Privacy Policy

1. Data controller

The controller of personal data from the Stepkins app (called "Šlapíci" in Czech) and the stepkins.com website (together the "Service") is Powermove s.r.o., company ID 10955267, Bořivojova 878/35, Žižkov, 130 00 Prague 3, Czech Republic, registered with the Municipal Court in Prague under file no. C 351295. Contact: [email protected].

The Service is intended for parents with children. A child has no account of their own and always uses the Service together with an adult. All information about the child is entered by the parent, who decides about it.

2. Data stored only on your device

The app works mainly on your device. Without an account, nothing that identifies you or your child is stored on our server; the only data sent out is the technical data needed for the map (section 5), an anonymous device record, place reports and anonymous counts (section 7) and error and crash reports (section 8). Stored on the device are in particular:

• adventures, including the route, distance, time, tasks and finds;
• adventure photos – without an account they stay on the device only (for photo backup see section 3);
• the child's name, how the app addresses them and their date of birth, the chosen buddy and age group;
• game progress (collection, farm, supplies, completed tasks) and app settings;
• technical data needed for the app to work (for example what has already been counted in the anonymous counts).

Widgets and the live activity on the lock screen show only data from the device. Uninstalling the app deletes this data; you can also delete it in the app (Profile → Data and privacy).

3. Account and backup

Signing in (Apple, Google or e-mail with a password) is optional. It is used to back up your data and share it with other adults in your family. With an account we process:

• account data: e-mail, the account's technical identifier and your name if your Apple or Google account provides it; the name is shown to other family members and can be changed in the app. When you sign in with e-mail, the password is managed by the sign-in service (Google Firebase) and we never see it; we may send a link to your e-mail address to verify it or to set a new password;
• the child's profile: name, how the app addresses them and date of birth, buddy, game progress, game settings and the country you play in – without location;
• adventures: date, length, time, tasks, finds, the adventure route and which family member went on it. The route is stored so that the adventure can be shown on the map on another device too;
• adventure photos: backed up as part of the Premium subscription (section 11; until it launches, for everyone who is signed in) as a reduced-size copy, encrypted, on a secure server in the EU, and visible only to members of your family – we do not look at them (in our administration tool we only see how many there are). Deleting a photo, an adventure or the account also deletes the backup;
• family: family members, their names and the date they joined; a family invitation is time-limited and contains only the information the invited person needs to recognise which family they are joining;
• phone: phone model, system and app version, language, whether you have news and the home screen widget turned on, when you last used the app (we also use this to compile the daily usage overview) and whether the backup succeeded (or a technical description of the backup error), linked to your account so that we can quickly find the cause of a problem; no device identifier and no location.

The data is stored in the Google Firebase cloud; the database with family data is on servers in the European Union, and the provider's sign-in service may also process account data (e-mail, identifier) outside the EU (see section 8). Only family members and the operator have access to a family's data, and the operator only for support and fixing errors. We do not sell the data or pass it on for advertising.

Deletion: an adventure deleted in the app is removed from the server immediately. Deleting your account (Profile → Data and privacy) removes your account and the data of the family you manage (adventures, child profiles, members). If you were invited to a family, deleting your account removes you from it; the family's adventures remain with its other members. After you sign out, the data stays on the server for your next sign-in; you can delete it at any time.

The legal basis is the performance of a contract (creating an account). You enter information about the child as their legal guardian. We process the phone details on the basis of our legitimate interest in fixing errors and providing support; they are deleted when the account is deleted.

4. Information about your child

A child has no account of their own and does not use the Service alone. The parent enters the child's name (a nickname is enough), how the app addresses them and their date of birth, which is used to choose age-appropriate tasks and for a small celebration in the app. Without an account this information stays on the device only; with an account only your family can see it. We collect no other data about the child, show them no advertising and do not use their data for profiling. If you do not want anything about your child stored on the server, use the Service without an account.

