Privacy policy
What Stepzo does with your data, and the choices you have.
The short version
- Stepzo works without an account. Until you sign in, your routines stay on your phone.
- If you create an account, we store your routines and history so they sync between your devices.
- There are no ads, and we never sell your data.
- You can export or delete everything whenever you like.
Who we are
Stepzo is an app from Digital Matty (“we”, “us”). We decide how the data described on this page is used. If you have a question about your data, email services@digitalmatty.com.
What we collect
We collect only what the app needs to work. Almost all of it exists only if you create an account.
| Data | What it includes | Why we need it |
|---|---|---|
| Account | Email address, password (stored only as a one-way hash), account ID and sign-up date. | To sign you in and keep your account secure. |
| Profile | Optional display name, avatar emoji and time zone. | To show you in focus rooms and to time things for where you live. |
| Routines | Routine names, icons, colours and reminder times; step titles and durations. | To back up your routines and sync them between your devices. |
| History | When you started and finished a routine, how many steps you completed or skipped, and extra time you added. | To show your progress and weekly summary. |
| Settings | Your sound, vibration, reminder and notification preferences. | To keep the app set up the same way on each device. |
| Focus rooms | Rooms you follow or create, when you join and leave a session, and reports you send about other people. | To run focus rooms and keep them safe. |
| Purchases | Whether Pro is active, which product you bought, when it expires and the App Store or Google Play reference for that purchase. We never receive your card details. | To unlock the features you paid for. |
| Device | Whether you use iOS or Android, a push notification token, the app version and when the app was last active. | To send the notifications you have turned on. |
| Diagnostics | Crash reports and anonymous usage events such as “routine started”. They never contain routine names or anything you type, and they are not linked to your account. | To fix bugs and improve the app. You can turn usage data off. |
We don’t ask about your health or any diagnosis, and we don’t collect your contacts, photos or location.
What stays on your phone
You can build routines, run the timer, set reminders and see your progress without signing in. In that case your data is saved only on your device and is never sent to us. Reminders are scheduled by your phone itself.
When you sign out, you choose whether to keep your routines on the phone or remove them.
How long we keep it
- Account data
- Until you delete your account.
- Deleted routines and steps
- They stay marked as deleted for up to 90 days so your other devices can sync the change. After that they are erased.
- Focus room sessions
- Erased about 30 days after they end, unless they are part of your own history.
- Abuse-prevention counters
- Erased within one day.
- Backups
- Overwritten within 30 days.
Your choices and rights
- Get a copy. In the app, go to Settings › Manage account › Export my data. You get everything as one file.
- Correct it. Edit your routines and display name in the app at any time.
- Delete it. See Delete your account.
- Turn off usage data. Go to Settings › Privacy › Share anonymous usage data.
- Control notifications. Change them in Settings, or in your phone’s own settings.
Depending on where you live, you may also have the right to object to or limit how we use your data, to move it to another service, and to complain to your local data protection authority. To use any of these rights, email services@digitalmatty.com. We reply within 30 days.
We use your data to provide the service you asked for, to keep it secure and to improve it. Where the law requires your consent, we ask for it first.
How we protect it
- Data travels between the app and our servers over encrypted connections.
- Each account can read only its own data. The database itself enforces this.
- Passwords are stored only as a one-way hash.
- The keys for our providers are kept on our servers, never inside the app.
No system is completely secure. If we learn of a breach that affects you, we will tell you as the law requires.
Children
Stepzo is made for adults. It is not intended for children under 13, or under the minimum age in your country, and we don’t knowingly collect their data. If you believe a child has given us data, email us and we will delete it.
Where your data is processed
Our database is hosted by Supabase on Amazon Web Services in Singapore. Some of the providers listed above process data in other countries, including the United States. When data moves between countries, we rely on the safeguards those providers offer in their data processing terms.
Changes to this policy
When we change this policy, we update the date at the top of this page. If a change is significant, we will also let you know in the app or by email.
Contact
Digital Matty
services@digitalmatty.com