Privacy Policy

Last updated: July 2026

This Privacy Policy describes how StepTeddy, operated by Deniz Ilkaya ("Service Provider"), handles your data. We built StepTeddy to work with as little data as possible — your health data stays on your device.

Data Controller

Deniz Ilkaya is the Data Controller responsible for your personal data.
Address: Büschingstraße 11, Germany
Email: appsbydeniz@gmail.com

What Data We Collect

StepTeddy collects only what it needs to function:

• Step & activity data — read from Apple Health with your explicit permission. Stored locally on your device only.
• Streak & badge data — your best streak, earned badges, and badge notifications are synced via iCloud Key-Value Storage so your progress is preserved across devices.
• Purchase data — managed by RevenueCat to verify your subscription. We do not store payment details ourselves.
• Device information — basic technical data (OS version, device type) may be collected automatically by third-party SDKs for operational purposes.

How We Use Your Data

Your data is used solely to provide the app's features: tracking daily steps, calculating streaks, awarding badges, and updating your home screen widget. We do not use your data for advertising or profiling.

Legal Basis (GDPR)

Where GDPR applies, we process your data based on:

• Your consent — for HealthKit access, which you grant through iOS permissions. You can revoke this at any time in your iPhone's Settings.
• Contract performance — to deliver the features you paid for.
• Legitimate interests — for basic app stability and security.

Third-Party Services

StepTeddy uses the following third-party services, each with their own privacy policy:

• RevenueCat — subscription and purchase management. Data is shared only for the purpose of payment processing and only to the extent that it is necessary.

We do not sell or share your personal data with any other third parties.

iCloud Sync

Your best streak, earned badges, and badge notification history are stored in iCloud Key-Value Storage. This allows your progress to sync across your Apple devices. This data is governed by Apple's privacy policy. You can disable iCloud access for StepTeddy in your iPhone's Settings.

Data Retention

Step and streak data is stored locally on your device for as long as you use the app. iCloud data persists until you disable iCloud for StepTeddy or delete your iCloud account. Uninstalling the app removes local data, but iCloud data may remain until manually cleared through your device settings.

Children's Privacy

StepTeddy does not knowingly collect personal data from children. If you are under 16, a parent or guardian must agree to this Privacy Policy on your behalf. As StepTeddy stores all data locally on the user's device and in the user's own iCloud account, the Service Provider does not have access to or control over user data. To remove your data, simply uninstall the app and clear StepTeddy's data from your iCloud settings. Contact us at appsbydeniz@gmail.com if you have concerns.

International Data Transfers

RevenueCat, our subscription provider, is based in the United States. When you make a purchase, your purchase data may be transferred outside the European Economic Area (EEA). RevenueCat relies on Standard Contractual Clauses approved by the European Commission to ensure an adequate level of data protection. See RevenueCat's Privacy Policy for details.

Data Security

Your step and streak data is stored locally on your device and protected by iOS's built-in security. iCloud data is encrypted by Apple both in transit and at rest. We do not operate our own servers, which minimises the risk of a data breach on our end. No system is completely secure, but we have designed StepTeddy to handle as little data as possible.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours as required by GDPR. If the breach is likely to result in a high risk to you personally, you will also be notified without undue delay.

Your GDPR Rights

If you are in the EU, you have the following rights regarding your personal data:

• Art. 15 – Right of Access — request a copy of the data we hold about you.
• Art. 16 – Right to Rectification — request correction of inaccurate data.
• Art. 17 – Right to Erasure — request deletion of your personal data ("right to be forgotten").
• Art. 18 – Right to Restrict Processing — request that we limit how we use your data.
• Art. 20 – Right to Data Portability — request your data in a structured, machine-readable format.
• Art. 21 – Right to Object — object to processing based on legitimate interests. You may object to direct marketing at any time.
• Art. 7(3) – Right to Withdraw Consent — withdraw HealthKit permission at any time in your iPhone's Settings → Privacy & Security → Health.
• Art. 77 – Right to Lodge a Complaint — file a complaint with your local Data Protection Authority.

To exercise any of these rights, contact us at appsbydeniz@gmail.com. We will respond within one month, extendable by two months for complex requests.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the date above. Continued use of the app after changes constitutes acceptance, to the extent permitted by applicable law.

Contact

For any questions about this Privacy Policy, contact us at: appsbydeniz@gmail.com