Privacy policy
last updated October 14, 2026
This policy explains what personal information steppix collects, why, who helps us process it, how long we keep it, and the choices and rights you have. "Steppix", "we" and "us" mean Riso Development LLC, a Florida limited liability company, which operates the steppix app and steppix.app. Questions: support@steppix.app.
The short version: we collect what we need to run step challenges, move money safely and keep play fair. We read your steps from Apple Health only to run your challenges and catch cheating. We never sell your personal information, never share it for advertising, and never use health data for advertising.
What we collect and why
Your account
| What | Where it comes from | Why |
|---|---|---|
| Email address and name | Sign in with Apple or Sign in with Google (Apple may give us a private relay email) | to create and secure your account and contact you about it |
| Username, display name, profile photo (optional) and avatar style | you | your public profile in challenges, the feed and leaderboards |
| Date of birth | you, during sign-up | to confirm you meet the minimum age for paid challenges in your state, and that you're 13+ |
| Time zone | your device | each challenge day runs on your local midnight-to-midnight |
| Daily step goal, pledge, typical daily steps | you, during sign-up | to suggest challenges and personalise the app |
| Who invited you, and who you invited | invite links and codes | to run the referral program |
| Settings (feed privacy, notification choices, theme) | you | to respect your preferences |
| A device identifier | your device | to enforce one account per person and stop duplicate accounts |
| Push notification token | your device, if you allow notifications | to send challenge reminders and results |
Health and motion data
With your permission, steppix reads from Apple Health (HealthKit), read-only:
- step count samples (with their times, the source app and the device that recorded them, and whether they were entered by hand), and
- walking + running distance.
With your permission, steppix also reads pedometer data from Motion & Fitness (Core Motion step totals) on your iPhone.
We use this data only to run the challenges you join (counting your steps for each challenge day) and to detect cheating (for example, comparing Apple Health with your phone's motion data). Steps entered by hand, and steps written by other apps, are ignored.
- Health and motion data is never used for advertising or marketing, never sold, and never shared with data brokers or information resellers.
- We never write anything to Apple Health.
- We don't use it to make decisions about you other than challenge results and fair-play reviews.
- Other players see only what a challenge shows: whether you hit the day's goal and your step count for that day in challenges you've joined.
You can turn off access at any time in iOS Settings → Health → Data Access & Devices → steppix. Without it, steppix can't count steps for challenges.
Location
Location is checked only when you join a paid challenge or cash out, to confirm you're physically in a place where paid challenges are allowed. At those moments:
- your device location is requested ("while using the app") and converted to a US state, and
- your network's IP address is sent to our IP-intelligence provider, ipinfo.io, to confirm the country and state and to detect VPNs, proxies and hosting networks.
We store only the resulting US state (on your profile and on the entry), not your coordinates and not your IP address. Steppix never tracks your location in the background or while counting steps.
Payments, identity and payouts
Card payments, identity verification ("KYC") and payout bank details are handled by our payments provider, Whop. Your card number, government ID, selfie and bank account details go directly to Whop and never touch our servers. We receive and store references (like a customer or payout account ID), your verification status, and the amounts and dates of payments and payouts, which we need to keep accurate financial records.
Steppix+ subscriptions
Subscriptions are sold by Apple through the App Store and managed with RevenueCat. We receive your subscription status and renewal dates, never your payment details.
Challenge and activity records
Entries you make, challenge results, wallet history (entries, payouts, refunds, credits), achievements, rank, people you follow, reactions, and feed posts generated by your activity. Fair-play reviews create records of flags and their outcomes.
Support
If you contact us, we keep your messages and what we did about them.
Website
steppix.app uses cookieless analytics (Vercel Web Analytics), which counts page views without cookies, without cross-site tracking and without identifying you. We don't use advertising pixels or tracking cookies, so there's no cookie banner. When you open an invite link, we log the kind of link, the code, and a coarse device type (for example "ios" or "desktop") to measure our invite program. We don't store your IP address with it.
If you join the pre-launch waitlist, we store your email and the invite code you came from, if any. We'll email you once when steppix launches, asking you to confirm you still want to hear from us (double opt-in); if you don't confirm, we delete your email. You can ask to be removed at any time.
Legal bases
Where laws such as the GDPR apply, we rely on: contract (running your account and the challenges you join), consent (Apple Health, Motion & Fitness, location and notifications, each of which you can withdraw in iOS Settings), legal obligation (age and location rules, tax and financial record-keeping, responding to lawful requests) and legitimate interests (preventing fraud and cheating, securing the service, improving the app).
