Privacy Policy

1. About this policy

This policy explains how StepRally ("we," "us") collects, uses, shares and protects information when you use the StepRally app on iOS and Android, our website and related services (the "Service").

For privacy questions or requests, contact support@steprallyapp.com.

2. Information we collect

• Account and profile: email address, display name, username, avatar emoji, time zone and daily step goal; account identifiers used by StepRally and its subscription integration, including your StepRally account ID, RevenueCat anonymous identifiers and linked identifiers (aliases).
• Steps: with your permission, daily step counts from Apple Health on iOS or Health Connect on Android. We store daily totals in your account. See section 4 for permissions, available history and your controls.
• Food, water, activity and weight: what you enter in these features, including food entries, custom foods, saved recipes, water entries, activity entries, weight entries and goals. Searching for a food sends your search text to our server and USDA FoodData Central as described in section 5.
• Body and goal details: if you use the weight-goal feature, your height, current weight and age. Sex is optional, with "Prefer not to say" as the default. You may also answer whether you are pregnant or breastfeeding and whether you have a history of an eating disorder. These answers start as "No," and we store the answers you save.
• Friends and rallies: friend requests, blocks, invitations and codes, rally membership, step totals, rankings, achievements and results.
• Purchases: whether you have an active StepRally Plus subscription, the product and its dates. We also receive and retain purchase and subscription event information from RevenueCat, including the stored event contents and account identifiers and linked identifiers (aliases) contained in those events. See section 6 for records that can remain after account deletion. RevenueCat manages subscriptions, and payments are handled by the Apple or Google store; StepRally does not collect payment-card details.
• Support and reports: if you contact us or report a problem, your correspondence and, for a report, its category, your description, any rally or user you choose to report and a reference number.
• Technical information: our providers process limited technical information such as app version, timestamps, network address and error logs in providing and securing their services.

3. How we use information

We use information to run and secure the Service; sign you in; sync steps and score rallies; show your food, water, activity and weight records; calculate calorie and weight estimates; enable friends and rallies; confirm Plus access; answer support requests; prevent abuse; and comply with law.

4. Health data and permissions

Apple Health and Health Connect

With your permission, StepRally reads daily step counts from Apple Health on iOS or Health Connect on Android. We do not write data to either service.

On Android, StepRally requests only permission to read steps. We do not request other Health Connect data types, the additional health-data history permission, or background-read permission.

Without the additional history permission, Health Connect's standard access can include step data from up to 30 days before the date you first grant StepRally read permission, as well as later data while permission remains granted. Not requesting the additional history permission does not mean that steps from before permission was granted are inaccessible. Available steps also depend on the data present in Health Connect. This is the scope Health Connect can make available, not a promise that StepRally reads or stores every day in that range.

We use Apple Health and Health Connect step data only to provide the step-challenge features you ask for, including syncing daily totals and scoring rallies. Other members of a rally you join can see your totals for that rally as described in section 5. We do not sell this data, use it for advertising or marketing, share it with ad platforms or data brokers, or use it to build profiles or for unrelated purposes. Use of information received from Health Connect adheres to the Google Play User Data Policy, including the Limited Use requirements.

Optional answers and calorie estimates

If you say you are pregnant or breastfeeding, or have a history of an eating disorder, StepRally does not show its estimated daily calories and does not offer its calorie-target editor on the Weight screens. Other features are unchanged. You can still set a weight goal, and a calorie target you saved earlier, or the Nutrition screen's default targets, may still appear. These estimates and controls are not medical advice.

Your controls

You can turn off StepRally's health-data access in iOS Settings, or in Android Settings → Health Connect → App permissions → StepRally. Revoking access stops future reads under that permission. It does not delete daily step totals already synced to your StepRally account. See section 6 for deletion options and retained records.

5. How we share information

Other StepRally users

• Profile search: other signed-in users can find you by name or username and see your display name, username and avatar.
• Private rallies: members you invite, or who join with your code, can see your display name, username, avatar, step totals and results for that rally.
• Community rallies: these are open to anyone who chooses to join. Before joining, you are told that your display name, username, avatar and rally steps will be visible to the group, and you confirm. Blocking a user does not remove their leaderboard entry.
• We do not display your weight, food, water, activity, or body and goal details to other users through these social features. Information you choose to type into a display name, report or other submitted text can contain personal details; avoid including information you do not want processed for that feature.

Providers

• Supabase hosts our database, sign-in and backend functions. It processes the account and app information StepRally stores, including profile information, daily step totals, personal records, rally data and reports.
• RevenueCat manages subscriptions. It processes an anonymous identifier and, when linked to your signed-in account, your account identifier, along with purchase and subscription information from Apple or Google and technical information needed to operate its service. StepRally does not send RevenueCat your email address or display name. These identifiers are not a promise of anonymity.
• Apple and Google provide Apple Health, Health Connect, the app stores and payment services, as applicable. Their handling of information is also governed by their own policies.

