Privacy Policy

1. Who We Are

Step Social is operated by EAT LEBO GROUP LTD, a company registered in England and Wales under company number 16766058, with its registered office at 80 Victoria Road, Ruislip, England, HA4 0AL.

In this Privacy Policy, "Step Social", "we", "us" and "our" refer to EAT LEBO GROUP LTD. "Service" means the Step Social mobile application, website and related services.

For UK data protection law, EAT LEBO GROUP LTD is the controller of personal information processed through Step Social, except where another party is clearly identified as the controller.

Privacy questions can be sent to:

Privacy: hello@stepsocial.app

Support: hello@stepsocial.app

2. What This Policy Covers

This Privacy Policy explains how we collect, use, share, store and protect personal information when you use Step Social.

It applies when you:

• Create or use a Step Social account
• Connect Apple Health, Fitbit or another supported wearable or health service
• Track steps, activity, routes or movement
• Join leaderboards, groups, challenges or events
• Use badges, rankings or social features
• Purchase a subscription
• Contact support or report safety concerns
• Use the Step Social website or app

Third-party platforms such as Apple, Google, Fitbit, Garmin, Samsung, app stores, map providers and wearable manufacturers have their own privacy policies. This Privacy Policy does not replace their policies.

3. Information We Collect

The information we collect depends on the features you use, the permissions you grant and the integrations you connect.

We may collect:

Account Information

This may include your email address, username, login credentials, authentication ID, country, region, language, age confirmation, account status and app preferences.

Profile Information

This may include your display name, profile image, avatar, bio, country or region, badges, rankings, membership tier and privacy settings.

Health and Fitness Information

If you grant permission, we may collect steps, walking or running distance, activity timestamps, active time, movement goals, workouts, device source, sync status and other health or fitness data you authorise through Apple Health, Fitbit, Garmin, Android Health Connect or another supported service.

Location and Route Information

If you grant permission, we may collect precise or approximate location, route start and end points, route coordinates, distance, duration and map interactions when you use route planning, walk tracking or location-based event features.

Leaderboard, Challenge and Badge Information

This may include step totals, rankings, streaks, badges, challenge results, group participation, country or regional rankings and fraud-prevention signals.

Social and User Content

This may include group names, group images, event details, invitations, chat messages, reactions, reports, blocked-user records and content you create or share.

Subscription and Transaction Information

This may include your subscription plan, purchase status, renewal date, trial status, app-store transaction ID and entitlement status. Apple or Google processes your payment details. We do not receive your full payment-card number.

Device, Technical and Usage Information

This may include device type, operating system, app version, IP address, time zone, diagnostic logs, crash data, security events, consent records and feature interactions.

Support and Safety Information

This may include messages you send to us, report evidence, investigation notes, moderation decisions, appeal requests and communications required for safety or legal purposes.

4. How We Collect Information

We collect information:

• Directly from you when you register, edit your profile or contact us
• From your device and connected health or wearable services after you grant permission
• From other users when they interact with you, invite you or report content
• Automatically through app logs, analytics, crash reports and security tools
• From Apple App Store, Google Play or other billing providers to verify subscriptions

5. Why We Use Your Information

We use personal information to:

• Create and manage your account
• Provide dashboards, step tracking, rankings, groups, events, challenges and badges
• Sync your authorised health and fitness data
• Show leaderboards and challenge results
• Generate route and activity features
• Verify subscriptions and manage paid features
• Provide support and respond to questions
• Detect abuse, cheating, fraud, manipulation or unsafe behaviour
• Moderate content, investigate reports and enforce rules
• Improve app performance, reliability and user experience
• Send service updates, security alerts and important notices
• Comply with legal obligations and respond to lawful requests

Where required by law, we rely on consent, contract performance, legitimate interests, legal obligations or explicit consent for health and fitness data.

6. Health and Fitness Data

Health and fitness data is sensitive. We only request the data types reasonably needed for the features you choose to use.

We do not sell health or fitness data. We do not use health or fitness data for advertising of any kind, employment decisions, credit decisions, insurance decisions or sale to data brokers.

Health and fitness data may be used to calculate steps, goals, rankings, badges, challenges, progress and personalised in-app motivation.

Step Social is not a medical app, medical device, diagnostic service or emergency service.

