Download

Privacy Policy

Обновлено: July 21, 2026

Last updated: 21 July 2026

UpStep ("we", "us", the "App") is a fitness app with step challenges, a leaderboard, a food diary, and an AI coach. This policy explains what personal data the App collects, why, how it is used and shared, and the choices you have. By using UpStep you agree to this policy.

The data controller for the App is an individual developer based in Ukraine. For any privacy question or request, contact [email protected].

Data we collect

We collect only what the App needs to work:

  • Account data — email address, display name, and a password (stored only as a secure hash; we never see your plaintext password).
  • Profile data — optional height, weight, date of birth (used to derive your age), and sex/gender (used to estimate calories and personalise coaching), plus an optional profile photo (avatar). Weight is also kept as a history so you can see trends over time.
  • Activity data — daily step counts read from your device (Apple Health / motion sensor on iOS, activity recognition / Health Connect on Android) and calories derived from them, shown as your charts and challenge progress.
  • Nutrition data (food diary) — meals and food items you log (name, portion, calories and macros) and, if you use photo recognition, the photos of food you take. Photos are uploaded to our server and processed by an AI provider to identify the food (see "AI features" below).
  • User content — posts, comments, reactions, and any photos you attach in challenge feeds; messages you send to the AI coach.
  • Social graph — your friends and the challenges you join.
  • Approximate location — derived server‑side from your IP address at city level only, used to fetch local weather for your activity insights. We do not collect GPS/precise location.
  • Notification token — a push token (via Expo / Apple APNs / Google FCM) so we can send you reminders and challenge notifications.
  • Basic technical data — device/OS type, app version and locale, used for delivering notifications and diagnosing problems.

We do not sell your data, and we do not use it for advertising or third‑party tracking.

How we use your data

  • Provide core features: step tracking, challenges, leaderboards, feeds, friends, the pet mini‑game, and the food diary.
  • Recognise food from photos and look up nutrition values for your diary.
  • Generate optional AI coaching messages, a daily digest, and activity summaries (see "AI features" below).
  • Estimate calories from steps, height/weight and age, and show weather‑aware activity insights.
  • Send notifications you have enabled (challenge updates, reminders, mentions).
  • Keep the service secure and fix bugs.

The legal basis (where applicable, e.g. GDPR) is performance of our service to you and your consent for device permissions and notifications.

Device permissions

The App asks for these permissions; you can decline or revoke them in system settings at any time (some features won't work without them):

  • Motion & fitness / physical activity (incl. Apple Health / Health Connect steps) — to count your steps. Step data is read only; we never write to Health, never share it with third parties, and never use it for advertising.
  • Camera / photo library — only when you choose to attach a photo to a post, set an avatar, or photograph a meal for the food diary.
  • Notifications — to deliver reminders and challenge updates.

AI features

Some optional features send data to third‑party AI providers to generate a result. We send only what each feature needs, and we do not attach your name, email or profile photo to these requests.

  • Coach, digest & summaries (text) — provider DeepSeek. Receives your message text and a summary of your recent activity (step counts, active challenges, and — for diet advice — the meals you logged that day).
  • Food photo recognition (vision) — provider OpenRouter (a Qwen vision model). Receives the photo of food you submit, to identify items and estimate nutrition; the photo is stripped of metadata (such as GPS location) before it is sent.
  • Nutrition lookup — USDA FoodData Central. Receives a generic food name (text only, never your photo) to return reference calories/macros.

Where a provider offers a no‑training / minimal‑retention option we enable it (this applies to our food‑photo provider). Our text provider DeepSeek processes and may retain data on servers in China under its own terms and may use API data to improve its models; other providers may process data in the United States. Because of this, please don't include sensitive personal information in coach messages or food photos.

How we share data

We share data only with service providers that operate the App on our behalf:

  • Hosting / backend — our own server infrastructure at makeupstep.com, fronted by Cloudflare (CDN/TLS). Encrypted backups are stored on Cloudflare R2.
  • AI providers — DeepSeek (text) and OpenRouter (food‑photo vision), as described above.
  • Nutrition data — USDA FoodData Central (generic food names only).
  • Weather / location — your IP address is sent to ip‑api.com to resolve an approximate city, and Open‑Meteo provides the local forecast.
  • Push delivery — Expo, Apple (APNs) and Google (FCM) to deliver notifications.

We may disclose data if required by law. Other participants in a challenge can see your display name, avatar, step counts on the leaderboard, and any posts or comments you make in that challenge.

Points and challenges

In‑app points are virtual. They cannot be purchased with real money, have no cash value, and cannot be withdrawn or exchanged for money.

Data retention & deletion

We keep your data while your account is active. Some records are pruned automatically (e.g. notifications, activity and chat history after a few weeks; uploaded food‑photo drafts that are not saved to a meal are removed within ~30 days). You can delete your account at any time from Profile → Delete account. This permanently removes your account and associated data — challenge participation, posts, comments, reactions, notifications, chat, friends, diary and avatar. Some records may persist briefly in backups before being overwritten.

Security

Traffic between the App and our server is encrypted with HTTPS/TLS. Passwords are stored hashed. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your data.

Children

UpStep is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

International users

Your data may be processed on servers located outside your country, including by the AI and weather providers listed above (which may operate in the United States and China). By using the App you consent to such processing.

Your rights

Depending on your region, you may have the right to access, correct, export or delete your personal data, and to withdraw consent. You can delete your account in‑app, or contact us for other requests.

Changes to this policy

We may update this policy; material changes will be reflected by the "Last updated" date above and, where appropriate, in‑app notice.

Contact

Questions or requests: [email protected].