StepLink Privacy Policy
Last updated: 22 October 2026
StepLink is a step-counting app with shared group leaderboards. This policy explains what it collects, why, who else sees it, and how to get rid of it.
Health data is the most sensitive thing StepLink handles, so the short version first: your step data is never sold, never used for advertising, and never shared with anyone outside the groups you personally join.
1. Who is responsible
Spiderworks OÜ
Haapsalu, Estonia
Registry code 17631495
Questions, requests or complaints: [email protected]
We are the data controller for the information described below.
2. What StepLink collects
Account information
Created when you sign in with Google or Apple. StepLink never sees or stores your Google or Apple password — sign-in is handled by Firebase Authentication.
| Data | Source | Why |
|---|---|---|
| User ID | Firebase | Identifies your account |
| Display name | Google/Apple, editable in-app | Shown on leaderboards |
| Email address | Google/Apple | Account identity; cannot be changed in-app |
| Profile photo URL | Google/Apple | Shown on leaderboards |
| Account creation date | StepLink | Account management |
Health and fitness data
| Data | Why |
|---|---|
| Daily step count, per calendar day | The entire purpose of the app |
| Which app or device each day's steps came from | Prevents double-counting between sources |
| Your daily and monthly step goals | Progress display |
StepLink reads step counts only. It does not read or store heart rate, sleep, location, GPS routes, workouts, body measurements, calories, or any other health metric — even where the connected service offers them.
Group data
Groups you create or join, your membership dates, group start dates, and the trophy days your group has earned.
App preferences
Your chosen walker style and accent colour, and whether you have seen the welcome screen.
Subscription status
Trial start date, subscription date and expiry date, where applicable.
Diagnostic data
- Sync logs — timestamps, the reason a background sync ran, and any error it hit, linked to your user ID. These exist to diagnose steps failing to sync.
- Crash reports — via Google Firebase Crashlytics: crash and error reports, device model, OS version, and your user ID so a specific report can be traced to a specific problem.
Advertising
Unless you hold an ad-free subscription, StepLink shows a single banner ad served by Google AdMob. AdMob is an advertising network, and to serve and measure that banner it receives your IP address, your device and OS details, and whether the ad was seen or tapped.
It never receives your step counts, your health data, your groups or your account. Nothing from sections 2 or 3 above is sent to the ad network.
StepLink does not ask for the iOS App Tracking Transparency permission, so on iOS no advertising identifier is available to it and the ads are not personalised across apps. On Android AdMob may use the system advertising ID, which you can reset or delete in your device settings. Buying the ad-free subscription stops the banner loading at all.
What StepLink does not collect
No location or GPS data. No contacts. No behavioural analytics product tracking what you do in the app. No marketing SDKs, no data brokers, and no advertising use of anything StepLink stores about you.
3. Where step data comes from
You choose one source. StepLink reads from it and nothing else.
On your device — you grant permission in the platform's own dialog, and can revoke it there at any time:
- Health Connect (Android) — reads step records written by other apps
- Apple Health / HealthKit (iOS) — reads step records
- Samsung Health (Samsung devices) — read directly via Samsung's Health Data SDK
From a connected account — you authorise StepLink through the provider's own consent screen, and your steps sync without your phone being involved:
- Google Health (formerly Fitbit)
- Garmin
For connected accounts, StepLink stores an access credential so it can keep reading your steps. These credentials are encrypted before storage. StepLink never receives or stores your password for these services.
Apple HealthKit disclosure: data read from HealthKit is used solely to display and compare your step counts within StepLink. It is never used for advertising, marketing or data mining, and is never disclosed to third parties for those purposes.
Google API Services disclosure: StepLink's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Google Health is used only to provide the step-tracking features described here, is not transferred to others except as required to provide those features, is never used for advertising, and is never sold.
4. Who else can see your data
Members of groups you join
This is the one place your data is visible to other people, and it is the point of the app. Anyone in a group with you can see:
- your display name and profile photo
- your daily step counts for days within that group's date range
- your position on that group's leaderboard
If you do not want someone to see your step counts, do not join a group with them. Leaving a group stops your future steps appearing on its leaderboard.
Service providers
| Provider | What they process | Why |
|---|---|---|
| Google Firebase (Authentication, Crashlytics) | User ID, email, crash reports | Sign-in and crash diagnostics |
| Hetzner Online GmbH, Finland | All app data | Runs the API and database |
| Google AdMob | IP address, device and OS details, ad views and taps | Serves the banner ad — no step or health data |
| RevenueCat, Inc. | Purchase receipt, subscription status, an app-specific user ID | Runs the ad-free subscription |
Nobody else
StepLink does not sell your data. Beyond the banner described in section 2 — which receives none of your step, health, group or account data — nothing is shared with advertisers, data brokers, analytics companies or insurers.
We disclose data otherwise only where legally compelled to, and only what is compelled.
5. Legal basis (GDPR)
Health data is a special category of personal data under Article 9 GDPR. StepLink processes it on the basis of your explicit consent (Article 9(2)(a)), given when you grant health permissions or connect a provider account. You may withdraw that consent at any time by revoking the permission, disconnecting the provider, or deleting your account.
Account and group data, and your subscription record, are processed to perform the service you asked for (Article 6(1)(b)).
Crash reports, sync logs and the banner ad rest on our legitimate interest (Article 6(1)(f)) in keeping the app working and paying for it. The ad-free subscription is how you object to the last of those.
6. How long it is kept
Your data is kept while your account exists. When you delete your account it is removed immediately — see below. Crash reports are retained by Firebase Crashlytics according to Google's own retention schedule (currently 90 days).
7. Deleting your account
Settings → Delete Account.
This is a hard delete, not a deactivation. There is no archived copy and no recovery period. It removes:
- your account record, including name, email and photo URL
- your entire step history
- your step goals
- your group memberships
- your background sync logs
- your provider connections, including stored credentials
- your Firebase authentication record
Groups you created are transferred to another member, or removed if you were the only member.
Your access grants at connected providers (Google Health, Garmin) are revoked as part of deletion. If a provider is unreachable at that moment, deletion still proceeds — you can also revoke access directly in your Google or Garmin account settings.
One exception, stated plainly: the Samsung Health permission is held by the Samsung Health app on your device, not by StepLink. Deleting your StepLink account does not remove it. Clear it yourself in Samsung Health's own permission settings.
8. Your rights
Under GDPR you have the right to access, correct, delete, export, restrict or object to the processing of your personal data, and to withdraw consent at any time.
Deletion and correction of your display name are available directly in the app. For anything else, contact [email protected] and we will respond within one month.
You may also complain to your national data protection authority. In Estonia this is the Andmekaitse Inspektsioon (aki.ee).
9. Security
- All traffic between the app and the API uses HTTPS.
- Every API request is authenticated with a short-lived Firebase token.
- Provider credentials are encrypted before being written to the database.
- Access to production systems is restricted to the operator.
No system is perfectly secure, and we do not claim otherwise.
10. Children
StepLink is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
11. International transfers
StepLink's servers and database are hosted by Hetzner Online GmbH in the European Union (Finland). Your step history and account data stay within the EU.
Firebase Authentication and Crashlytics are operated by Google and may process data outside the EEA under Standard Contractual Clauses. This affects your user ID, email address and crash reports — not your step history, which never leaves our EU servers.
12. Changes
Material changes will be announced in the app before taking effect. The date at the top shows the current version.
13. Contact
Spiderworks OÜ
[email protected]