5. Location

The app determines the device's location only on the adventure screen – before and during the adventure: to show the map, count the distance, place game elements and find playgrounds. An adventure continues even when the device is locked (on iPhone with the blue location indicator, on Android with a persistent notification); the app does not need "Always" location permission. Outside the adventure screen it does not determine your location; it only remembers the last location from an adventure so that it can load the map faster next time and suggest nearby playgrounds. The app does not store your home address.

To show the map, calculate routes and search for places, we use third-party services based on OpenStreetMap data. These services receive only the data needed for the function (the map area shown, the route coordinates or the text searched for), never your name or information about your child. The adventure route is stored on our server only with an account (section 3).

Sharing an adventure: you create the picture with the map and photo on your device and send it yourself. The app hides the start of the route on it; even so, think about who you share the picture with.

6. Notifications

The app's notifications (walk reminder, the buddy's wish, hunger, weekly goal, holidays and notifications during a walk) are scheduled directly on the device; no server sends them.

The exception is Stepkins news (new features, tasks and special offers), which is on by default; you can turn it off at any time in Profile → Notifications. The device uses Firebase Cloud Messaging (Google), and on iPhone also the Apple Push Notification service, to subscribe to news for the app language and country (the country from Profile, otherwise determined from location on the device; for example "English, United Kingdom"), so that we only send news where it is relevant. For this, the service creates a random device identifier (token). We do not store the token with your account or in our database and we do not link it to information about the child or to location. We usually send news to all subscribers of a language or country at once; a device with an account also subscribes to news for its family, and a device without an account to news meant only for it, so we can also send a message to a single family or a single device (for example a reply to a reported problem or news depending on your plan). News is only shown if you have allowed notifications for the app on the device. When you turn news off or delete the data in the app, the subscription is cancelled and the token is deleted. Part of the processing may take place on servers outside the EU (see section 8). The legal basis is our legitimate interest in informing you about news of the Service; showing notifications requires your permission in the device settings, and you can object at any time by turning the switch off.

You can turn off all notifications in the app (Profile → Notifications) or in the device settings.

7. Anonymous identifier, device record without an account and anonymous counts

A device used without an account may receive an anonymous technical identifier with no name, no e-mail and no link to you or your child. If you sign in later, it may become part of your account. The identifier is used so that:

• place reports ("this playground isn't here") can be counted only once from each device; a report contains the coordinates of the reported place, not your location. Once enough matching reports come in, the place stops being shown;
• there is only one device record without an account ("guest") per device: if you choose to continue without an account in the introduction, the app sends, at most once a day and under the anonymous identifier, the device model, the system and app version, the language, the country, whether you have news and the home screen widget turned on, when you last used the app and, for your last 20 adventures at most, only the date and time, distance, duration and number of completed tasks. It sends no name, routes, places, location or information about your child. This lets us know how many people use the app and where, help if you have problems or send you news (section 6). From these records (and, with an account, from the phone details, section 3) we also compile a daily overview of how many people used the app that day. The record is deleted as soon as you sign in (the device is then recorded with your family, section 3) or delete the data in the app.

Apart from that, the app sends anonymous counts without identifiers: how many devices went through each step of the app's introduction (before choosing an account), how many times a task was shown, completed or skipped and how many times someone opened a news notification. They are sent only as counts; they cannot show which device sent what.

The legal basis is our legitimate interest in an accurate map, in a basic overview of how the Service is used and in supporting users. We do not use this data for advertising or profiling.

8. Crash reports and usage statistics

So that we can fix errors, crash reporting (Google Firebase Crashlytics) is active in the app. When the app crashes, it sends the device model, the system and app version and a technical record of the error, without your name, location or information about your child.

The app also sends error and crash records to our internal administration tool: where in the app the error occurred, a short technical description, the device model, the system and app version, the language, the time and the account identifier or, for a device without an account, its anonymous identifier, so that we can trace the error and get in touch with you. The same error is sent at most once a day, and at most ten errors a day from one device; the records contain no names, location, photos or information about your child. The legal basis is our legitimate interest in the Service working without errors.

