Privacy Policy

Effective 13 September 2026

Step Season is a step-count competition between friends: Leagues, Seasons, a Commissioner, prizes you describe yourselves, and one Standings board. It is operated by its developer, David Girgis (the App Store developer name), who you can reach at shah.shahlawyers@gmail.com. This policy explains, in plain English, what the iPhone app, the Apple Watch app, the companion app for other phones and the web app at stepseason.vercel.app read, store and share.

What we read from Health

We read only your daily step count — from Apple Health on iPhone and Apple Watch, or from Health Connect on other phones. We ask for read-only access to steps and nothing else: no heart rate, no workouts, no location, no other Health data. The app never writes to Health. For each day we keep the total, the total without manually entered steps, the largest single-hour count, and which app or device recorded the steps (for example “Apple Watch” or “Garmin Connect”). Those details are what the fair-play flags are based on.

What we store

Your account: the name you signed in with (editable), your email address, a random account ID, your time zone, your daily step goal, your step source and your notification preferences. Sign in uses Sign in with Apple or Sign in with Google; we never see a password.

Your Leagues: League names, dates, settings, Teams, the free-text prize descriptions the Commissioner writes, who is a member, and the activity feed (joins, goals hit, big days, rank changes) with emoji reactions.

Your steps: the per-day numbers above, for the days your Leagues cover plus a few days of sync grace. On the web you can also enter a day by hand and attach a screenshot; both are stored with your entry and marked as manual.

Fair play: flags raised on manual, unrecognised-source or implausible days, and the Commissioner's decisions about them. Notifications: a push token for each device that has one — how and when that happens differs by platform (see below). Standings history: frozen Standings taken at each reveal for Leagues that reveal weekly, on chosen dates or at the end of the Season.

App opens — when you open the app (and on which platform: iPhone, Apple Watch, Android or the web), so the operator can see which accounts are in use. Nothing about what you did in the app is recorded.

Who can see what

Members of the same League see each other's display name, totals, rank, day-by-day steps, step source, last-synced time and feed activity. A League's Commissioner also sees the fair-play flags raised on its members and may view a screenshot attached to a manual entry. Nobody outside your Leagues sees anything about you. We do not sell your data and we do not share it with anyone for advertising or marketing.

We rely on these service providers to run the app, each only for the purpose named: Supabase (database, sign-in, file storage), Vercel (hosting for the web app), Apple (Sign in with Apple, push notifications on iPhone and Apple Watch) and Google (Sign in with Google, push notifications on other phones).

Notifications

So we can tell you when someone passes you, a Season starts or ends, Standings are revealed, someone joins, or — for Commissioners — a flag needs a decision, the app stores a push token for your device: on iPhone and Apple Watch, an alert token once you allow notifications, plus a separate widget-refresh token whenever you add a Home or Lock Screen widget (that one needs no notification permission, since a widget keeps refreshing whether or not alerts are on); on Android, a token as soon as you sign in, whether or not you grant the notification permission — that permission only controls whether an alert is shown; and on the web, a token only once you turn push on in Settings.

You choose which kinds to receive in You (iPhone) or Settings (web), and turning notifications off in your device settings stops them entirely. Signing out removes the iPhone alert token and the Android push token right away; the iPhone widget token is removed only when you remove the widget, and the web push token only when you turn it off in Settings. Deleting your account removes every token immediately.

Where your data lives

Everything is stored in a Supabase project hosted on Amazon Web Services in Canada (Central) (ca-central-1). The web app runs on Vercel. Data travels over HTTPS only. Your data is never in iCloud and never in any Apple-hosted service: Apple Health stays on your devices, and only the daily numbers described above leave them.

How long we keep it

For as long as your account exists. Ended Seasons stay visible to their members as history. When you delete your account, everything tied to it is removed immediately (next section). Frozen Standings and feed lines that mention you by display name may remain inside the Leagues you belonged to, as part of the other members' history; they are no longer linked to any account.

Deleting your data

On iPhone: You → Delete account. On the web: Settings → Delete account. Deletion is immediate and permanent: your profile, League memberships, step history, manual entries and their screenshots, flags, reactions, push tokens and your sign-in identity are all removed. If you cannot sign in, email shah.shahlawyers@gmail.com from the address on the account and we will delete it for you.

No ads, no tracking

There is no advertising, no third-party analytics SDKs and no tracking: no advertising identifiers and no data shared across apps or websites. The only usage record we keep is the app-open count described above, kept in our own database and shown only on the operator's dashboard. Your Health data is used only to run the Leagues you join and for nothing else.

Children

Step Season is not directed at children under 13 (or the age of digital consent where you live) and we do not knowingly collect their data. If you believe a child has an account, email shah.shahlawyers@gmail.com and we will delete it.

Changes to this policy

If we change what we collect or how we use it, we will update this page and its effective date, and point it out in the app before the change takes effect.

Contact

Questions, requests and complaints: shah.shahlawyers@gmail.com.