Privacy
Last updated 30 September 2026
Step Together turns walking into a team challenge. To do that we need to know how far you walk. We don't need to know where, so we never ask.
Who we are
Step Together is run by Appy Days, a trading name of Typex (U.K.) Ltd. We are the controller of your personal data. You can reach us at hello@appydays.xyz.
What we collect
- Your account. Your email address, or the account ID and email that Apple or Google share when you sign in with them. The name you choose to show, and a profile photo if you add one.
- Your age check. You give us your date of birth once so we can check you're 13 or over. We don't keep it, only the fact that you passed.
- Walking distance. With your permission, we read walking and running distance from Apple Health on iPhone. On Android we read distance, steps, exercise sessions and your height from Health Connect, and use your height to work out your stride. We keep hourly distance totals and whether each came from a watch, a phone or was typed in. We never read your location, routes, heart rate or any other health data.
- Walks you add by hand. The distance, the time and any note you add.
- Your challenges. Challenges you create or join, your team, invites you send and badges you earn.
- Your settings. Time zone, units, stride or height if you set them, and your notification choices and quiet hours.
- Your devices. Whether you use iPhone or Android, the app version, a push notification token, whether health access is turned on and when you last synced.
- Technical logs. Our servers log requests, including your IP address, to keep the service secure and fix problems.
How we use it
- To run your challenges: adding up your team's distance, tracking milestones, and showing maps, charts and leaderboards.
- To sign you in and keep your account secure.
- To send the notifications you've left turned on.
- To spot and fix problems, and to catch days that look implausibly high so challenges stay fair.
We don't show ads, sell your data or use it for marketing. There are no analytics or tracking tools in the app or on this website. Health data is only ever used to run your challenges.
Our legal reasons (UK GDPR)
- Running the service you asked for covers your account, challenges, teams and notifications.
- Your explicit consent covers walking distance, because it counts as health data. You can take it back at any time in the Health app on iPhone or Health Connect on Android. Distance we have already counted stays with your team.
- Our legitimate interests cover security logs and fairness checks.
Who can see what
- Your teammates see your name, photo, daily totals and how much you added to each milestone, including anything added by hand.
- Other people in the same challenge see team totals, and your name, photo and total on the leaderboard.
- Team captains and the challenge organiser can also review days that look unusually high.
- Nobody outside your challenges sees your walking data.
Services we use
These companies process data for us, only to provide their part of the service:
- Cloudflare hosts the app's server, database and profile photos, and sends sign-in emails.
- Google Firebase Cloud Messaging delivers push notifications. It receives your device's push token and the text of each notification.
- Apple and Google handle sign-in if you choose them, and deliver notifications to your phone.
- OpenRouteService (run by HeiGIT in Germany) plans walking routes and finds places when someone creates a challenge. It receives the place names and map points being searched, never anything about you.
Some of these providers may process data outside the UK, for example in the United States. When they do, they're covered by UK adequacy regulations or standard contractual clauses.
How long we keep it
- Sign-in codes and links expire after 15 minutes. You stay signed in for up to 30 days without opening the app.
- Everything else is kept while you have an account.
- If you delete your account, we delete your name, email, photo, devices and settings. The distance you walked stays with your team, shown as "Former member", so their totals don't change.
- Deleted data can remain in our database backups for up to 30 days before it's gone for good.
Your rights
You can ask us for a copy of your data, to correct it, to delete it or to stop using it, and you can take back consent at any time. To do any of these, email hello@appydays.xyz. We'll reply within a month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Step Together is for people aged 13 and over. If you think a younger child has signed up, let us know and we'll delete their account.
Cookies
This website doesn't use cookies or trackers. The app keeps your sign-in securely on your phone.
Changes
If we change this policy we'll update the date at the top. If a change affects what we collect or who sees it, we'll tell you in the app first.