Privacy Policy

01Who we are

Step-In is published by Zentryx Labs. You can reach us about anything in this policy, including a request to delete your data, at zentryxlabs.dev@gmail.com.

02The short version

03What the app stores on your device

Everything below is written to a database inside the app's private storage, which other apps cannot read. You create all of it by using the app; none of it is gathered in the background.

• Activities — the GPS track of a recorded walk, run or ride, including each point's position, altitude, accuracy, speed and time, plus distance, pace, splits, elevation, estimated energy and any title or note you add.
• Food — meals you log with their calories and macronutrients, the time you logged them, and any foods you save for reuse.
• Body — weigh-ins, height, year of birth, sex and any goal weight, which are used to estimate energy expenditure and nutrient targets.
• Steps — a daily step total read from your phone's own step counter. To put steps taken around midnight on the right day, the app also asks Google Play services on your phone to keep a record of when steps were taken (Google's Recording API). That record is kept on your phone by Play services for up to ten days, needs no Google account, and is not sent to us or anyone else.
• Water and fasting — drinks you record, and fasts you start and finish.
• Settings — units, goals, reminder times, map preference, your chosen colour and theme, and the name you give if you use the app without signing in.

04Permissions, and why each is asked for

You can refuse or withdraw any of these in Android's settings. The app keeps working without them, minus the feature each one serves — without location it cannot record a route, and without the activity permission it cannot count steps.

05When information leaves your phone

There are four occasions, and no others.

Looking up a food

Searching for a food or scanning a barcode sends the words you typed, or the barcode number, to Open Food Facts and to our own server, which forwards the query to the food database provider FatSecret and passes the answer back. These requests carry the search term only. They do not carry your name, your account, your location or anything else you have logged.

Drawing a map

Map tiles are fetched from Esri's ArcGIS imagery service and from OpenFreeMap as you look at a map. A tile request necessarily reveals to those providers the area of the world being viewed, and your IP address, in the same way any map in any app does. Your recorded track is never sent to them.

Signing in (optional)

If you choose to sign in, we use Google Sign-In through Firebase Authentication. We receive your Google account's identifier, email address and display name, and use them only to tell one account's backup from another.

Cloud backup (optional, and only while signed in)

While you are signed in, the app uploads a compressed copy of its whole database — the activities, food, weight, steps, water, fasting and settings described in section 3 — to Google Cloud Firestore, stored against your account identifier. It uploads when the app goes to the background and only when something has actually changed. If you never sign in, this never happens and no copy of your data exists off your phone.

06What we never do

• We do not sell or rent your data, and we do not share it with advertisers or data brokers.
• We run no advertising, no analytics SDK and no crash-reporting SDK.
• We do not build a profile of you or track you across other apps or websites.
• We do not read your data for any purpose of our own. Nobody at Zentryx Labs looks at the contents of your backup.

07How long it is kept

Data on your phone stays until you delete it or uninstall the app. A cloud backup stays until you ask us to delete it or delete your account; the app keeps a small number of recent backups and removes older ones automatically.

08Deleting your data

On your phone. Individual records can be deleted in the app. Uninstalling Step-In removes the whole database from your device.

Your account and cloud backups. Signing out in the app stops any further upload but does not by itself erase what has already been stored. To erase it, open the app, go to Me → Settings → Account → Delete account. That permanently deletes your account and every backup held against it, and offers to erase this phone's own copy as well. It happens immediately and we are not involved.

If you no longer have the app installed, email zentryxlabs.dev@gmail.com from the address you signed in with and we will do it for you. We will confirm and complete the deletion within 30 days.

Depending on where you live you may also have the right to ask what we hold, to get a copy of it, to correct it, or to object to our handling it. Use the same address and we will answer.

09Security

Data on your device sits in the app's private storage, protected by Android's own sandbox and by whatever screen lock and device encryption you use. Traffic to and from our servers and every third party listed above travels over HTTPS. Cloud backups are held in Google Cloud Firestore under access rules that permit only the signed-in account to read its own data.

No system is perfect, and we will not pretend otherwise. If we ever discover a breach affecting your data we will tell affected users and the relevant regulator as the law requires.

10Children

Step-In is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us information, write to us and we will delete it.

11Health information

Step-In is a fitness and food diary. It is not a medical device, it does not diagnose or treat anything, and nothing it shows you is medical advice. Energy and nutrient figures are estimates from published formulas and vary from person to person.

12Changes to this policy

If this policy changes we will update the date at the top of the page, and for anything significant we will say so in the app before the change takes effect.

13Contact