7. Google and Fitbit Data

This section explains how Step Social handles information we receive from Google, including Google Sign-In and the Google Health API (which provides Fitbit data).

What we access

• Google Sign-In: if you choose to sign in with Google, we receive your name, email address, profile picture and a Google account identifier. We use these only to create and secure your Step Social account.
• Google Health API (Fitbit): if you choose to connect Fitbit, and only after you agree on the Google permission screen, we ask for read-only access to your activity and fitness data. From that data we read only your step counts: your daily step totals (up to the last 365 days) and today's steps in 15-minute intervals, which we use to work out how many steps you took before 9am and after 8pm. We also receive your Fitbit and Google Health user identifiers so we can link the connection to your account, and we store your phone's time zone so your days line up with your phone. We do not read your distance, exercise sessions, heart rate, sleep or any other Fitbit data. We only read this data. We do not write anything to your Fitbit or Google account.

How we use it

We use Google and Fitbit data only to provide and improve the Step Social features you can see in the app: your step totals and goals, daily/weekly/monthly/all-time leaderboards, Gold Coins, badges, group and event challenges, and in-app motivation. We do not use it for any other purpose.

What we never do with it

• We never sell Google or Fitbit data.
• We never use it, or share it, for advertising of any kind, including personalised, interest-based, retargeted or contextual advertising.
• We never give it to data brokers or information resellers, even if aggregated or anonymised.
• We never use it to decide credit-worthiness or for lending, insurance or employment decisions.
• We never use it to develop, improve or train generalised (non-personalised) AI or machine-learning models.
• We do not use it for medical purposes or research.

Who can see it

• Other Step Social users can see your step totals and rankings through leaderboards, groups and events, as described in "Information Visible to Other Users".
• Our service providers process it only so we can run the app. For Google and Fitbit data, the only service provider is Supabase, which hosts our database, authentication and server functions. No analytics, advertising, crash-reporting or AI company receives your Google or Fitbit data. Our payments provider (RevenueCat, for App Store subscriptions) and Apple's push notification service do not receive your step data. Supabase is contractually limited to processing data on our instructions and may not use it for its own purposes.
• We may also share it if needed for security (for example, investigating abuse or cheating), to comply with the law, or as part of a merger, acquisition or sale of assets, and only after getting your explicit consent first.
• Step Social staff do not read your Google or Fitbit data unless you ask us to (for example, for a support request), it is needed for security or to investigate abuse, it is required by law, or it has been aggregated and anonymised for internal operations.

How we store and protect it

Google and Fitbit data is stored on our servers hosted by Supabase in the European Union (Amazon Web Services, Stockholm, Sweden). It is encrypted in transit (HTTPS/TLS) and at rest. The access and refresh tokens Google gives us are kept in the iOS Keychain on your phone and in a restricted part of our database that only our own server functions can reach; no other app user and no part of the app's public interface can read them. They are covered by the encryption at rest that protects our whole database, and access is limited to systems and staff that need it.

How long we keep it and how to delete it

• We keep your Fitbit connection details (Google tokens, identifiers and time zone) only while your Fitbit connection is active and your account exists.
• You can disconnect Fitbit at any time in the app: tap your profile picture at the top of the screen to open your Profile, then under Connected Services tap Manage, and next to Fitbit (via Google) tap Disconnect. When you do, we stop collecting data, ask Google to revoke Step Social's access, and delete your stored Google tokens and Fitbit connection details straight away. Step totals that were already synced stay in your Step Social history and on leaderboards, so your past results are not lost. If you would like those step totals deleted as well, contact us at the address in Section 1 and we will delete them within 30 days.
• You can also remove Step Social's access from your Google Account at https://myaccount.google.com/permissions.
• If you delete your Step Social account (open your Profile, scroll to the bottom, tap Delete Account, then Delete), we delete your Google and Fitbit data within 30 days, except where the law requires us to keep it.

Limited Use

Step Social's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

The use of information received from the Google Health API will adhere to the Google Health API Developer and User Data Policy (https://developers.google.com/health/policies/health-api-developer-user-data-policy), including the Limited Use requirements.

8. Location Data

If you use map, route or event features, Step Social may request access to location data.

Location data may be used to:

• Generate or track walking routes
• Estimate distance and time
• Support map-based activity features
• Help users discover or create events
• Improve route functionality and safety features

You can disable location permissions in your device settings. Some features may not work properly without location access.

