Step N Scroll ("we", "our", or "the app") is operated by Matheus Mello, a sole trader established in Portugal, acting as the data controller. This policy explains what personal data the app processes, why, on what legal basis, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Data We Process

Depending on which features you use, the app processes:

Step and activity data: daily step counts read from Apple Health, plus motion data from your device's pedometer. Under GDPR this is health data — a special category of personal data under Article 9.
Blocked-app selections: the apps you choose to lock. Apple's Screen Time (Family Controls) framework hands these to us only as opaque tokens; we cannot see which apps they are, and they do not leave your device.
Account data: an account identifier and email address, if you create an account.
Onboarding answers: your name or nickname, chosen goal, activity level and step target.
Photos (Future Walk Self only): if you use the Future Walk Self scan, the full-body photo you upload and the image generated from it.
Subscription data: purchase and entitlement status, processed through the Apple App Store.
Diagnostics: anonymous usage and crash data used to fix faults and improve the app.

2. Why We Process It, and Our Legal Basis

We rely on the following legal bases under Article 6 (and Article 9 where health data is involved):

Explicit consent (Art. 9(2)(a)): for step and activity data, and for Future Walk Self photos. You give this when you grant Apple Health access or start a scan, and you can withdraw it at any time.
Performance of a contract (Art. 6(1)(b)): to run the features you subscribed to — blocking apps, tracking progress against your goal, and managing your subscription.
Legitimate interests (Art. 6(1)(f)): to keep the app secure, prevent abuse, and fix faults using anonymous diagnostics.
We do not sell your personal data, and we do not use it for advertising or profiling that produces legal effects.

3. Third-Party Processors

We share data only with processors acting on our instructions:

Apple (App Store, Apple Health, Screen Time): payment processing and on-device health and blocking frameworks.
Supabase: account authentication and storage for scan data.
RevenueCat and Superwall: subscription and entitlement management.
OpenAI: generates the Future Walk Self image from the photo you upload.
Mixpanel and Sentry: anonymous product analytics and crash reporting.

4. International Transfers

Some processors operate outside the European Economic Area, including in the United States. Where that happens — most notably for Future Walk Self image generation — the transfer is covered by the European Commission's Standard Contractual Clauses under Article 46, together with additional safeguards where required. Your step data is not transferred for this purpose.

5. Your Rights

Under the GDPR you have the right to:

Access the personal data we hold about you, and receive a copy.
Have inaccurate data corrected.
Have your data erased — you can delete any individual scan, all scan data, or your whole account from within the app.
Restrict or object to processing.
Receive your data in a portable, machine-readable format.
Withdraw consent at any time, including by turning off Apple Health access in iOS Settings. Withdrawal does not affect processing carried out before you withdrew.
Lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or with your local supervisory authority.

6. Storage and Security

Step data stays on your device and in Apple Health. Blocked-app tokens never leave your device. Scan photos and results are held in private storage and reachable only through short-lived signed links tied to your account. Data in transit is encrypted with TLS.

7. Data Retention

Account and onboarding data are kept while your account is active. Scan photos and generated images are kept until you delete them or close your account. Anonymous diagnostics are kept for up to 24 months. When you delete your account, associated personal data is removed from our systems.

8. Age Requirement

Step N Scroll is not directed at children under 16, and we do not knowingly process their data. If you believe a child has provided personal data, contact us and we will delete it.

9. Contact

Controller: Matheus Mello, Portugal. For any privacy question, or to exercise any of the rights above, contact privacy@stepnscroll.app

10. Changes to This Policy

We may update this policy as the app changes. Material changes will be signalled in the app or by email, and the date above will be revised.

Privacy Policy