Privacy.

Who we are

Stepa is built by Harry, Seb, and Ollie — three friends in the UK making a step tracker for walking with the people you love. The website at getstepa.com and the Stepa app are operated by SocialClimb Marketing Ltd, a company registered in England & Wales (company no. 16858678) with registered office at 67 Illingworth, Windsor, United Kingdom, SL4 4UP. SocialClimb Marketing Ltd is the data controller for the purposes of the UK GDPR and, where we offer Stepa to people in the European Economic Area, the EU GDPR.

For any privacy question, contact us at hello@getstepa.com. We aim to reply within 14 days.

What we collect — and why

If you join the waitlist

• Your email address. So we can tell you about Stepa and when it’s available to you. Stored securely in Google Firestore.
• The time you signed up and the source page (always website at the moment).
• Your browser’s user-agent string. Used solely to help us debug if signups break in a particular browser. Not used for tracking.

That is the entire dataset we hold for waitlist signups, alongside which invite link you arrived through if you came via one. Your IP address is used momentarily to rate-limit the form and is not stored.

If you use the Stepa app

• Your name and avatar — so your friends can find you.
• The email or Apple/Google account you sign in with — for authentication only.
• Your step count — read from your phone’s motion sensor (Stepa’s built-in pedometer) and, where you grant permission, from Apple Health (HealthKit) on iOS. We only read step totals — we do not read your heart rate, sleep, workouts, or any other health data.
• Your location and walking routes. Stepa uses your phone’s location to plot the routes you walk and to recognise when you’ve started walking. With your permission (“Always allow” on iOS), Stepa does use background location so it can detect when you begin a walk and start recording automatically without you having to open the app. You can change this permission at any time in your phone’s settings — switch it to “While using” or turn it off entirely. Stepa still works without background location; you’ll just need to tap “Start a walk” yourself.
• Your friend list — the small circle of people you choose to walk with. We never see, share, or surface them publicly.
• Your duels — when you accept a duel, we store its start date, end date, and the participants’ step totals so we can show the leaderboard.

Step counting itself does not require any location data. Location is only used for route plotting, walk detection, and the loops library.

Legal basis (UK & EU GDPR)

• Contract. Most of what we collect is necessary to provide Stepa to you (your account, your steps, your friends, your duels).
• Legitimate interest. The waitlist email and the user-agent string are stored under legitimate interest — to tell you about Stepa and its availability, and to debug signup issues. We also email you about your own activity on Stepa: a monthly summary of your walking, weekly results if you place in the top three, a note when a friend challenges you or someone you invited joins, and an occasional nudge if you have not been out in a while. Every one of these carries an unsubscribe link that works immediately, and you can turn them off in Settings at any time.
• Consent. Push notifications, location for walks, and motion data all require explicit OS-level permission. You can revoke any of them at any time in your device settings. News about new Stepa features is also consent-only — we send it solely if you have asked for it, and you can withdraw that at any point without affecting anything else.

Where your data lives

We use a small handful of trusted services to make Stepa work. Each one is named here so you know exactly who has touched your data.

• Google Firestore (hosted in europe-west2 / London) — stores your account, steps, friend list, duels, and waitlist signups.
• Resend — our email provider. Sends account emails (verification, deletion confirmation), service emails about your own activity on Stepa, and product news where you have opted in. Resend processes your email address on our instructions and uses it for nothing else.
• Vercel — hosts getstepa.com. Vercel may log basic request data (IP, user-agent, URL) at the edge for security and DDoS protection. Vercel Analytics and Speed Insights run only if you accept them in the cookie banner (see below).
• Apple App Store and Google Play — distribute the Stepa app and handle authentication when you sign in with Apple or Google.
• Sentry — receives anonymised crash reports and performance data when something goes wrong in the app or on the website. We disable IP collection and scrub personal data (including location coordinates) before sending. Sentry stores reports in the EU and is GDPR-compliant.
• RevenueCat — runs Stepa Pro subscriptions. It receives your Stepa user ID and the purchase itself (which plan, when, whether it renewed) so we can unlock Pro and honour restores across your devices. It never receives your name, email, location or step data. Payment card details go to Apple or Google and are never seen by us or by RevenueCat.
• Hetzner — hosts the routing service that builds your walking loops, on servers in Germany. When you ask for a walk it receives the coordinates you are starting from in order to generate routes around you. Requests are not tied to your account beyond the sign-in check, and coordinates are not retained to build a history of where you have been.
• Meta (Facebook) — the Stepa app includes the Meta SDK, which reports app installs so we can tell which of our own ads and posts brought people to Stepa. On iOS we ask first through Apple’s App Tracking Transparency prompt, and your advertising identifier is only used if you allow it. It does not receive your step data, routes, friends or location.

