Privacy Policy

Introduction

Welcome to Step Rival ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how your personal information is collected, used, shared, and protected when you use our Step Rival mobile application ("the App").

This policy describes our privacy practices for users in the United States, Canada, the United Kingdom, the European Economic Area, Australia, New Zealand, Singapore, Hong Kong, Barbados, Bahamas, Trinidad and Tobago, Belize, and Bermuda. It is not a substitute for legal advice.

Information We Collect

Personal Information You Provide

• Account Information: We collect your email address and may collect your name and profile picture when you create an account.
• Authentication Information: If you sign in with Google or Apple, we receive basic account information from these providers.
• Profile Information: Information you provide in your user profile, such as username, profile picture, frames, and shields.
• User-Generated Content: Team names, team chat, reactions, profile details, support messages, reports, and other content you choose to provide through social or community features.
• Purchase and Economy Information: App Store product identifiers, verified StoreKit transaction identifiers, purchase dates, entitlement status, virtual currency balances, inventory, reward history, and transaction/audit records needed to grant and protect purchases and rewards.

Information Collected Automatically

• Health and Fitness Data: Step count, walking/running distance, active energy, hourly activity totals, HealthKit source information used for anti-cheat/source filtering, and step recovery totals from Apple Health (only with your device permission). Step Rival may also write synced step data back to Apple Health if you grant write permission.
• Motion and Live Step Data: Motion and fitness information used to show live step updates while the App is open.
• Usage Data and Analytics: Features accessed, time spent, onboarding, HealthKit authorization and sync events, screen/tab usage, ad reward events, battle and race activity, quest progress, gacha/summon events, currency events, social interactions, moderation events, app errors, and App diagnostics.
• Device Information: Device type, OS version, device identifiers, mobile network info, advertising/attribution signals, App version, Firebase installation data, and push notification tokens when notifications are enabled.
• Device Location: While the App itself does not request or track your precise GPS location, our backend services (like Firebase) may infer your general geographic region from your IP address for purposes such as regional leaderboards or analytics.

How We Use Your Information

• To provide and improve the App's features.
• To enable competition, leaderboards, and rivalry features.
• To personalize your experience with achievements, quests, and challenges.
• To process in-app purchases securely.
• To grant and audit rewards, virtual currencies, battle passes, collectibles, store items, summons, equipment, streak recoveries, and other in-app items.
• To send notifications you enable, including account, progress, social, team, and reward-related notifications.
• To operate moderation, safety, abuse prevention, anti-cheat, account integrity, and fraud-prevention systems.
• To analyze usage for improvements.
• To protect against unauthorized or fraudulent activity.

Legal Basis for Processing (GDPR)

For UK and EEA users, we rely on the following legal bases for the main ways we process personal data:

Data Storage and Processing

Your data is stored securely using Firebase services:

• Firebase Authentication – For account security.
• Firebase Firestore – For user profiles, step data, achievements.
• Firebase Storage – For profile images and assets.
• Firebase Functions – For secure server-side processing.
• Firebase Cloud Messaging – For push notification tokens and notification delivery.
• Firebase Analytics – For App usage and diagnostic analytics. We did not identify Crashlytics as part of the current reviewed app code.

How We Share Your Information

• With Other Users: Your username, profile picture, selected frames/shields, public pet/profile stats, team membership, rivalry status, step totals, leaderboard placement, achievements, quest completion, chat messages, reactions, and other social activity may be visible to other authenticated users depending on the feature.
• Service Providers: We use providers such as Firebase/Google Cloud for authentication, database, storage, functions, diagnostics, notifications, and infrastructure; Apple for StoreKit purchases and HealthKit permissions; Google Sign-In for authentication; Google Mobile Ads/AdMob for rewarded ads and ad measurement; and moderation/safety providers for content review.
• Apple: App Store purchases are processed by Apple. We receive verified transaction details needed to grant App entitlements and rewards, but we do not receive your full payment card details.
• Advertising Partners: Rewarded ads may be served by Google AdMob. AdMob may process device, ad, diagnostic, and attribution information under its policies. We do not provide Apple Health data to advertising partners.
• Business Transfers: If involved in a merger or acquisition.
• Legal Requirements: If required by law or government request.

Your Privacy Rights and Choices

Access and Control

• Access and update your account information in settings.
• Control Apple Health sharing via your device settings.
• Control notification permissions through iOS settings.
• Use device or platform settings to manage ad personalization choices where available.
• Unsubscribe from marketing emails through provided links.
• Request account deletion through the App or by contacting us.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, California law may give you the right to:

• Know what personal information we collect and how we use it.
• Request deletion of your personal information.
• Correct inaccurate data.
• Opt out of the sale or sharing of personal data. We do not sell personal information for money. Rewarded ads and ad measurement may involve disclosures to advertising partners; if those activities are considered "sharing" under California law, you may contact us to request opt-out handling.
• Limit the use and disclosure of sensitive personal information (SPI). You control sharing of HealthKit data, which may be considered SPI, directly through your device settings.
• Use an authorized agent and exercise these rights without discrimination.

In the last 12 months, we may have collected identifiers, customer records, commercial information, internet or app activity, approximate location inferred from IP address, sensitive health/fitness information you permit through HealthKit, user content, inferences used for App features, and device/ad identifiers. Sources include you, your device, Apple Health/HealthKit, Apple StoreKit, Firebase/Google services, AdMob, and other users who interact with you. We use these categories for the purposes described in this policy and disclose them to service providers, other users, advertising partners, and legal/compliance recipients as described above.

We currently respond to Global Privacy Control signals on the Website where technically supported. In the App, please contact us at support@steprival.net for California privacy requests, including sale/share opt-out requests.

