Summary
- Steplock reads only your step count from Apple Health. It never writes to Health.
- The apps you choose with Apple's Screen Time picker stay on your iPhone. Steplock receives opaque tokens from iOS and cannot see which apps they are.
- Your account and sync data is stored with Convex in the EU (Ireland).
- Payments are handled by Apple (in-app purchase) or Stripe (desktop). We never see your card number.
- No advertising, no third-party analytics, no tracking across apps or websites.
- Delete your account any time in the iPhone app (You, then Delete account) or by emailing support@imbored.fun.
Who we are
Steplock ("Steplock", "we", "us") is an independent app developed and operated by Alessandro Zambon, who is the data controller for the processing described here. You can reach us at support@imbored.fun.
This policy covers the Steplock iPhone app, Apple Watch app and widgets, the desktop apps for macOS, Linux and Windows, the Steplock Chrome extension, and this website.
Data we process
| Category | What | Where it comes from |
|---|---|---|
| Account | Email address, name (if provided by your sign-in method), a sign-in provider identifier | You, when you sign in with Apple, Google or email |
| Step progress | Your daily step total, daily goal, the time you reached your goal, per device and calendar day | Apple Health on your iPhone (with your permission) |
| Rules | Your mode, step goal, earn settings, schedules (name, days, times), strict mode and pause state | You, in the app |
| Blocking status | On desktop and Chrome: the names of apps, games or websites you chose to block. On iPhone: only the number of blocked items. | You, in the desktop app or extension |
| Device | A random device identifier, platform, time zone, app version, last sync time | The app |
| Subscription | Stripe customer and subscription IDs and status, or Apple's original transaction ID and expiry date | Stripe or Apple |
| Referrals | Your invite code, who redeemed it and the free months credited | You and the people you invite |
| Support | Whatever you send us by email | You |
We do not collect your location, contacts, photos, browsing history, the content of apps you use, or any health data other than step counts.
Apple Health & Screen Time
Step counts (HealthKit)
With your permission, Steplock reads your step count from Apple Health on your iPhone (including steps recorded by your Apple Watch). We sync your daily step totals to your account so your other devices (Mac, PC, browser, Watch) know when to unlock. Health data is never used for advertising or marketing, never sold, and never shared with third parties except the infrastructure providers listed below that store it on our behalf. You can revoke access at any time in the Health app, then Sharing, then Apps, then Steplock.
Screen Time (Family Controls)
On iPhone, you choose apps and categories using Apple's own picker. iOS gives Steplock opaque tokens, not app names, and those tokens are stored only on your device. Steplock uses them to lock and unlock those apps on your device. They are never uploaded.
Why we process data & legal bases
If you are in the EEA, UK or Switzerland, we rely on the following legal bases under the GDPR:
- Providing the service (Art. 6(1)(b), performance of a contract): your account, rules, sync between devices, blocking status, subscriptions and referrals.
- Your explicit consent (Art. 9(2)(a)) for step counts, which are health data. You give it through the Apple Health permission prompt and can withdraw it any time without affecting earlier processing.
- Legal obligations (Art. 6(1)(c)): keeping billing records as tax law requires.
- Legitimate interests (Art. 6(1)(f)): keeping the service secure and preventing abuse, for example short-lived server logs.
We do not use your data for profiling, automated decisions with legal effects, or advertising.
Service providers
We use a small number of providers who process data only on our instructions:
- Convex (database and backend), hosted in the EU (AWS eu-west-1, Ireland): account, step progress, rules, devices, subscription status.
- Clerk (sign-in): authenticates your account; may process your email and sign-in identifiers in the United States.
- Apple: Sign in with Apple, HealthKit, Screen Time and App Store in-app purchases, under Apple's own privacy policy.
- Stripe (desktop payments): processes your payment details as an independent controller for payment data. We only receive customer and subscription identifiers and status.
- Hetzner (website hosting in Germany): serves this website and download files.
Where data is transferred outside the EEA (for example to Clerk or Stripe in the US), it is protected by the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
Retention & deletion
- Account, rules and progress data are kept while your account exists.
- Delete your account in the iPhone app under You, then Delete account, or email us. This permanently deletes your account, step history, rules, devices and referral data from our database immediately. Residual copies in encrypted backups expire within 30 days.
- Billing records may be kept for up to 10 years where tax law requires it.
- Deleting your account does not cancel an App Store subscription; cancel it in iOS Settings, then your name, then Subscriptions. Desktop (Stripe) subscriptions are cancelled when you delete your account.
Your rights
Depending on where you live, you have the right to access, correct, delete, export (portability) and restrict or object to processing of your personal data, and to withdraw consent at any time. Email support@imbored.fun and we will respond within 30 days. You also have the right to complain to your local data protection authority.
If you are a California resident: we do not sell or share personal information for cross-context behavioral advertising.
This website
steplock.imbored.fun uses no cookies, no analytics and no third-party trackers. Fonts are self-hosted. Our web server keeps standard access logs (IP address, user agent, requested page) for up to 14 days for security and abuse prevention, then deletes them.
Children
Steplock is not directed to children under 13 (or the minimum age in your country) and we do not knowingly collect their data. If you believe a child has given us data, contact us and we'll delete it.
Changes & contact
If we change this policy in a meaningful way, we'll update the date above and tell you in the app before the change takes effect. Questions or requests: support@imbored.fun.