We use Vercel Analytics and Vercel Speed Insights to monitor page performance (load times, Web Vitals). These are privacy-friendly, cookie-free tools that do not track individual users or build profiles. We do not use Google Analytics, Mixpanel, Segment, the Facebook Pixel or Hotjar on this website.

The Stepa app includes the Meta SDK for install attribution, described above — that is the one advertising-related tool we use, and on iOS it only uses your advertising identifier if you agree to the App Tracking Transparency prompt. We do not run adverts inside Stepa, and we do not sell advertising space. We do not have advertisers to please.

Who we share your data with

Nobody. We do not sell, rent, license, share, or otherwise transfer your personal data to third parties for marketing purposes. Ever.

The only people who see your data are: you, the friends you explicitly add to your circle, and the trusted infrastructure providers listed above (who process it on our instructions and only for the purpose of running the service).

How long we keep your data

• Waitlist email: up to 12 months from the date you join the waitlist, after which we delete it — unless you have created a Stepa account, in which case the retention periods for accounts below apply. We delete it sooner if you ask us to or unsubscribe.
• Unsubscribe list: if you unsubscribe, we keep your email address (the address itself, not a coded version) and the date you unsubscribed, and use them only to make sure we never send you marketing emails again. We keep this record for as long as we send emails.
• Active accounts: for as long as your account exists. Step data is retained indefinitely so your history stays intact.
• Deleted accounts: we hard-delete your account, your step data, your friend list, and your duels within 30 days of deletion. Some backup snapshots may persist for an additional 60 days before being overwritten.

Your rights

Under the UK GDPR and the EU GDPR you have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate data.
• Delete your data (the “right to be forgotten”).
• Port your data to another service in a machine-readable format.
• Object to how we process your data.
• Restrict processing in certain circumstances.

To exercise any of these rights, email hello@getstepa.com from the address you signed up with. We aim to action requests within 14 days.

If you’re not satisfied with how we’ve handled your data, you have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

Cookies

We ask before we set anything that isn’t essential. The first time you visit getstepa.com a banner offers Accept all or Reject non-essential, and your choice is remembered in your browser’s local storage so we don’t ask again.

Essential — a small amount of local storage remembers the cookie choice itself and, if you arrived through an invite or referral link, which one, so the app can credit it. These are needed for the site to work and are not optional.

Analytics, only if you accept — Vercel Analytics and Vercel Speed Insights load only after you press Accept all, and not at all if you reject. They measure page views and load performance. They are cookie-free and do not build a profile of you or follow you to other websites.

We do not use advertising cookies or third-party ad trackers on this website, and we never have. You can change your mind at any time by clearing site data for getstepa.com in your browser, which makes the banner appear again.

Children

Stepa is intended for people aged 16 and over. We do not knowingly collect personal data from anyone under 16. If we become aware that a child under 16 has provided us with personal data, we will delete it immediately. If you are a parent or guardian and believe your child has signed up, please contact us at hello@getstepa.com.

International transfers

Your data is stored in Google Firestore’s europe-west2 region (London, UK), so it stays within the UK. Resend and Vercel are US-headquartered and may process some data in the US — both have signed Standard Contractual Clauses (SCCs) and are certified under the EU-US Data Privacy Framework, providing equivalent protection to UK data protection law. The routing service that builds your walking loops runs on Hetzner servers in Germany.

Our representative in the EU

We are established in the United Kingdom. Where we offer Stepa to people in the European Economic Area, Article 27 of the EU GDPR requires us to name a representative inside the EEA who you and data protection authorities can contact about your data.

EU representative: [TO BE APPOINTED — name and address before Stepa is marketed in the EEA]

Contacting our representative does not replace your right to complain to your own national data protection authority, and you can always reach us directly at hello@getstepa.com.

Changes to this notice

We’ll update this page when our practices change. The “Last updated” date at the top reflects when. If the change is material (e.g. we start using a new processor or collecting new data), we’ll email you in advance.

Contact

Questions, requests, complaints, or just curious — email hello@getstepa.com. Real humans read it. Harry, Seb, or Ollie will reply.

To delete your data or account, the fastest way is the self-service form at getstepa.com/delete — enter your email, click the verification link we send you, and your data is gone within minutes. Or email hello@getstepa.com with the subject “Delete my data” (from the address you signed up with) and we’ll action it within 14 days.