Privacy Policy

1. Who We Are

The data controller responsible for your personal data is:

Voodoo SAS, a French simplified joint-stock company, registered with the Paris Trade and Companies Register under number 792 483 307, with its registered office at 12 place Dauphine, 75001 Paris, France.

2. Purposes and Legal Bases

Where the GDPR applies, we rely on the following legal bases:

3. Friends and Social Features

StepMaxx includes friends features that let users find and connect with each other. Your daily step history is never exposed through search.

You may add an optional Drylendar username to your profile. People who can view your StepMaxx profile can see this username and use its link to open your Drylendar profile. This does not link the accounts or transfer activity between the apps. Clear the field in Edit profile to remove the link.

Calendar sharing is on by default when you create a profile, as explained during setup. With Apple Health access, your daily totals sync to StepMaxx and your calendar becomes visible to accepted friends. You can turn friend sharing off in Settings to hide your calendar; new uploads stop when both friend sharing and public step sharing are off; previously uploaded totals remain until you delete your account. Existing sharing preferences are preserved. You can manage or end your friend connections at any time in the App.

Public step sharing is a separate, optional setting and is off by default. If you enable it, your name, username, profile photo, rank and today, week, month and year step totals are visible to everyone on the global leaderboard in the app and at stepmaxx.app/leaderboard, including visitors without an account. Rankings use UTC calendar periods with Monday-based weeks. In the app and on the website, avatar rings also show your rounded percentage of today’s goal completion, valid for your local day. Your current streak length is also visible beside your name until the end of its grace day; this does not expose your daily goal or individual daily history. Your latest synced steps for today contribute to a community histogram that returns anonymous bucket counts, not individual totals or identities. Missing daily totals are excluded. Exact daily goals, past daily calendar history, friends and comments are not made public by this setting. Turning it off removes you from the public ranking. Previously viewed or saved information cannot be recalled.

Sharing uploads daily totals and dates, not raw Health samples or location. Your profile caches the current year and the last 50 days; separate year documents hold earlier calendars. Comments and likes are visible to the profile owner and accepted friends with access. You can remove friends, block users, delete your comments and report abuse. Your username, display name and optional avatar are visible on your public username page, which you can share to connect with friends. This page and username search never reveal step totals, friends, comments or likes.

If you enable notifications, we store a device delivery token and send friend requests, acceptances, today’s 10K achievement and streak milestones. These notifications can reveal an achievement on a recipient’s lock screen. You can disable notifications in Settings. Exported images and screenshots saved by others cannot be recalled.

4. Data Recipients

We use Firebase Authentication, Firestore, Cloud Functions and Cloud Storage to operate accounts and social features, App Check with Apple App Attest to verify app requests, and Firebase Cloud Messaging with Apple Push Notification service for notifications. StepMaxx uses PostHog, hosted in the United States, for product analytics: explicitly named screen views and feature actions, outcomes, app/device metadata and pseudonymous identifiers. The analytics identifier is derived from the guest or connected account ID; names, emails, usernames, photos, comments, friend identities, daily targets and Apple Health step values or history are not sent to PostHog. Automatic screen and tap capture, session recording, location enrichment and advertising attribution are disabled in PostHog. StepMaxx does not display advertisements or include paid subscriptions.

Optional virtual coffee purchases are processed by Apple. We use RevenueCat to validate receipts, remember and restore purchased gifts, and measure purchase activity. RevenueCat receives the guest or connected account identifier, product and transaction identifiers, purchase history, prices, currency, storefront and app/device information. We do not receive your payment-card details. No Apple Health information, goals, friends, comments or photos are sent to RevenueCat.

