PipstepDRAFT for review by the owner and a lawyer. Not yet in force. Items in [square brackets] must be filled in.
Privacy policy
Last updated: [date of publication]
Pipstep is a walking and running coach for Apple Watch and iPhone. We built it so that it works on your devices, offline, and sends as little as possible anywhere else. This page explains, in plain words, what data exists, where it lives and what you can do about it.
The short version
- Apple Health data stays on your devices. We never send it to our servers, never sell it and never use it for advertising.
- Your location never leaves your device. GPS is used during a lesson to measure distance, pace and route, and the route is saved to Apple Health only.
- You don't need an account. Lessons, the path, your streak and habit school work without one.
- Friends features are optional. If you sign in, we store a small profile and your lesson results so friends, leagues and groups can work.
- Progress backup comes with a profile. Signed in, your path, stars, streak, gems and settings are backed up so you can pick up on any iPhone. Apple Health data is not part of it.
- Analytics are opt-in and anonymous. Nothing is counted unless you say yes.
- No ads, no trackers, no third-party analytics or advertising SDKs. This website sets no cookies.
Who is responsible
[Legal name of the company or person], [postal address], [country]. Contact: office@doderasoft.com. [If required: name and contact of an EU representative / data protection officer.]
1. Data that stays on your devices
Apple Health
With your permission, Pipstep reads from Apple Health: workouts and workout routes, heart rate, resting heart rate, heart rate variability, heart rate recovery, VO₂ max, sleep, sleeping wrist temperature, workout effort scores, steps, walking and running distance, active energy, running speed, power and running form (stride length, vertical oscillation, ground contact time), body weight, date of birth (for heart-rate estimates), your heart-rate zones and Activity ring summaries. It uses them to suggest where to start and to set today's targets relative to you.
With your permission, Pipstep writes to Apple Health: each lesson as a workout (with route, heart rate, distance, energy and one interval per lesson step), and a glass of water when you tick a water break.
Apple Health data is processed on your iPhone and Apple Watch only. It is never sent to our servers, never shared with third parties, never used for advertising or marketing, and the app does not store it in iCloud. You can change Health permissions at any time in the Health app or in Settings → Privacy & Security → Health.
Location and motion
During a lesson Pipstep uses GPS (iPhone or Apple Watch) and motion sensors to measure distance, pace, route and steps per minute. On iPhone the app keeps using location while the phone is locked, but only while a lesson is running. Location is never sent to our servers.
Your progress and settings
Your path progress, stars, streak, gems, Pip's outfits, lesson history and settings are stored on your iPhone and Apple Watch and kept in step directly between the two devices (Apple's WatchConnectivity). They are included in your device backups like any app data. If you sign in, they are also backed up to our server (section 3).
Lesson logs
Each lesson on the watch writes a small diagnostic log (coach lines, sensor summaries every few seconds, audio and workout events). It is moved to your iPhone after the lesson and stays there. We never receive it unless you choose to share it with us, for example when asking for help.
Health check
Before your first lesson Pipstep asks a short health check (for example heart conditions, chest pain, pregnancy). Your answers are not stored: only whether Pip should coach extra gently (yes or no) is kept, in your settings on your iPhone and Apple Watch. It is never sent to our servers or counted.
Crash and performance reports
Apple's MetricKit tells the app, about once a day, if it crashed, froze or used too much battery or memory. These reports are kept on your iPhone, where you can see, export or delete them in Settings → Health & safety → Diagnostics. They are sent to us only if you said yes to anonymous counts (section 4).
2. Course updates
The app checks our content server for new lessons and coach lines and downloads them. These requests contain no account or device identifier. Like any web server, it receives your IP address and app version in the request; [our server logs keep them for N days / are not kept].
