Privacy Policy

UpStep ("we", "us", the "App") is a fitness app with step challenges, a leaderboard, a food diary, and an AI coach. This policy explains what personal data the App collects, why, how it is used and shared, and the choices you have. By using UpStep you agree to this policy.

The data controller for the App is an individual developer based in Ukraine. For any privacy question or request, contact [email protected].

Data we collect

We collect only what the App needs to work:

Account data — email address, display name, and a password (stored only as a secure hash; we never see your plaintext password).
Profile data — optional height, weight, date of birth (used to derive your age), and sex/gender (used to estimate calories and personalise coaching), plus an optional profile photo (avatar). Weight is also kept as a history so you can see trends over time; if you turn on “Take weight from Health” in Profile, your weigh-in history is imported from Apple Health / Health Connect (anything you entered by hand takes precedence).
Activity data — daily step counts and, if you grant access, your daily active energy, read from your device (Apple Health / motion sensor on iOS, activity recognition / Health Connect on Android) plus calories derived from them — shown as your charts, challenge progress and your daily calorie target.
Nutrition data (food diary) — meals and food items you log (name, portion, calories and macros) and, if you use photo recognition, the photos of food you take. Photos are uploaded to our server and processed by an AI provider to identify the food (see "AI features" below).
Bad habits — the habits you have decided to give up (smoking, vaping, alcohol, sugar or your own, under a name you choose), when you quit, optionally how much you used to spend on it per day (amount and currency) and how many units or servings a day, plus a log of relapses with their date and an optional note. This is health data, so it is visible only to you: we never show it to friends or other users (not in feeds, your profile or leaderboards), never pass it to the AI coach, other AI providers or any third party, and never use it for advertising. Your days without the habit, your record and the money saved are calculated from it inside the App. You can delete a habit or a single relapse at any time.
User content — posts, comments, reactions, and any photos you attach in challenge feeds; messages you send to the AI coach.
Social graph — your friends and the challenges you join.
Approximate location — derived server‑side from your IP address at city level only, used to fetch local weather for your activity insights. We do not collect GPS/precise location.
Notification token — a push token (via Expo / Apple APNs / Google FCM) so we can send you reminders and challenge notifications.
Basic technical data — device/OS type, app version and locale, used for delivering notifications and diagnosing problems. This also covers an app installation identifier and a step-source label (Health or the phone’s sensor): they let us investigate step discrepancies and keep one device from overwriting another device’s records.
Crash reports — if the App closes unexpectedly, it sends a technical report: the stack trace, app version, device model and OS version. The report contains no name, e-mail address, IP address or account identifier, so we cannot link it to you. Reports are used only to find and fix the cause of the crash; we do not use them to analyse your behaviour.
Voice messages — if you record a voice message for the AI coach, the audio is sent to our server, forwarded to a transcription provider and discarded immediately after; we do not store it. Only the resulting text is kept, as part of your chat with the coach.
Barcode lookup — Open Food Facts. Receives the barcode you scan, to return the product name and its reference nutrition values. No account data is sent.

We do not sell your data, and we do not use it for advertising or third‑party tracking.

How we use your data

Provide core features: step tracking, challenges, leaderboards, feeds, friends, the pet mini‑game, the food diary and the bad‑habit tracker.
Recognise food from photos and look up nutrition values for your diary.
Generate optional AI coaching messages, a daily digest, and activity summaries (see "AI features" below).
Estimate calories from steps, height/weight and age, and show weather‑aware activity insights.
Send notifications you have enabled (challenge updates, reminders, mentions).
Keep the service secure and fix bugs.

The legal basis (where applicable, e.g. GDPR) is performance of our service to you and your consent for device permissions and notifications.