We use Adjust to measure which marketing campaigns lead to StepMaxx installs and app sessions. Adjust receives app, device and session information, network IP and attribution identifiers. With tracking permission, RevenueCat also links purchase events and revenue to Adjust for campaign measurement using attribution identifiers. Without that permission, the app does not link RevenueCat purchases to Adjust. The iOS tracking permission is requested after you save a daily goal, or when you return to the app if an earlier request was interrupted without a decision. Adjust starts only after you allow tracking. Without permission, Adjust remains disabled and RevenueCat attribution identifiers are not shared with Adjust. You can change your choice in iOS Settings. We never send your steps, daily goal, Apple Health history, profile details, friends, comments or photos to Adjust, and never use Health data for advertising.

We do not sell personal data, and we do not currently display advertising in the App; if this changes, we will update this Policy and obtain consent where required. Personal data may be accessed or shared, where necessary, with the following recipients:

• Service providers who process personal data on our behalf (such as hosting and infrastructure, security, friend search and push delivery);
• Other users, where you use the friends features and only as described in this Policy;
• Professional advisers, where necessary for legal, compliance or business purposes;
• Public authorities, where disclosure is required by law or legal process.

5. International Transfers

Your personal data may be stored or processed outside the European Economic Area. Where this is the case, we put in place appropriate safeguards to protect your data, such as an adequacy decision, the standard contractual clauses approved by the European Commission, certification under the EU-U.S. Data Privacy Framework, or another appropriate safeguard or derogation permitted under applicable law.

6. Data Retention

We keep personal data only for as long as necessary for the purposes described in this Policy, and in particular for as long as your account remains active. When you delete your account, we delete or anonymise your personal data, subject to limited backup retention, security needs, and any legal obligation or lawful request that requires us to retain certain information.

Purchase records may be retained by Apple and RevenueCat for restoration, fraud prevention and required accounting. Deleting a StepMaxx account does not cancel or refund an App Store purchase. Contact us for requests concerning purchase-related personal data.

Apple Health data stored on your device is controlled through your device and Apple Health settings. StepMaxx does not write to Apple Health. Recent totals are also stored locally in a protected App Group cache for the month widget. Deleting your StepMaxx account does not delete the original Apple Health data.

7. Your Rights

Depending on your location and subject to applicable law, you have rights over your personal data.

If you are located in the European Union or the United Kingdom, these rights include the right to be informed about how your data is processed, the right to access your personal data, the right to request rectification of inaccurate or incomplete data, the right to request erasure, the right to request restriction of processing, the right to object to processing (including profiling), the right to object to processing for direct marketing purposes, the right to withdraw consent at any time where processing is based on consent, the right to data portability, the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and the right to lodge a complaint with a supervisory authority.

Residents of certain U.S. states may have the right to know and access the personal data collected about them, to request deletion, to request correction, to receive a copy of their data, to opt out of the sale or sharing of personal data and of targeted advertising, to opt out of certain profiling, to limit certain uses of sensitive personal data where applicable, to appeal a decision refusing a privacy request, and to exercise their rights without discrimination. California residents may also use an authorised agent to submit a request on their behalf. We do not sell personal data. Advertising attribution and partner sharing follow your iOS tracking permission as described above.

Some rights may be limited because we must keep certain information to comply with legal obligations, ensure security, prevent abuse, or defend legal claims.

You may lodge a complaint with a supervisory authority. In France, the competent authority is the CNIL. In the United Kingdom, it is the Information Commissioner’s Office. To exercise your rights, contact us at contact@stepmaxx.app. We may need information to verify that the request relates to your account.

8. Age Requirement

StepMaxx is intended for users aged 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe that a minor has created an account, please contact us so we can take appropriate action.

9. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or destruction, and to preserve the confidentiality, integrity and availability of the service. No method of transmission or storage is completely secure, but we maintain measures appropriate to the risk and review them as needed.

10. Policy Updates

We may update this Privacy Policy from time to time, including to reflect changes to the App, our practices, legal requirements, or security needs. The latest version will indicate the date on which it was last updated. Your continued use of the App after an updated version becomes effective means that the updated Privacy Policy applies to your use of the service.