Step Town ← Back to home
Privacy

Privacy Policy

Last updated: 21 September 2026 · Effective: 21 September 2026

English Deutsch

The short version. Step Town reads your step count from your phone's health system so you can earn coins in a game, plus walking distance and (on iOS) floors climbed for activity stats and daily quests. We store a small profile (display name, town progress, friends list, gift history) in Firebase so it syncs across devices. We use Firebase Analytics / Crashlytics and AppsFlyer to understand installs, crashes, and which ads or creator links brought you to the app. We do not sell your data, we do not show third-party ads inside the game, and we do not share your Health data with anyone for advertising or marketing.

Contents
  1. Who we are
  2. Data we process
  3. Why we process it (legal basis)
  4. Service providers we use
  5. How long we keep your data
  6. Your rights
  7. Account deletion
  8. Children
  9. International transfers
  10. Changes to this policy
  11. Contact

1. Who we are

Step Town is a single-developer project operated as a sole proprietorship by:

Friedrich Henle
Leuchtenberger Kirchweg 50a
40489 Düsseldorf
Germany
Email: henlefreddy@gmail.com

We are the data controller (verantwortliche Stelle) under Article 4(7) GDPR for everything described in this policy.

2. Data we process

2.1 Health data (steps and distance)

On iOS we read from Apple HealthKit. On Android we read from Android Health Connect or the on-device step sensor.

We read:

  • step count (used to earn coins)
  • walking and running distance (activity stats and daily quests)
  • floors climbed, on iOS only (activity stats and daily quests)

On Android we also request permission to read recent health history, so older step samples still count, and permission to read health data in the background, so a silent daily sync can upload your latest step count while the app is closed.

We do not read heart rate, sleep, workouts, weight, or calories. We do not write anything back to your health store.

The number of steps you walked each day is stored in our database as a small record per day (e.g. 2026-05-14: 7,832 steps, 432 coins earned). Distance and floors stay on the device for stats and quests. We do not send health readings to AppsFlyer or ad networks.

2.2 Account data

  • Anonymous user ID generated by Firebase Authentication on first launch.
  • Sign in with Apple, Sign in with Google, or email and password when you choose to link your account, so your village survives a reinstall or device change. Apple Sign-In gives us a private relay email unless you share your real address. Google Sign-In and email sign-in give us the email you used.
  • Display name and friend code you create in the app.

2.3 Game data

  • Town Hall level, buildings placed, villager looks, coin and jewel balances, lifetime steps, lifetime coins.
  • Walk Pass progress for the current month (steps toward rewards, claimed rewards, and whether Gold Pass is active for that month).
  • Club membership and a club-visible profile (display name, town hall, club role) that other members can see.
  • Friends list (the friend codes you have added), pending and claimed gifts, gift counters.
  • Cosmetics, locker looks, and stored decorations you unlock or buy.
  • A public projection of some of the above (display name, town hall level, population, friend code) which other signed-in players can see when you become friends or appear in shared leaderboards.

2.4 Diagnostics & measurement

  • Crash reports via Firebase Crashlytics: a stack trace, operating system version, device model, app version, and the anonymous user ID at the moment of crash.
  • Product analytics via Firebase Analytics (Google Analytics for Firebase): app opens, onboarding completion, and similar in-app events so we can see what works.
  • Install / campaign attribution via AppsFlyer, on Android only: which ad network, campaign, or creator link led to your install. This may use the Google advertising ID, which you can reset or delete in Android settings. On iOS we do not use the advertising identifier at all and the app never shows a tracking prompt.
  • Push token (Firebase Cloud Messaging) so we can send optional game notifications and a silent daily wake that uploads your latest step count. You can turn notifications off in Settings.
  • Server logs for our Cloud Functions (gifts, clubs, Walk Pass, purchase verification, account deletion, signup) containing the user ID and the action performed.

2.5 What we do not collect

  • We do not collect your phone number, postal address, or precise location.
  • We only see an email if you sign in with Google, email and password, or Sign in with Apple. Apple may give us a private relay address instead of your real one.
  • We do not collect contacts.
  • We do not show third-party advertisements inside the app, and we never sell your data.

2.6 Purchases

Optional in-app purchases (jewel packs, the starter offer, and the monthly Gold Pass) are processed by Apple or Google. We do not receive your payment-card details. After a purchase we receive a store receipt or purchase token so we can unlock the item on your game account and so Restore Purchases works. We store Gold Pass entitlement on your account until that month's period ends or you delete the account. Apple and Google keep their own payment records under their policies.