Usage statistics (only with your consent). If you agree to anonymous statistics in the app (asked during the app's introduction; you can change it at any time in Profile → Data and privacy), we use Google Analytics for Firebase. It sends a random app installation identifier (not the device's advertising identifier), which screens and features are used, whether you opened a news notification, the device model, the system and app version, the language and the approximate country (derived from the IP address, which Google does not store). We do not send names, e-mail addresses, location, photos or information about your child. Ad personalisation and Google signals are switched off. Without your consent none of this is sent; our only overview of usage then comes from anonymous counts without identifiers (section 7). The legal basis is your consent, which you can withdraw at any time in Profile; withdrawal does not affect processing before it. We do not use the device's advertising identifier.

Part of the processing of crash reports and statistics may take place on servers outside the EU; the provider (Google) takes part in the EU–US Data Privacy Framework and transfers are covered by standard contractual clauses.

9. Messages from you

If you send us a message from the app (Profile → Write to us), we receive your e-mail, the text of the message, any photos and, automatically, the device model and the system and app version so that we can find the reported problem. The message is stored in the Google Firebase database on servers in the EU (photos encrypted) and we read it only in our internal administration tool; we reply to you by e-mail. We delete the photos as soon as the message has been dealt with and keep the text for at most 2 years. Deleting the account also deletes your messages.

10. Website and waiting list

The website does not use advertising or tracking cookies. We store the e-mail from the waiting list form with an e-mail service provider, together with the website language and the date you signed up, so that we can let you know about the app's launch and news. You can unsubscribe using the link in every e-mail; we then delete your e-mail.

11. Payments

The Premium subscription is paid through the App Store or Google Play and applies to the whole family, so it can only be purchased with an account. Payment details are processed only by Apple or Google; we (and our subscription management processor) receive only the account identifier, the plan purchased and information about whether the subscription is valid. Premium includes backup of adventure photos (section 3), more children and adults in the family and additional tasks.

12. Recipients of data

The following processors handle data on our behalf, always only to the extent described above:

• Google (Firebase): accounts, database and cloud storage in the EU, crash reports (Crashlytics), usage statistics with consent (Google Analytics for Firebase), sending news (Firebase Cloud Messaging);
• Apple and Google: account sign-in, payments in the app stores and delivering news to the device;
• a subscription management processor: subscription status by account identifier;
• providers of map data, route calculation and place search (OpenStreetMap data), based in the EU;
• a hosting and storage provider in the EU: hosting of the website and the administration tool, the encrypted photo backup and photos attached to messages;
• an e-mail service provider (EU) for the waiting list.

We do not sell data or pass it on for advertising. We disclose it to public authorities only where the law requires us to.

13. Retention

• On the device: until you delete the app or the data.
• On the server with an account: until you delete the account or the adventure; then immediately.
• Family invitation: until it is accepted or expires.
• Place reports: for as long as needed to keep the map accurate (a report contains only the place, the time and an irreversible hash of the account, not a name or e-mail).
• Anonymous counts (introduction, tasks, news): contain no personal data.
• Crash reports (Crashlytics) and error and crash records in the administration tool: 90 days.
• Device record without an account: until you sign in or delete the data in the app.
• Usage statistics (with consent): detailed records 2 months, after that only aggregate reports without identifiers.
• Token for news: until you turn news off or delete the data in the app; the service invalidates an unused token on its own.
• Waiting list: until you unsubscribe.

14. Your rights

You have the right to access your data, have it corrected or erased, restrict its processing, data portability, the right to object to processing based on legitimate interest and the right to withdraw consent. You can do most of this directly in the app (changing details in Profile, deleting the account and data). In other cases contact us at [email protected]; we will reply within 30 days. You can lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.gov.cz).

15. Changes

We may update this policy. We announce changes in the app or on the website and state the date they take effect.

16. Contact

Powermove s.r.o., Bořivojova 878/35, Žižkov, 130 00 Prague 3, Czech Republic, company ID 10955267 E-mail: [email protected]