLS), encryption at rest at our database provider, row-level access controls so each account can reach only its own data, hashed passwords, and least-privilege access to production systems. No method of transmission or storage is 100% secure. If a breach affects your personal information, we'll notify you and the authorities as required by law.

11. Children

The Service is not directed to children under 13 (or under 16 in the EEA and UK), and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we'll delete it.

12. International transfers

We are based in the United States and our providers may process data in the U.S. and other countries. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

13. Changes to this policy

We may update this policy as the Service changes. We'll change the "Last updated" date and, for material changes, notify you in the app or by email before they take effect.

14. Contact

Questions or requests: support@stepstation.app
StepStation, operated by Ethan Gale, United States.