Privacy Policy

1. Who we are

steps.org is operated by Pipedesk OÜ, Pärnu mnt 22, 10141 Tallinn, Estonia, trading as Not a Company. Pipedesk OÜ is the controller of the personal data described here. Write to us at [email protected].

2. What we process

Your account: your email address, which you sign in with through Clerk; your time zone; your weekly goal and your stakes, and any change you make to them.

From Strava: when you connect Strava (you can untick any permission on Strava's own screen), we read your activities through Strava's API: each activity's start time, moving time, sport, name, the device that recorded it, whether it was entered by hand, and whether it has heart rate or a GPS track. We never post to Strava. We keep these activities for 7 days at most. From them we keep each week's total minutes, whether you hit your goal, and your price after it, as the record of what you were charged.

Why you are doing this, written by you: private. It appears only to you: on Progress, in Settings and in our emails.

Payments: your card is saved with Stripe when you start your plan, and you're charged once a month for the month just ended, by the day, each day at that day's price. Stripe gives us a customer reference, the amounts and whether each charge went through; your card details never reach us. 30% of what you pay, after VAT and card fees, buys carbon removal through Stripe Climate, which receives no personal data from us.

Emails: the address each email goes to and whether it was delivered, through Resend.

Visits: pages viewed and the link that brought you, through Google Analytics and Seline (section 6). Nothing read from Strava is part of it.

Messages to us: if you use the contact form, your name, email and message, through Formspark.

Technical data: IP address and browser details, used to keep steps.org secure and to limit abuse.

3. Why, and on what basis

To run your account and your weekly goal, to read your activities from Strava and to charge your monthly price: this is the contract between us (GDPR Art. 6(1)(b)).

To keep steps.org secure, to prevent abuse, and to count visits so we can improve the site: our legitimate interests (Art. 6(1)(f)).

To keep payment records: our legal obligations (Art. 6(1)(c)).

We don't sell personal data, and we don't use it for advertising. Nothing read from Strava is used for analytics or by any AI.

4. Who sees your data

Only you. Your week, your activities, your price and your reasons show only to you, when you're signed in. steps.org has no public pages and no search listing of anyone's data.

5. The emails we send

Six kinds, to you: on Monday, how your last week went and your new price; the moment you hit your weekly goal, your price from Monday and your streak; on Saturday, if you haven't hit it yet, your minutes so far and what's left; one when a monthly charge fails; one confirming we've deleted your Strava data, when you disconnect Strava or close your account; and one 7 days before your account closes after 90 days with no activity on Strava. They can carry one of your reasons for doing this, in your words. You can turn off Monday's, and the hit with Saturday's, in Settings; the others come while your account is open. Emails are sent through Resend. Stripe emails your receipts itself.

6. Measuring visits

steps.org counts visits with Google Analytics and Seline, so we can tell which pages help people start. Seline runs without cookies. There is no cookie banner: you can switch measuring off at any time with "Don't measure my visits", in the footer and on our privacy page, which stops both from loading in that browser. Signing in uses Clerk's own cookies, which steps.org needs to work.

7. Who processes data for us

Strava (your activities, read with your permission; Strava is a controller of your Strava data in its own right, under its own privacy policy, and records how apps use its API), Clerk (sign-in), Stripe (payments; Stripe is also a controller of payment data in its own right), Resend (email), Google Analytics and Seline (measuring visits), Formspark (the contact form) and our hosting providers. Some of them process data in the United States, at least in part. We share with them only what each needs to do its job.

8. How long we keep it

Activities from Strava: 7 days at most. Your weeks, your goal and your reasons: while your account is open. Remove steps.org in Strava's settings and we delete what we hold from Strava within two days and email you to confirm; your weeks count as missed until you reconnect.

After 90 days with no activity on Strava we close your account, and closing it yourself does the same: your goal, weeks, reasons and Strava data are deleted, and we email you to confirm. We email you 7 days before an account closes for inactivity.

What outlives a deletion, by law or by nature: Stripe keeps the payment records the law asks it to, and visits already counted by Google Analytics stay there under a random id until their retention ends. We keep one count of deleted accounts, with nothing about you in it.

9. Your rights

You can ask to see, correct, delete or take a copy of your personal data, and to restrict or object to how we use it. Most of it you can change yourself, in Settings. Write to [email protected]. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the data protection authority where you live.

10. Age

steps.org is for adults, aged 18 and over.

11. Changes

If this policy changes in a way that matters, we'll update the date at the top and, for significant changes, tell you by email.