Privacy Policy

Last updated: October 2026

Step1st ("we", "our", or "us") respects your privacy. This Privacy Policy explains how the Step1st mobile application ("the App") accesses, uses, and protects information when you use it.

Step1st is designed with privacy in mind. The app does not require user accounts and stores most data locally on your device.

By using Step1st, you agree to the practices described in this Privacy Policy.

1. Overview

Step1st helps users stay focused by temporarily restricting selected apps until a daily step goal is reached.

We designed Step1st around the following privacy principles:

  • Your personal data stays on your device whenever possible
  • We collect minimal information
  • We do not sell, rent, or share personal data
  • We do not require user accounts

Most data used by Step1st is processed locally on your device and is not transmitted to external servers.

Optional seasonal social features may sync pseudonymous activity metrics with our servers when you choose to use them (see "Seasonal Social Features" in Section 2 below).

2. Information the App May Access

Step1st may request access to certain system permissions to provide its features.

Motion & Fitness Data

Step1st may request permission to access Motion & Fitness activity in order to count your steps.

This allows the app to:

  • track your daily step progress
  • determine when your step goal has been reached
  • unlock restricted apps once the goal is met

Motion data is processed locally on your device for core features and is not transmitted to external servers, except for today's total step count and step goal when you optionally participate in Seasonal Social Features (described below).

Apple Health (HealthKit)

Step1st may optionally request permission to read step count data from the Apple Health app.

If permission is granted, Step1st may read:

  • step count data

This allows the app to:

  • display walking history
  • calculate trends and statistics
  • show longer-term step insights

Step1st:

  • only reads step count data
  • does not write or modify any Health data
  • does not upload Health data to external servers

HealthKit data is used only for providing app functionality and is handled in accordance with Apple's HealthKit guidelines.

Health data is never used for advertising, marketing, or data-selling purposes.

Screen Time Access

Step1st may request access to Apple's Screen Time APIs in order to temporarily restrict selected apps.

This permission allows the app to:

  • pause selected apps until your step goal is reached
  • automatically unlock apps once the goal is completed

Step1st does not collect or transmit Screen Time usage data outside your device.

Seasonal Social Features ("Friends Ghost Hunt")

When you optionally participate in seasonal social features such as "Friends Ghost Hunt", the App communicates with our secure API infrastructure hosted on Cloudflare (https://louisbuilds.me/step1st/api/v1) to synchronize party state and live feeds.

Data transmitted to our servers includes:

  • A pseudonymous device identifier (UUID stored in your iOS Keychain) to maintain your session without requiring a personal account.
  • Your chosen display handle (e.g., @SpookyGhost) and avatar emoji.
  • Derived party details (e.g., "@SpookyGhost's Ghost Party 👻").
  • Today's total step count, daily step goal, the numeric count of restricted apps you selected (not app names or Screen Time tokens), derived leaderboard step totals (including Treat bonuses), derived unlock status, and party-day bonus state from Treat/Trick interactions.
  • Your local calendar date and time zone identifier for fair daily resets and interaction limits.
  • Party membership, invite codes, and system-generated interaction events (such as Treats, Ghost Locks, joins, or milestones).

Visibility to Party Members

To power party leaderboards and live feeds, your display handle, avatar emoji, party name, leaderboard step total, unlock status labels, and system-generated interaction events are visible to other members of your private party (up to 8 members). Teammates never see the names of your restricted apps, a numeric restricted-app count (only labels such as whether apps are still locked or all freed), Screen Time settings, HealthKit history, or precise location.

The in-party live feed shows system-generated events only. There is no free-form chat or other user-generated message content.

Short-Term Security Processing

Connecting IP addresses may be processed briefly by Cloudflare KV (with a 60-second TTL) solely for rate limiting and server defense. IP addresses are never stored long-term, nor used for tracking or profiling.

All core Screen Time rules, application names, and detailed HealthKit histories remain strictly local on your device.

After a seasonal event ends (for example, November 14, 2026, Pacific Time), the Ghost Hunt experience may be removed from the App. Related server data is handled as described in Section 4 below.

3. Information We Do NOT Collect

Step1st does not collect or store the following information:

  • name, email address, or phone number
  • precise or approximate location data
  • contacts
  • photos, videos, or files
  • free-form messages or private chat communications (party interaction events are strictly limited to system-generated status updates and pre-defined game actions)
  • browsing history
  • health data other than step count (if HealthKit is enabled)

Step1st does not create user accounts and does not track users across apps or websites.

4. Data Storage

Most data used by Step1st is stored locally on your device.

This may include:

  • selected apps to restrict
  • daily step goals
  • step progress
  • app settings and preferences

If you delete the app, this locally stored data is removed from your device.

If you delete and reinstall the app, iOS may retain identifiers stored in the Keychain (such as the pseudonymous UUID used for seasonal features) according to Apple's Keychain rules.

Server Storage (Seasonal Features)

Pseudonymous party data and interaction logs associated with seasonal features are stored on secure servers operated by us (including Cloudflare). Leaving a party removes your active participation but retains historical anonymous event logs for team leaderboard consistency. Following the conclusion of a seasonal event, active party data is archived.

5. Analytics

Step1st may use privacy-friendly analytics tools to understand general app usage and improve the product.

Analytics data may include:

  • app version
  • device model and operating system version
  • basic interaction events (such as opening certain screens or completing certain actions)

Analytics data:

  • does not directly identify individual users
  • does not include step count data
  • does not include HealthKit data
  • does not include Screen Time usage data
  • does not include the content of restricted apps

We use anonymized identifiers to track app usage patterns. This data helps us understand which features are most helpful while protecting your identity.

6. App Sharing

Step1st may allow users to share a link to the app using the system share sheet provided by iOS.

When using this feature:

  • the user chooses whether to share
  • only a link to the app may be shared
  • no personal data or usage data is included in the shared content

Step1st does not access or store information about who the user shares the app with.

If you use Friends Ghost Hunt, you may share an invite link that contains a party code. Recipients need the link or code to join. Invite links do not include your email, real name, blocked app list, or HealthKit data.

7. In-App Purchases

Step1st offers optional Pro subscriptions through Apple's App Store.

When you make a purchase:

  • the transaction is processed by Apple
  • Step1st does not receive your payment information

Apple may provide limited subscription status information to the app in order to verify your subscription.

For more information, please review Apple's privacy policy.

8. Third-Party Services

Step1st relies on the following Apple services:

  • Apple HealthKit
  • Motion & Fitness framework
  • Screen Time APIs
  • App Store in-app purchases
  • PostHog (Product Analytics) — To understand feature usage and improve app performance.

Website Analytics: Our website uses standard analytics tools (such as Google Tag) to collect anonymous traffic data. This helps us understand website performance and does not identify individual users.

These services are governed by Apple's own privacy policies.

Apple Privacy Policy: https://www.apple.com/legal/privacy/

9. Children's Privacy

Step1st is not directed to children under the age of 13.

We do not knowingly collect personal information from children.

If you believe that a child has provided personal data through the App, please contact us and we will take appropriate action.

10. Changes to This Policy

We may update this Privacy Policy from time to time.

When changes are made, the "Last updated" date at the top of this document will be revised.

Continued use of the app after changes indicates acceptance of the updated policy.

11. Contact

If you have questions about this Privacy Policy, please contact us:

Email: [email protected]