3. Friends features (only if you sign in)
If you sign in on the Friends tab, we create an account on our community server and store:
| What | Why |
|---|---|
| Sign-in identity: an ID from Apple, Google or your email address (Apple sign-in asks only for your name; Google sign-in gives us your Google account ID, email and name) | To sign you in and link sign-in methods |
| Display name, Pip colour and mood, friend code | So friends and league members recognise you |
| Streak length and number of lessons | Shown on your profile to friends |
| Finished lessons: title, stars, XP, duration, distance and time | Weekly XP, leagues, friend quests, challenges, and the friends feed if you choose to share |
| Friends, friend requests, invites, blocks, groups, cheers, nudges and walk-together sessions | To make those features work |
| Reports you send about someone | To keep the community safe |
| If you have Pipstep Plus: product, expiry date, environment and Apple's original transaction ID | To unlock the Plus bonus friend quest |
| Your progress backup: path progress and stars, XP, streak and calendar dots, campfires, gems, outfits and shop items, quests, habit-school progress, events, breaks, Plus status, settings, water you log in Pipstep (if the water tracker is on), your effort levels (walking and running speeds, steps per minute, typical lesson length) and a short list of your last 60 lessons (date, lesson, stars, minutes, distance) | So your progress is safe and comes back on a new or second iPhone, merged without losing anything |
What the backup never contains: anything read from Apple Health (heart rate, heart-rate estimates, water other apps logged, sleep and the rest listed in section 1), your health check answer, routes or locations, and the detailed lesson history (routes, heart rate, splits) — those stay on your devices. The backup is updated by itself after changes while you are signed in; Settings → Progress backup shows when it last happened. Signing out keeps everything on your devices. You can delete the backup with your account (it is deleted with everything else).
Sharing is off by default. Your finished lessons count for weekly XP and leagues, but friends only see them in their feed if you turn on "Share finished lessons with friends" in Settings. League members see only your display name, Pip colour and weekly XP. Nobody ever sees your route or location; we never receive them.
Email sign-in: we send you a 6-digit code and a sign-in link through our email provider ([provider name]). We store only a scrambled (hashed) version of the code; it expires after 10 minutes.
Delete your account any time in the app: Settings → Community → Delete account. This deletes your profile, friends, posts, cheers, your progress backup and everything else listed above from our server for good. Your lessons and streak on your devices stay.
4. Anonymous counts (only if you say yes)
When you first open the app we ask whether you want to help improve Pipstep. If you say yes, the app keeps simple daily counters on your device (for example "a lesson was started", "lesson 3 was finished with 2 stars", "onboarding step 2 was shown", "the Plus screen was shown") and sends each finished day once to our server. The counts carry no account, device or advertising identifier. Our server only adds them to totals per day; it does not store your IP address, and the rate limiter uses a salted, one-way hash of it that is kept in memory only. You can turn this off at any time in Settings → Privacy, which also deletes any counts not yet sent.
With the same yes, crash and freeze reports are summarised and sent too: the kind of problem, the place in Pipstep's own code where it happened (a program name and a number), the app and iOS version and the iPhone model family (a code such as "iPhone17", never your exact model), plus a day. No message text, no account, device or advertising identifier, no location or lesson data, and no IP address is stored. Our server only adds them to counts per problem and day.
5. Purchases
Pipstep Plus is sold by Apple through the App Store. We never see your payment details. The app checks your subscription with Apple on your device.
6. Who else is involved
- Apple: Apple Health, Sign in with Apple, the App Store and in-app purchases, under Apple's own privacy policy.
- Google: only if you choose "Continue with Google", under Google's privacy policy.
- Hosting: our servers run at [Hetzner Online GmbH, Germany / Finland].
- Email: sign-in emails are delivered by [email provider].
We don't sell or rent personal data, and we don't share it for advertising.
7. How long we keep things
- On your devices: until you delete the app or its data.
- Community account data: until you delete your account. Sign-in codes expire after 10 minutes; walk-together sessions after 3 hours.
- Anonymous daily totals and crash counts: [kept for as long as they are useful / N years]. They can't be linked to you.
- Crash and performance reports on your iPhone: 30 days at most.
- Server logs: [N days].
8. Your rights
Depending on where you live (for example under the GDPR), you can ask to access, correct, delete or export your data, object to or restrict processing, and complain to your data protection authority. Most of this you can do in the app; for anything else write to office@doderasoft.com. [Legal bases to confirm: contract for the friends features, consent for anonymous counts and Health access, legitimate interest for security and server logs.]
9. Children
[Owner decision: minimum age for the friends features, e.g. 13 or the age of digital consent in your country.] Lessons and Apple Health work without an account.
10. This website
This website is static. It sets no cookies, loads nothing from other servers and uses no analytics.
11. Changes
If we change this policy we will update the date above and, for important changes, tell you in the app.