Privacy Policy

1 Who We Are

Radstep ("we," "us," "our") operates the Radstep fitness tracking application available on iOS and Android. For the purposes of data protection law, Radstep is the data controller responsible for your personal information.

Contact us regarding privacy matters at [email protected] or through our support page.

2 Data We Collect

Account Information

• Email address — used to create and manage your account and for transactional communications
• Password — stored as a cryptographic hash; we never store your plain-text password
• Display name & username — visible to other users in social features
• Profile photo (optional) — uploaded at your discretion

Authentication via Third Parties

If you sign in with Google or Apple, we receive your name and email address from that provider. We do not receive your password for those accounts. See Third-Party Services below.

Fitness & Activity Data

• Daily step count read from Apple Health (iOS) or Health Connect (Android)
• XP, levels, streaks, achievements, and progression data
• Creatures collected, hatched, bred, and battled

Usage & Device Data

• App version, device model, operating system, and platform (iOS/Android)
• Crash reports and diagnostic logs (collected anonymously)
• In-app interactions (feature usage, store visits)
• Push notification token (if you opt in to notifications)

Payment & Subscription Data

Payments are processed entirely by Apple App Store or Google Play, and by our subscription provider RevenueCat. Radstep does not receive or store your credit card number or full payment details. We receive confirmation of purchase, subscription tier, and renewal status from these providers.

Social & Community Data

• Friends list and group memberships you create or join
• Goals and challenges you participate in
• Any content you post in group or community features

3 How We Use Your Data

We use your data only for the purposes below. We process your data on the legal bases of contractual necessity (to provide the Service), legitimate interests, and your explicit consent where required.

• Provide the Service — track your steps, calculate rewards, maintain your account and progression
• Personalization — display your stats, history, and tailored challenges
• Social features — power leaderboards, groups, and friends lists
• Communications — send account-related emails (password resets, subscription updates), and push notifications you opt into
• Safety & fraud prevention — detect cheating, step spoofing, and abuse
• Analytics & improvements — understand how features are used to fix bugs and improve the app (using anonymized or aggregated data where possible)
• Legal compliance — meet our obligations under applicable law

We do not use your data to serve third-party advertising.

4 Step & Fitness Data

Your step count is the heart of Radstep. With your permission, we read your daily step count from your device's health platform:

• Apple Health (iOS) — we request read-only access to your step count
• Health Connect / device step counter (Android) — we read your step count to credit in-app progress

Radstep reads only your step count. We do not access your GPS location, routes, or precise whereabouts, and the App requests no location permissions. Your step totals are stored on our servers associated with your account so you can view your history and progression.

You may revoke step-count access at any time in Apple Health, Health Connect, or your device Settings. Revoking access will prevent the App from crediting new steps. You may delete all your data at any time in the App.

5 Third-Party Services

We work with the following trusted partners to operate the Service. Each is contractually bound to protect your data:

RevenueCat

Manages subscriptions and in-app purchases on iOS and Android. RevenueCat receives your device identifier, purchase receipts, and subscription status. RevenueCat Privacy Policy

Google (Sign In)

If you use "Sign in with Google," Google shares your name and email with us. Google Privacy Policy

Apple (Sign In)

If you use "Sign in with Apple," Apple shares your name and (optionally) your email address with us. Apple's policy allows you to hide your real email using a relay. Apple Privacy Policy

Cloud Infrastructure

Our backend servers and database are hosted on cloud infrastructure providers (e.g., AWS or equivalent). These providers store data on our behalf under data processing agreements and do not process your data for their own purposes.

Crash Reporting

We use anonymous crash and diagnostics reporting to fix bugs. These reports contain device type, OS version, and a stack trace but are not linked to your account.

6 Data Sharing

We do not sell your personal data. We share data only in the following circumstances:

• With your consent — e.g., when you join a public group or share your step progress
• Service providers — as described in Third-Party Services above
• Legal requirements — when required by law, subpoena, or government authority
• Protection of rights — to investigate fraud, enforce our Terms, or protect the safety of our users
• Business transfer — in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you beforehand and you may delete your account.

Public social features (leaderboards, group rankings) show your display name and aggregate stats to other users by design. You control your display name and can set your profile to private in Settings.

7 Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data — kept until you delete your account
• Step & fitness data — kept with your account; you can delete all history at any time in the App
• Deleted account data — personal data is deleted immediately upon account deletion. Anonymized, aggregated data (e.g., total platform steps) may be retained indefinitely
• Legal hold — if required by law or legal proceedings, we may retain certain data longer

8 Security

We implement industry-standard technical and organizational measures to protect your data against unauthorized access, disclosure, alteration, or destruction, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of sensitive data at rest (passwords hashed with bcrypt, tokens encrypted in secure storage)
• Access controls limiting who can access production data
• Regular security reviews and dependency updates

No system is perfectly secure. If you suspect your account has been compromised, contact [email protected] immediately. If we discover a data breach that affects your rights, we will notify you as required by applicable law.

9 Your Rights

Depending on your location, you may have the following rights regarding your personal data. To exercise any of these, contact us at [email protected]:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure ("right to be forgotten") — request deletion of your personal data
• Restriction — request that we limit processing of your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, you may withdraw it at any time

California Residents (CCPA)

California residents have the right to know what personal information is collected, to request deletion, and to opt out of the "sale" of personal information. We do not sell personal information as defined by the CCPA.

EEA / UK Residents (GDPR)

If you are in the European Economic Area or United Kingdom, you have the rights listed above under GDPR. You also have the right to lodge a complaint with your local data protection authority.

We aim to respond to all privacy requests within 30 days.

10 Children's Privacy

Radstep is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided us with personal information, we will delete it promptly. If you believe a child under 13 has created an account, please contact us at [email protected].

Users between 13 and 18 should have a parent or guardian review these policies.

11 International Data Transfers

Radstep is based in Poland. If you access the Service from outside Poland, your information may be transferred to and processed in Poland or other countries where our service providers operate. We ensure that any such transfers are protected by appropriate safeguards, such as standard contractual clauses approved by relevant data protection authorities.

12 Policy Changes

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. When we make material changes, we will post a notice in the App and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

We encourage you to review this policy periodically. Continued use of the Service after changes become effective constitutes your acceptance of the updated policy.

13 Contact & Data Protection

For any privacy-related questions, requests, or concerns, please reach out:

• Email: [email protected]
• General support: [email protected]
• Support page: radstep.com/support

We will respond to all privacy inquiries within 30 days. For unresolved concerns, you may contact the relevant supervisory authority in your country.