Device permissions

The App asks for these permissions; you can decline or revoke them in system settings at any time (some features won't work without them):

Motion & fitness / physical activity (incl. Apple Health / Health Connect) — to count your steps and the energy you burn. We read steps, active energy and — only if you turn on “Take weight from Health” in Profile — your weigh-in history. If you turn on “Write nutrition to Health” in Profile, the meals and water you log are written to Apple Health (calories, protein, fat, carbohydrates, fiber, sugar, water) — nothing else is written, and nothing is written unless you enable it. We never share Health data with third parties and never use it for advertising.
Camera / photo library — only when you choose to attach a photo to a post, set an avatar, or photograph a meal for the food diary.
Notifications — to deliver reminders and challenge updates.
Microphone — only while you are recording a voice message for the AI coach. Nothing is recorded in the background.

AI features

Some optional features send data to third‑party AI providers to generate a result. We send only what each feature needs, and we do not attach your name, email or profile photo to these requests.

Coach, digest & summaries (text) — provider DeepSeek. Receives your message text and a summary of your recent activity (step counts, active challenges, and — for diet advice — the meals you logged that day). Live coach chat replies may instead be generated via OpenRouter (the same provider that handles voice and food photos) — the same message text and activity summary is sent, nothing more.
Food photo recognition (vision) — provider OpenRouter (a Qwen vision model). Receives the photo of food you submit, to identify items and estimate nutrition; the photo is stripped of metadata (such as GPS location) before it is sent.
Feed photo check — provider **OpenRouter**. Receives a photo you post to a challenge feed in order to filter out objectionable content automatically (explicit imagery, graphic violence, hate symbols). The check is mandatory: without consent to AI features you cannot attach a photo to a post, while text posts work as usual.
Nutrition lookup — USDA FoodData Central. Receives a generic food name (text only, never your photo) to return reference calories/macros.
Voice message transcription — provider OpenRouter. Receives the audio of the voice message you record, to convert it into text; the audio is not stored by us, and only the text reaches your chat with the coach.

Where a provider offers a no‑training / minimal‑retention option we enable it (this applies to our food‑photo provider). Our text provider DeepSeek processes and may retain data on servers in China under its own terms and may use API data to improve its models; other providers may process data in the United States. Because of this, please don't include sensitive personal information in coach messages or food photos.

How we share data

We share data only with service providers that operate the App on our behalf:

Hosting / backend — our own server infrastructure at makeupstep.com, fronted by Cloudflare (CDN/TLS). Encrypted backups are stored on Cloudflare R2.
AI providers — DeepSeek (text) and OpenRouter (food‑photo vision), as described above.
Nutrition data — USDA FoodData Central (generic food names only).
Weather / location — your IP address is sent to ip‑api.com to resolve an approximate city, and Open‑Meteo provides the local forecast.
Push delivery — Expo, Apple (APNs) and Google (FCM) to deliver notifications.
Crash reports — Sentry, processed in the European region (de.sentry.io).

We may disclose data if required by law. Other participants in a challenge can see your display name, avatar, step counts on the leaderboard, and any posts or comments you make in that challenge.

Points and challenges

In‑app points are virtual. They cannot be purchased with real money, have no cash value, and cannot be withdrawn or exchanged for money.

Data retention & deletion

We keep your data while your account is active. Some records are pruned automatically (e.g. notifications, activity and chat history after a few weeks; uploaded food‑photo drafts that are not saved to a meal are removed within ~30 days). You can delete your account at any time from Profile → Delete account. This permanently removes your account and associated data — challenge participation, posts, comments, reactions, notifications, chat, friends, diary, bad habits with their relapse log, and avatar. Some records may persist briefly in backups before being overwritten.

Security

Traffic between the App and our server is encrypted with HTTPS/TLS. Passwords are stored hashed. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your data.

Children

UpStep is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

International users

Your data may be processed on servers located outside your country, including by the AI and weather providers listed above (which may operate in the United States and China). By using the App you consent to such processing.

Your rights

Depending on your region, you may have the right to access, correct, export or delete your personal data, and to withdraw consent. You can delete your account in‑app, or contact us for other requests.

Changes to this policy

We may update this policy; material changes will be reflected by the "Last updated" date above and, where appropriate, in‑app notice.

Contact

Questions or requests: [email protected].