Privacy Policy

Who we are

Get Step Go is operated by Deeplogix, LLC. If you have a question about this policy or about your data, email privacy@getstepgo.com.

What we collect

We collect the information the app needs to run groups, challenges and leaderboards:

Your account email address and display name.
A profile photo, if you choose to add one.
Your daily step counts, recorded by date.
Which groups and challenges you belong to.
Messages you post in a challenge's chat.
A crash report, if the app breaks while you are using it. It describes the fault, not you — see Analytics and crash reports.
Step screenshots you choose to upload, so the app can read a step count from them.
If you connect Oura, the access and refresh tokens for that connection and the daily activity data Oura reports for your account.

You can create an account with an email address and a password, or by signing in with Google. Signing in with Google is available in the Android app today.

If you choose Google, we receive the basic profile information a Google sign-in carries: your email address and whether Google has verified it, your name, a link to your Google profile picture, and an identifier that is unique to your Google account. We use the email address to identify your account and the name as your display name in Get Step Go, which you can change in Settings whenever you like. The rest is stored by our sign-in provider and we do not use it. We never see your Google password, and we cannot read anything else in your Google account — not your contacts, your mail or your files.

If you sign in with Google using an address that already has a Get Step Go account, we join the two rather than creating a second account, so you keep your groups, challenges and step history. After that you can get in either way. If your account was created through Google and has no password, Settings offers to set one, which emails you a link.

Where step data comes from

Step counts reach the app from Apple Health, Android Health Connect, a connected Oura account, manual entry, or by reading a number out of a screenshot you upload. Garmin, Whoop and Samsung devices are not integrated directly — if you use one, its data reaches Get Step Go because that device already writes into Apple Health or Health Connect, and the app reads it from there.

Health platform access is read-only

Get Step Go reads your step count from Apple Health or Health Connect. It never writes anything back to either platform.

Apple and Google health data commitments

Health data is never used for advertising, never sold, and never disclosed to third parties for their own purposes. We use it only to provide the features described in this policy. These commitments are required of us by Google's Health Connect data policy and Apple's HealthKit terms, and we hold to them regardless of platform.

Connecting Oura

Connecting Oura requests the daily scope, which covers your daily activity summary. The access and refresh tokens for that connection are stored encrypted at rest and are never readable by the app running on your device — only our server-side functions can use them, to fetch your data from Oura on your behalf. Disconnecting Oura deletes those stored tokens. The step data already imported from Oura before you disconnected stays in your step history.

Who can see your steps

Every member of a group can see the step counts of every other member of that group. Nobody outside the group can see them. This is enforced by row-level security in our database, not just by what the app's screens choose to show — the same rule applies no matter which client reads the data. If you upload a screenshot as evidence for a day's count, it's visible to your fellow group members on the same terms as the count itself.

If you add a profile photo, the same rule applies to it: members of your groups can see it, and nobody else can. It's optional. You can remove it at any time in Settings, which deletes the file, and members then see a plain silhouette instead.

Per-member visibility controls — letting you hide your steps from a specific group while still sharing with another — do not exist yet. Today, joining a group means every member of that group sees your counts. This is planned.

How we use your data

We use your data to run the app's features: your stats, your groups, your challenges, leaderboards and chat, and we use crash reports to fix the app when it breaks. We do not use it for any other purpose. Specifically, we do not use your data for advertising, we do not use it to make automated decisions about you, and we do not sell it.

We use Supabase to host our database and run our backend, so Supabase processes your data on our behalf. If you connect Oura, we call Oura's API to fetch your own activity data — nothing more. We use Sentry to receive crash reports, so Sentry processes what a crash report contains — which is listed below, and does not include your step data. We do not share your data with advertising networks, and we do not share it with a product analytics provider, because we do not use one.

Analytics and crash reports

We do not use product analytics. We do not measure which screens you visit, which features you use or how long you spend in the app, and we are not planning to.