Avoid publishing routes or locations that reveal your home address, workplace, school or regular routine.

9. Information Visible to Other Users

Depending on your settings and participation, other users may see:

• Your display name
• Profile image or avatar
• Country or region
• Step totals
• Ranking position
• Badges
• Challenge results
• Group membership
• Event participation
• Content you post in groups or events

Public leaderboards, public groups and public events may be visible to other Step Social users. Private groups restrict ordinary access to approved members, but content may still be reviewed for safety, moderation, legal compliance or support.

10. Sharing Information

We may share information with:

Service Providers

This may include hosting providers, databases, authentication services, analytics providers, crash-reporting tools, fraud-prevention tools, customer-support tools, moderation tools, email providers and audio-generation providers.

Google and Fitbit data is shared only as described in the 'Google and Fitbit Data' section.

No analytics, crash-reporting, advertising, AI or audio-generation provider receives Google or Fitbit data.

Connected Services

This may include Apple Health, Fitbit, Garmin, Android Health Connect, mapping providers and other services you choose to connect.

Other Users

Information may be shared with other users through leaderboards, groups, challenges, events, chat and profile features.

App Stores and Payment Providers

Apple App Store and Google Play may process purchases, subscriptions, renewals, refunds and entitlement checks.

Legal, Safety and Professional Parties

We may share information with regulators, authorities, courts, law enforcement, safety bodies, professional advisers or insurers where required or where necessary to protect users, comply with law or enforce rights.

Business Transfers

If Step Social is involved in a merger, acquisition, investment, restructuring or sale, information may be transferred subject to confidentiality and applicable law.

11. International Transfers

Some suppliers may process information outside the United Kingdom or the country where you live. Where required, we use recognised safeguards such as adequacy decisions, approved contractual clauses or other lawful transfer mechanisms.

12. How Long We Keep Information

We keep personal information only for as long as reasonably needed.

General account information is usually kept while your account is active. Health, fitness, ranking, challenge and route data may be kept while needed to provide the Service, maintain records, prevent fraud and support user-requested features.

Support, safety, moderation and legal records may be kept for longer where necessary to protect users, comply with law, investigate abuse or resolve disputes.

When you delete your account, we will delete or anonymise personal information unless we need to keep limited information for legal, safety, fraud-prevention, accounting or dispute-resolution reasons.

Google and Fitbit data is kept and deleted as described in Section 7 (Google and Fitbit Data), which takes precedence over this section.

13. Account Deletion

You can request account deletion in the app.

Open your Profile (tap your profile picture), scroll to the bottom, tap Delete Account, then confirm Delete.

Deleting the app from your device does not automatically delete your Step Social account or cancel any subscription.

If you cannot access the app, contact:

hello@stepsocial.app

14. Your Rights

Depending on where you live, you may have rights to:

• Access your personal information
• Correct inaccurate information
• Delete your information
• Restrict processing
• Object to certain processing
• Withdraw consent
• Request a copy of your data
• Complain to a data protection authority

To exercise these rights, contact:

hello@stepsocial.app

We may need to verify your identity before acting on a request.

15. Marketing Communications

We may send service messages, security notices and important account updates.

We will only send marketing messages where permitted by law. You can unsubscribe from marketing communications at any time.

16. Children and Age Eligibility

Step Social is intended for users aged 16 or over.

We do not knowingly allow users under 16 to create accounts. If we discover that a user is under 16, we may delete the account and associated data.

If you believe a child under 16 has used Step Social, contact:

hello@stepsocial.app

17. Security

We use reasonable technical and organisational measures to protect personal information, including access controls, security monitoring, encryption of data in transit and at rest and internal restrictions.

No system is completely secure. You are responsible for keeping your account credentials secure and protecting your device.

18. Third-Party Links and Services

Step Social may include links or integrations with third-party services. We are not responsible for the privacy practices, content or security of third-party services.

Review third-party privacy policies before connecting or using external services.

19. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we may notify you through the app, website or email.

The updated version will apply from the effective date shown at the top of the policy.

20. Contact Us

EAT LEBO GROUP LTD
80 Victoria Road, Ruislip, England, HA4 0AL

Privacy: hello@stepsocial.app

Support: hello@stepsocial.app

Website: https://stepsocial.app

© EAT LEBO GROUP LTD. Step Social.