Last updated July 20, 2026 · Steps.org is operated by Pipedesk OÜ, Estonia
Steps (steps.org) is operated by Pipedesk OÜ, a company registered in Estonia, in the European Union. Pipedesk OÜ is the data controller for your personal data under the GDPR.
Your phone number (so Steps can text you on iMessage), the check-in messages you send — the words are yours; a one-word answer is enough — your chosen check-in time, what you told us to call the thing you are tracking (optional: you can leave it unnamed), your plan and payment status, and, on the Partner plan, the name and iMessage number of the partner you designate. We also keep operational logs about message delivery as metadata only: these logs never contain your words. Payments are handled by our payment processor — we never see or store card numbers. steps.org collects basic, privacy-respecting analytics.
To send your daily check-in, keep your count and history, send the weekly Partner report if you are on that plan, and manage your account and billing. Nothing else. Your check-ins are never used to train AI models, never sold, and never used for advertising.
Your check-ins are stored and counted — that is all. No AI model reads or analyzes them, no chatbot replies to them, and nothing you send is ever used to train AI, ours or anyone else's. The confirmations Steps sends are simple automated messages. Sensitive by nature, your recovery data gets the narrowest processing we can build: it is read by software only to update your count, and by no human, ever.
If you designate an accountability partner, Steps sends them one iMessage report per week containing your day count and your check-in record — never the text of anything you wrote. Their number is stored only to deliver that report. Remove your partner at any time and reports stop immediately; delete your account and their details are erased with everything else.
Your data is encrypted at rest and stored in EU data centers, with strict access controls and audit logging.
Under the GDPR you can access, correct, export, or permanently delete everything at any time — self-serve at steps.org, or by writing to us. You may also lodge a complaint with the Estonian Data Protection Inspectorate (AKI).
We keep your data for as long as your account exists. If you delete your account, all data is permanently erased within 30 days.
Privacy questions: [email protected].
