Stepli

Privacy Policy

Effective 20 October 2026

Stepli is a calm daily-focus app. This policy explains what data it collects, why, and how you control it. There are no ads in Stepli, and we do not sell your personal data.

The data controller is Zaraar Digital Ltd, a company registered in England and Wales (company number 17347766), registered office 562 High Street, Winsford, CW7 2EA, United Kingdom. For anything about your data, write to [email protected]. For help with the app, write to [email protected].

The short version

What we collect

If you never create an account

Your steps, tasks and settings are stored only on your device. We never see that content. On iOS and Android builds that support purchases, RevenueCat uses an app-generated anonymous customer identifier and receives purchase and entitlement information from the relevant store. This is separate from a Stepli account.

If you create an account

Security logs

Like any service, our database provider records technical logs of requests and sign-in attempts, including IP addresses, to keep accounts secure and to diagnose faults. These logs are not used to build a profile of you, are not linked to the content of your steps, and we do not pass them on to anyone else.

Product analytics (only if you agree)

Stepli asks once, on its home screen, whether it may count which screens and buttons get used. Until you say yes, no analytics is set up and nothing is sent. If you say yes, the app sends a short, fixed list of named events to PostHog so we can tell which parts of Stepli people actually use: for example, that a step was completed, or that the paywall was shown. Events never carry the content of your steps or notes, only which screen or action was involved and a small count or two.

Events are tied to a random id on your device or, once you sign in, to your account id (never your email). That makes them pseudonymous rather than anonymous. IP address discard is on for every event. You can turn this off at any time in Settings, then Usage analytics, which stops events leaving your device straight away. Deleting your account also asks PostHog to delete the events tied to your account id; PostHog removes them in a weekly batch, so it can take up to about a week. Events that carry only a random device id, because you never signed in, cannot be tied back to you, so they are not included and simply expire as described below.

Older versions of the iOS app. Stepli for iOS versions 1.0.0 and 1.0.1 (released in September 2026) work differently: they send these events from the first launch until you switch off Settings, then Analytics. Version 1.0.2 and later ask first and stay off until you say yes. If you use an older version, update it, or switch analytics off in Settings, and email [email protected] if you want the events it already sent deleted.

Crash reports

Crashes and unhandled errors are reported to Sentry so we can fix them. We do not attach your name, email or account id, and the reports do not include the content of your steps. Sentry still receives technical details such as your device model, operating system, app version and the error itself. There is no separate switch for crash reports at the moment.

What we do not do

This website

The website is separate from the app and collects a little:

None of this touches the app, and visiting this site does not create an account or link you to one.

Why we use your data

Under the UK GDPR and the EU GDPR we need a lawful basis for each use of your data. Ours are:

How long we keep it

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, to move it to another service, and you can withdraw any consent you gave. Most of this is in the app:

For anything else, email [email protected]. We will answer within one month.

If you are unhappy

Tell us first at [email protected]. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You can also complain to the UK’s data protection regulator, the Information Commission (formerly the Information Commissioner’s Office, ICO), at ico.org.uk/make-a-complaint, or to the data protection authority in the country where you live.

Who processes your data, and where

These providers act as our processors under written terms. They use your data to provide their service to us, and to run and secure it, not to advertise to you.

Synced account data helps Stepli work across devices; it is not a backup service, so use the export if you want an independent copy.

Where personal data leaves the UK or the EEA for a provider in the United States, we rely on the recognised transfer mechanisms: the UK–US data bridge and the EU–US Data Privacy Framework for certified providers, and standard contractual clauses (with the UK Addendum) in our contracts with providers.

Children

Stepli is for people aged 13 and over, and you confirm this when you create an account. We do not knowingly collect data from children under 13. If you think a child under 13 has an account, tell us at [email protected] and we will delete it.

Do Not Track, and residents of California and other US states

We do not track you across other websites or apps, and we do not use advertising networks or data brokers, so there is nothing for a browser “Do Not Track” signal to switch off. The optional Google Analytics on this website loads only if you accept it, whatever your browser signals. No other party collects personal information about you through Stepli over time and across other websites or apps; our service providers handle data only to provide their service to us. We do not sell or share personal information for advertising. If you live in California or another US state with a privacy law, you can ask us what we hold about you and ask us to correct or delete it, at [email protected].

Changes to this policy

If we make a material change we will update the effective date above and, where required, tell you inside the app or by email.

Contact

Questions about this policy or your data: [email protected]