USDA food searches

When you search for a food, our server sends your search text to the U.S. government's USDA FoodData Central to obtain food and nutrition results. StepRally does not send your account ID or email address in that request. Our server makes the request, so USDA sees our server's network address rather than your phone's address from that request. The search text itself is transmitted; avoid entering personal or sensitive information into a food search. This disclosure describes the actual transfer and does not mean that removing account identifiers makes every search anonymous.

Legal, safety and business changes

We may disclose information to comply with law, respond to lawful requests, protect rights and safety, prevent abuse, or in connection with a business transfer.

We do not sell or rent personal information or share it for cross-context advertising.

6. Retention and deletion

We keep information while your account is active and as reasonably necessary to operate the Service, handle support and safety matters, resolve disputes, meet legal duties and protect security. Some records remain after account deletion as explained below. We do not state a fixed retention or automatic-expiry period for those records.

Deleting individual records

In the app you can delete individual food, water and activity entries, as well as your saved recipes and movement goals. The app does not provide individual deletion of weight entries or daily step totals; successful account deletion removes those account-linked records. You can contact support@steprallyapp.com about privacy requests, but this does not promise a separate individual-record deletion feature or an unverified outcome.

Account deletion

You can request deletion in the app through Profile → Delete Account, or email support@steprallyapp.com without using the app. For an email request, use the subject "StepRally account deletion" and include your username if known. Writing from the email associated with your account can help us locate it, but an email address or remembered account details alone are not sufficient verification. We verify your identity before acting on an email request. Please do not send your password, sign-in codes or access tokens.

Successful account deletion removes your sign-in account, profile and associated personal records, including your stored daily steps, food and nutrition logs, water and activity entries, weight records, goals and saved personal recipes. It also removes your account-linked friend and block relationships, invitations, rally memberships and Plus access record. Removing the Plus access record is not subscription cancellation.

Deleting a host account also deletes its hosted rallies and can remove other members' memberships, scores and results within those rallies. Other members' accounts and their personal records outside those hosted rallies are not deleted by that action. Some account relationships can prevent completion and require review; a request or acknowledgment is not confirmation of deletion.

Records that can remain

Not every record is erased by account deletion:

• Reports can remain with account and rally links cleared; report descriptions can still contain identifying information.
• Final results in another host's rally can remain with your account link cleared.
• Purchase-event records, including account identifiers and linked identifiers in their stored content, and subscription-status revision records can remain in StepRally's database.
• Authentication and technical records can remain. Administrative deletion may additionally create an authentication audit record containing your account identifier and email address. Account deletion is not a guarantee that every technical log, audit record or internal recovery copy is immediately erased.
• Provider and store records are separate from the StepRally account. RevenueCat handling is described below; deleting a StepRally account does not itself delete records held by Apple or Google.

Requests concerning retained reports or information about other people are reviewed individually, with care for third-party privacy, safety and applicable legal obligations. Removing a linked account identifier does not necessarily make the remaining content anonymous. We confirm only the outcomes we have verified and identify any parts still pending.

Manual RevenueCat deletion and subscriptions

For verified account-deletion requests handled by email, we include manual RevenueCat customer deletion in our process after matching the customer record and resolving any identity or linked-identifier (alias) conflict. RevenueCat deletion applies to the matched customer record and its linked aliases. Deleting your account in the app does not automatically delete that record or send us a RevenueCat deletion request. You can delete in the app without emailing us. For coordinated provider cleanup, email support@steprallyapp.com; contacting us before deletion helps us verify the customer identifiers. You may also contact us afterward, but we may need additional information to locate the record. We report the action taken and any unresolved issues; submitting a deletion request is not confirmation that processing has finished. Later app activity or purchase restoration can recreate customer or purchase information. This process does not itself remove records held separately by StepRally or the app stores, and it does not cancel Apple or Google subscriptions. Manage cancellation through the store where you subscribed.

7. Your choices and rights

You can edit your profile, manage Apple Health or Health Connect permissions, block users, and delete records and your account as described above. Depending on where you live, you may have rights to access, correct, delete or receive a copy of your information, or to object to or restrict certain processing. Contact support@steprallyapp.com to make a request. We may need to verify your identity and consider applicable legal requirements and the rights of other people.

We do not sell personal information or share it for cross-context advertising.

8. Security

Data travels over encrypted HTTPS connections, and we use access controls to restrict access to stored account data. No method of transmission or storage is perfectly secure. We cannot guarantee absolute security.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact support@steprallyapp.com so we can review and address it.

10. International processing

We operate from the United States. Our providers may process information in other countries, where privacy laws may differ from those where you live.

11. Changes to this policy

We will post changes to this policy here and update its effective date.

12. Contact

StepRally, operated by House of Luna LLC.

For privacy questions, rights requests or deletion requests, email support@steprallyapp.com.