3. Why we process it (legal basis)

  • Performance of a contract (Art. 6(1)(b) GDPR) — to provide the game itself: convert your steps to coins, sync your village across devices, deliver friend gifts. Without this data the app cannot function.
  • Legitimate interest (Art. 6(1)(f) GDPR) — to operate, secure, and improve the service, and to measure which marketing channels bring new players (Firebase Analytics, AppsFlyer aggregated attribution on Android, crash reports, server logs). Our interest is keeping the app working and spending marketing budget responsibly; you can limit advertising identifiers in system settings.
  • Explicit consent for special-category data (Art. 9(2)(a) GDPR): health data (step counts, walking distance, and on iOS floors climbed) is a special category under GDPR. We ask for HealthKit / Health Connect permission inside the app; you can revoke it at any time from your phone's Settings.

4. Service providers we use

To run the app we rely on a small number of processors. We have data processing agreements (DPA) with each of them as required by Art. 28 GDPR.

  • Google Ireland Ltd. — Firebase (Authentication, Firestore database, Cloud Functions, Analytics, Crashlytics, Remote Config, Cloud Storage, Cloud Messaging). Hosting is on Google Cloud infrastructure (multi-region, currently us-central1 for Cloud Functions; data may also be replicated to other Google regions). Google's terms: firebase.google.com/terms/data-processing-terms.
  • AppsFlyer Ltd. — mobile measurement / install attribution so we can see which ads and creator campaigns work. Privacy: appsflyer.com/legal/privacy-policy.
  • Apple Inc. — HealthKit, Sign in with Apple, App Store. Health data is read on-device and never transmitted to Apple by us. Apple's privacy policy: apple.com/legal/privacy.
  • Google LLC — Android Health Connect, Sign in with Google, Google Play. Google's privacy policy: policies.google.com/privacy.

We do not share your Health data with AppsFlyer or ad networks. We never sell data.

5. How long we keep your data

  • Account, game, friends, club, Walk Pass, and purchase-entitlement data: for as long as you keep the app installed and signed in. If you delete your account from inside the app (Settings → Delete Account), all of it is purged from our database within minutes.
  • Crash reports: retained by Firebase Crashlytics for 90 days, then automatically deleted.
  • Server logs: retained for 30 days, then automatically deleted.
  • Backups: Firestore performs internal backups managed by Google with rolling retention up to 7 days, after which deleted data is unrecoverable.

6. Your rights

Under GDPR you have the right to:

  • Access the personal data we hold about you (Art. 15).
  • Rectify inaccurate data (Art. 16). You can change your display name in Settings.
  • Erase your data (Art. 17). Use Settings → Delete Account, or email us.
  • Restrict processing (Art. 18).
  • Data portability (Art. 20) — request a copy of your data.
  • Object to processing based on legitimate interest (Art. 21).
  • Withdraw consent at any time, by disabling HealthKit / Health Connect permission and uninstalling the app.
  • Complain to a supervisory authority. For Step Town this is the data protection authority of the German federal state of North Rhine-Westphalia: Landesbeauftragte für Datenschutz und Informationsfreiheit NRW.

To exercise any right, email henlefreddy@gmail.com. We respond within 30 days.

7. Account deletion

Open the app, tap Settings → Delete Account. We will immediately:

  • Delete your user record, town, buildings, coins, step history, and gift history.
  • Remove your entry from every friend's list.
  • Delete the public profile mirror (display name, town hall level) other players can see.
  • Delete your Firebase Auth account.

If you cannot access the app, email henlefreddy@gmail.com with the friend code visible in your profile and we will delete the account manually.

8. Children

Step Town is rated 4+ on the App Store and PEGI 3 on Google Play. The game does not contain third-party ads or open chat. It offers optional in-app purchases (cosmetic items, jewel packs, and a monthly pass), which are processed entirely by the App Store or Google Play. We do not knowingly collect data from children under 13 (under 16 in the EU). If you are a parent or guardian and believe your child has provided data without your consent, email henlefreddy@gmail.com and we will delete the account on receipt.

9. International transfers

Firebase services are operated by Google. Some processing occurs on servers in the United States. Where personal data is transferred outside the European Economic Area, the transfer is covered by Google's EU Standard Contractual Clauses and Google's adherence to the EU–US Data Privacy Framework.

10. Changes to this policy

If we materially change this policy we will update the "Last updated" date at the top and, where required by law, notify you in-app. Continued use of Step Town after a change means you accept the new policy.

11. Contact

Friedrich Henle
Leuchtenberger Kirchweg 50a
40489 Düsseldorf, Germany
henlefreddy@gmail.com