We do use crash reporting. When the app hits an error, it sends a report to Sentry, our crash reporting provider, so that we find out the app is broken from the app rather than from a review. A report contains the kind of error, the place in our own code it came from, the app's version, your phone's model and its Android or iOS version, and normally a random identifier for that installation of the app. The identifier is not your account and is not linked to it.

A crash report never contains your step counts, your groups, your challenges, your chat messages, your photos, your name or your email address. The app does this by allowing a fixed list of fields into a report and dropping everything else, so anything new the reporting tool might one day try to add is left out rather than sent.

It does not send the error's own description either. That sentence is written by whichever piece of software failed and could say anything at all, so a report tells us what kind of error happened and where in our code, and never what it said.

Advertising

We do not show advertising today. If that changes, your health or step data will never be used to target ads — the health platform policies we operate under forbid it, and we would hold to that regardless.

Purchases

Get Step Go is free today, with no purchases or subscriptions.

Emails we send

We send account emails only: confirming your address when you sign up, and a link to reset your password when you ask for one. We do not send marketing or product email today. If we introduce it, it will be opt-in and every message will carry an unsubscribe link.

You can share a group's invite code through your phone's share sheet, the same way you'd share any link or text. The app does not post to social networks on your behalf, and shareable result cards — an image summarising a challenge you could post elsewhere — do not exist yet.

How long we keep it

Daily step rows are deleted automatically twelve months after their date, by a scheduled job that runs every night. That window exists so you can compare your steps year on year and so annual challenges have a full year of history to work with. Account data — your profile, profile photo, groups and messages — is kept until you remove it or delete your account.

A step screenshot is kept only as long as the day it belongs to. When a day's step record goes — automatically at twelve months, or when your account is deleted — the screenshot attached to it is deleted too, by a job that runs every night. If you correct a day again and upload a new screenshot, the one it replaced is deleted the same way.

Deleting your data

In-app account deletion does not exist yet. Today, you delete your account by emailing privacy@getstepgo.com — see Delete your account for details. We complete the deletion within 30 days of your request. Deletion is permanent: once it's done, your data cannot be recovered.

Security

Your data is encrypted in transit and at rest. Every database query is scoped by row-level security to the signed-in user and their groups, so one account can never read another account's private data by accident or by a bug in the app. Oura tokens are accessible only to our server-side functions and are never exposed to the app itself.

HIPAA does not apply

Deeplogix, LLC is not a HIPAA covered entity or business associate. Step data collected from your own phone or wearable is not protected health information under HIPAA. We mention this because people reasonably assume otherwise about anything touching health data — the commitments in this policy are the ones that actually govern how we handle yours.

Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your data, to object to how we use it, and to withdraw consent you've given us. To exercise any of these, email privacy@getstepgo.com.

These rights are described by the GDPR and UK GDPR for users in Europe and the UK, and by various US state privacy laws for users there. Deeplogix is a small business and qualifies for the small-business exemption under Texas's Data Privacy and Security Act, but we honour these rights for every user regardless.

Children

Get Step Go is for users aged 13 and over, or 16 where local law sets that higher age. If we become aware that an account belongs to someone younger, we remove it.

International transfers

Your data is processed in the United States. If you're in Europe or the UK, that means your data is transferred there, and we do so under appropriate legal safeguards.

Changes to this policy

If we make a material change to this policy, we'll tell you in the app or by email before it takes effect, and we'll update the effective date at the top of this page.

Contact

Questions about this policy or your data go to privacy@getstepgo.com. Deeplogix, LLC is registered in Texas.

A message sent through the contact form on this website is delivered to us as an email containing your name, email address and message. It passes through our hosting provider, Cloudflare, and our email provider, Resend, and then sits in our contact mailbox like any other email we receive. We use it only to reply to you, and for nothing else. So that the form cannot be flooded, the part of the site that receives it keeps the sending IP address in memory — in the running copy of it that handled your message, never in a database — and lets that address go when the copy stops running, or makes room for newer senders.