Who we share it with
We don't sell personal information or share it for cross-context behavioural advertising. We share it only with service providers who process it for us under contract, when the law requires, or to protect players and the service:
| Provider | What they do for us | What they receive |
|---|---|---|
| Supabase | database, authentication, file storage and server functions | everything stored in your account |
| Apple | Sign in with Apple, HealthKit (on your device), App Store and subscriptions, push notification delivery | as needed for each service |
| Sign in with Google, if you choose it | your sign-in | |
| Whop | card payments, identity verification and payouts | payment, identity and payout details you give them, plus entry and payout amounts |
| RevenueCat | subscription status | an app user ID and subscription events |
| ipinfo.io | IP location and VPN/proxy detection at entry and cash-out | your IP address at that moment |
| Expo | push notification delivery | your push token and notification content |
| Sentry | crash and error reports | technical details of the error, your device model and OS version |
| Vercel | hosting and cookieless analytics for steppix.app | page requests |
We may also disclose information to comply with law, a court order or a valid request from authorities; to investigate fraud, cheating or safety issues; to enforce our terms; or as part of a merger or sale of the business, in which case this policy continues to apply.
What other players see
Your username, display name, avatar or photo, rank and verified badge are public. In challenges you join, other entrants see your standing, whether you hit each day and your step count for the day. Your activity may appear in the feed; set feed privacy to public, anonymous or hidden in Settings. Your date of birth, email, location, wallet and health history are never shown to other players.
How long we keep it
- Account and profile data: while your account is open.
- Step data: while your account is open, so challenge results can be checked; daily step history is deleted when you delete your account.
- Financial records (entries, payments, payouts, refunds, credits and the ledger): kept for at least 7 years after the transaction, even after you delete your account, because tax, anti-money-laundering and consumer-protection laws require it. After deletion these records are tied only to an anonymous ID.
- Fair-play and fraud records: kept as long as needed to protect the service and other players, including after deletion.
- Support messages: up to 3 years.
- Waitlist emails: until launch plus 30 days, unless you confirm you want to stay on the list.
Deleting your account
In the app: Settings → delete account. You'll be asked to cash out any balance first (the minimum is waived) and to let active challenges finish. When you delete your account we remove your username, display name, pledge, typical steps, feed visibility, daily step history, follows, push tokens and stored sign-in tokens; we revoke Sign in with Apple; we disable your login; and any unused entry credit is forfeited. Financial and fair-play records are kept as described above, linked only to an anonymous ID. Can't use the app? Request deletion on the web.
Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, get a copy in a portable format, opt out of sale, sharing or targeted advertising (we don't do these), limit use of sensitive personal information (we use it only to provide the service), and not be discriminated against for exercising these rights. These include rights under the California Consumer Privacy Act as amended by the CPRA, and the privacy laws of states including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others.
To make a request, email support@steppix.app from your account email. We'll verify it's you (and may ask for your username) and respond within 45 days. You can use an authorised agent; we'll ask for proof of their authority. If we deny your request, you can appeal by replying to our decision, and we'll respond within 45 days. See also do not sell or share my personal information.
California notice at collection: the categories we collect are identifiers, customer records, characteristics (age), commercial information (entries and purchases), internet activity (in-app usage), geolocation (state only), sensitive personal information (account login, precise location at entry and cash-out, health data, and government ID, which only Whop holds), and inferences (fraud signals). Purposes and retention are described above. We do not sell or share personal information.
Children
Steppix isn't for children under 13 and we don't knowingly collect their information; the app blocks sign-up under 13. Paid challenges require 18 or older, and older in some states (see eligibility). If you believe a child under 13 has given us information, email support@steppix.app and we'll delete it.
Security
Data is encrypted in transit and at rest with our providers. Money moves only on our servers through an append-only ledger; the app can't change a balance. Access to personal data is limited to people who need it to run the service. No system is perfectly secure; if a breach affects you, we'll notify you as the law requires.
Where your data is processed
Steppix is for people in the United States, and we process and store data in the United States. If you use steppix from elsewhere, your information is transferred to and processed in the US.
Changes
If we change this policy, we'll update the date above. For material changes we'll tell you in the app or by email before they take effect.
Contact
Riso Development LLC, 4103 Raffia Drive, Naples, FL 34119. Email: support@steppix.app.