Privacy Policy

What this policy covers

Last updated: October 8, 2026

This update clarifies who operates StepChase, what syncs when you sign in, how analytics choices work across devices, and how to make privacy requests. French and Spanish versions are now available.

This policy describes how StepChase uses personal and step data.

StepChase is operated by Ryan Mohunlal, an individual based in New York, United States.

StepChase is a fitness app, not a medical service.

Information StepChase uses

With your permission, StepChase reads Step Count from Apple Health or Health Connect.

On iPhone, StepChase can also read Flights Climbed for private Me summaries.

It does not request routes, location, heart rate, calories, or unrelated health categories.

StepChase creates daily step totals for personal insights, achievements, and Friends or Groups you join.

Private hourly detail used by Me stays on your device.

Distance, calorie, and active-time estimates use step totals. They stay on your device.

These estimates are general calculations, not personal health measurements.

Account data can include your sign-in identity, display name, avatar, goal, settings, relationships, groups, and invitations.

StepChase also stores the information needed for achievements, reactions, reports, blocks, and account security.

Signing in can sync your profile, optional avatar, saved goals, and permitted daily step totals to StepChase's cloud service, even before you add a friend or join a group.

Cloud daily records are linked to your account. They can include the local date, private time-zone metadata, step total, saved goal, measurement and sync times, and data-quality information.

Hourly history and raw Health samples are not uploaded by StepChase.

If you contact support, StepChase receives your message, contact details, and any information you choose to include. The app lets you review and choose whether to include a limited diagnostic summary.

How StepChase uses information

StepChase uses your information to provide analytics, sync eligible data, and operate private competition.

It also uses information to secure accounts, honor privacy choices, process invitations, and investigate reports.

StepChase does not sell personal data or health data.

Health data is never used for advertising, marketing profiles, insurance, or employment decisions.

What other members can see

Friends and eligible group members see only information allowed by your relationship and privacy settings.

Shared views can include Steps, Improvement, or Goal Progress for Day, Week, and Month periods.

Your Me view, hourly detail, private time zone, and sign-in information stay private.

Notifications, analytics, and diagnostics

Daily goal reminders can run on your device after you enable them.

Remote social and recap alerts need sign-in, device permission, and a registered notification token.

Expo helps deliver the notifications you enable.

StepChase does not include exact health values in lock-screen notification copy by default.

Optional product analytics stay off until you choose to share app analytics.

If enabled, StepChase sends limited product-usage events to PostHog in the United States.

These events exclude step values, health details, names, goals, ranks, groups, and screen recordings.

On this website, we use Google Analytics 4 (GA4) to understand visits only after you allow website analytics. It uses analytics cookies and browser identifiers. This choice is separate from app analytics in PostHog. Our website measurements exclude private invitation pages, query strings, fragments and referring-page URLs. Advertising personalization and Google signals are disabled.

Essential reliability diagnostics remain active when optional analytics is off.

They contain operation timing, short result codes, build details, and random trace IDs.

They exclude account and session IDs, Health data, names, social content, invitation data, URLs, tokens, and raw errors.

Optional product events use a random account or installation identifier rather than your name or sign-in identity. This is separate from the account-linked daily step records used for cloud features.

Safety reports

A safety report uses a fixed reason and records the identity content visible when you reported it.

That record can include account references, the displayed name, a stored avatar reference, timestamps, and review status.

Safety reports never include steps, goals, leaderboard values, invitation tokens, or Health data.

Only authorized support and moderation operations can access the private report queue.

Reporting and blocking are separate actions.

Service providers

Supabase supports accounts, database records, and private avatar storage.

Vercel hosts this website. Expo supports enabled push delivery.

PostHog receives approved product events only after you enable optional analytics.

Google provides Google Analytics 4 for optional website audience measurement. When you allow website analytics, Google receives website usage information, analytics cookie identifiers, browser and device information, and network information such as your IP address. Google may process this information in the United States and other countries. See How Google uses data.

Supabase stores limited essential diagnostics for up to 30 days.

Apple provides Apple Health, sign-in, notification, and App Store services used on iPhone.

Google provides Health Connect, sign-in, notification, and Google Play services used on Android.

StepChase does not add advertising networks, session replay, or health-based tracking.

Retention and deletion

Account and step data remain while your account is active, unless a shorter product rule applies.

Updates use separate retention rules. Detailed essential diagnostics expire after 30 days.

Safety reports may remain as private review evidence after account deletion.

StepChase removes known account links and avatar references from retained reports.

Read the account deletion instructions for the complete current flow.

Your choices

You control Apple Health or Health Connect access, optional analytics, and notification settings.

You can withdraw Health access through Apple Health or Health Connect. This stops StepChase from reading new data through that permission; it does not delete data already stored in your StepChase account or in the health service.

Turning off Share app analytics in Profile & Settings stops future optional product events from that device. If you use StepChase on other devices, turn it off on each one. Your account's saved analytics choice may not update immediately if you are offline or unable to sync. Essential reliability diagnostics remain separate.

Use Analytics choices on this website to allow or decline website analytics. Declining stops future website analytics measurements from this browser; it does not change analytics in the app or delete information already collected. You can also clear existing analytics cookies through your browser. Your website choice is saved in this browser and does not automatically apply to other browsers or devices.

You can change profile visibility, leave social relationships, block users, and report eligible profiles or group identities.

You can start permanent account deletion in Profile & Settings. Signing out or deleting the app does not delete your cloud account.

Withdrawing a permission, changing a privacy setting, and deleting an account have different effects. Contact support to request another limit on use or disclosure, or withdrawal of consent, and to understand what can stop and what must remain.

Privacy requests and rights

Depending on applicable law, you may have rights to access your personal information, correct it, request deletion or cancellation, object to processing, or withdraw consent.

Email support@stepchase.com with the subject "StepChase privacy request". You can use this route even if you cannot open the app.

Include a reply address, the request you want to make, and enough information to locate the relevant account or records. For a correction, describe the change and any information supporting it. If you represent someone else, explain your relationship and authority to act.

Before disclosing or changing account data, StepChase verifies your identity and, where relevant, your authority to act for another person. Verification is limited to what is needed for the request. Do not send passwords, sign-in codes, invitation links, or full Health records.

StepChase responds using a contact route agreed with you within the time required by applicable law and explains the outcome, any additional information needed, and any lawful limitation. A request to withdraw consent does not itself erase previously stored data; the response will explain the affected processing and available deletion choices.

A self-service downloadable data export is not currently available. You can still request access to your information by email. For records in Apple Health or Health Connect, use that service's controls.

Changes to this policy

StepChase posts policy updates on this page and changes the Last updated date. You can reach this page from the website or Help & Support in the app.

Where applicable law requires additional notice or new consent for a change in processing, StepChase will provide that notice or seek that consent before making the change.

Age, security, and contact

StepChase is intended for people aged 13 and older.

StepChase uses access controls and private storage boundaries, but no service can promise perfect security.

Use Support or Help & Support in the app for privacy questions.

You can also email support@stepchase.com.