EU/EEA Residents – GDPR Rights

As an EEA resident, you have the right to:

• Request access to your personal data.
• Request correction or update of inaccurate data.
• Request erasure (deletion) of your personal data ('right to be forgotten').
• Request restriction of processing of your personal data.
• Receive a copy of your personal data in a structured, commonly used, and machine-readable format (data portability).
• Object to the processing of your personal data based on legitimate interests.
• Withdraw consent at any time (where processing is based on consent).

To exercise any of these rights (under CCPA/CPRA or GDPR), please contact us using the details provided in the "Contact Us" section below.

Canada and Quebec Privacy Rights

Canadian users may request access to, correction of, or deletion of personal information, and may ask questions about how personal information is handled. For all Canadian privacy requests, contact support@steprival.net.

For Quebec users, support@steprival.net is the published privacy contact and privacy officer contact for Step Rival. We use this contact for privacy questions, access/correction requests, deletion requests, incident questions, and cross-border processing questions.

Before launching materially new systems or processing that involve Quebec personal information, we review privacy impact and cross-border processing considerations. We also maintain an incident review process and will assess whether notices to affected people or regulators are required under applicable law.

Other Regional Privacy Rights

Users in Australia, New Zealand, Singapore, Hong Kong, Barbados, Bahamas, Trinidad and Tobago, Belize, Bermuda, and other supported regions may contact us at support@steprival.net to request access to personal information, correction of inaccurate personal information, deletion or withdrawal of consent where available, and information about how we collect, use, disclose, retain, protect, and transfer personal information.

These requests can include questions about providers, overseas processing, information we receive from sources such as Apple HealthKit, Apple StoreKit, Firebase/Google services, AdMob, device settings, or other app users, and our handling of health and fitness data or teen-related settings.

Step Rival does not currently send promotional email or promotional push messages. If we add promotional messages in a supported region, we will add the required consent, unsubscribe, or opt-out handling before sending them.

Data Retention

We retain your data as long as necessary for providing the App and fulfilling legal, safety, security, fraud-prevention, tax, accounting, dispute, and operational obligations. Account deletion removes or deactivates core account data where feasible, but some records may be retained for legitimate reasons, such as purchase and entitlement records, currency and reward audit logs, moderation/safety records, support communications, anti-cheat evidence, leaderboard history, backup copies, or data we must keep to comply with law. When retention is no longer needed, data is deleted or anonymized where practical.

Data Security

We use appropriate technical and organizational safeguards to protect your data. However, no system is 100% secure, and we cannot guarantee absolute protection.

Children's Privacy

The App is not directed to children under 13, and users must be at least 13 years old to use Step Rival. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information, please contact us immediately so we can review and delete the information where required. We do not knowingly sell or share personal information of users under 16.

HealthKit, Motion, and Fitness Data

Step Rival uses Apple HealthKit only after you grant permission through iOS. Health and fitness data is used to power App features such as step syncing, missed-step recovery, goals, streaks, leaderboards, quests, teams, pet battles/races, rewards, and anti-cheat checks. We do not use HealthKit data for advertising, marketing, or sale to data brokers.

You can change HealthKit permissions in iOS Settings. If you revoke access, some App features may stop updating or may rely on the last synced server state.

Third-Party Services

We may link to third-party websites or services. These are not under our control, and we are not responsible for their privacy practices. Third-party services used by the App may include Apple services, Firebase/Google Cloud, Google Sign-In, Google Mobile Ads/AdMob, and moderation or support tooling.

Third-Party Login Services

We support login via:

• Google Sign-In
• Sign in with Apple

Your data is handled according to the third party's privacy policy during authentication.

In-App Purchases

Payments are processed using Apple's StoreKit and are subject to Apple's privacy policy. We do not store your full payment details. To grant purchases and prevent fraud, we may store product identifiers, transaction identifiers, original transaction identifiers, purchase dates, App Store environment, app version, entitlement status, and related reward or balance changes.

App Tracking Transparency (ATT)

Step Rival uses AdMob rewarded ads and Apple's SKAdNetwork attribution framework. We do not use Apple Health data for tracking or advertising. If we add functionality that requires Apple's App Tracking Transparency permission, we will request your permission before using it.

International Data Transfers

Step Rival is operated from the United States and uses service providers that may process personal data in the United States, Canada, the European Union, the United Kingdom, Australia, New Zealand, Singapore, Hong Kong, Barbados, Bahamas, Trinidad and Tobago, Belize, Bermuda, and other countries where they or their subprocessors operate. These providers include Firebase/Google Cloud for authentication, database, storage, functions, analytics, diagnostics, and notifications; Apple for App Store, StoreKit, and HealthKit/device permission flows; Google Sign-In; Google Mobile Ads/AdMob; and support or moderation providers used to operate the App.

When personal data is transferred internationally, we rely on provider contracts, data processing terms, security commitments, and transfer safeguards such as standard contractual clauses or other lawful transfer mechanisms where required. For Quebec personal information and newly enabled expansion markets, including Australia, New Zealand, Singapore, Hong Kong, Barbados, Bahamas, Trinidad and Tobago, Belize, and Bermuda, we review cross-border processing risks before using or materially changing providers that process personal information outside the user's region where required.

You can contact support@steprival.net with questions about providers, safeguards, or cross-border processing.

Changes to This Privacy Policy

We may update this policy from time to time. The latest version will be published with an updated "Last Updated" date.

Contact Us

If you have any questions about this Privacy Policy, privacy rights, support requests, incidents, or Quebec privacy matters, contact us at:

Step Rival
Privacy and support contact: support@steprival.net

By using Step Rival, you acknowledge that you have read this Privacy Policy.