Legal

StepCity Privacy Policy

Effective date: 17 October 2026

This privacy policy applies to the StepCity app for mobile devices, together with any related services operated by Abbas Ali (collectively, the "Application"), and to this website. Abbas Ali is hereby referred to as the "Service Provider". It explains what information the Application collects, why, who it is shared with, and the choices you have.

The short version

  • StepCity reads your step count from Apple Health (iPhone) or Health Connect (Android), read-only, to turn your steps into StepCoins. It never writes to your health data and never reads anything other than steps.
  • You don't need an account to play. Linking an Apple or Google account is optional and only used to back up and restore your city.
  • The Application uses a small set of service providers (Google Firebase, RevenueCat and OneSignal) to save your city, process purchases, send notifications, and understand crashes and usage.
  • The Service Provider does not sell your data, does not show ads, and never uses your health data for advertising.

Information Collection and Use

Step data. With your permission, the Application reads your step count from Apple Health or Health Connect. Your first sync reads the last 7 days; after that, each sync reads the steps since your previous one. The Application only reads steps and never writes anything back. Your detailed step records stay on your device. The Application keeps totals derived from them as part of your game: your lifetime step total is stored in your save on your device and in your cloud backup, and the number of StepCoins credited by each sync is included in usage analytics. You can turn off access at any time in your phone's settings.

Game data. Your city, StepCoins, progress and the mayor name you choose are stored on your device. A copy is saved to Google Firebase (Cloud Firestore) so your city can be backed up and restored.

App identifier. When you first open the Application, it creates an anonymous user ID with Firebase Authentication. This ID is not linked to your name or email unless you link an account, and is used to connect your cloud save, analytics, crash reports, purchases and notifications to the same install.

Optional account. If you choose to back up your city with Sign in with Apple or Google Sign-In, the Service Provider receives the email address and name that Apple or Google shares (Apple lets you hide your email or share a relay address instead). This is stored by Firebase Authentication.

Usage analytics. The Application uses Google Firebase Analytics to understand how the game is played, for example: onboarding steps, syncs and the StepCoins they credited, buildings placed, city levels reached, purchases made, notifications opened and cities shared. Firebase also collects standard device information such as device model, operating system, app version, approximate country or region (derived from your IP address), and session times, and may collect your device's advertising identifier where your platform allows it. The Application does not show ads and does not use this information for advertising.

Crash reports. The Application uses Firebase Crashlytics to collect crash reports, which include device and app state at the time of a crash, so bugs can be fixed.

Purchases. In-app purchases are processed by Apple or Google; the Service Provider never sees your payment details. RevenueCat manages purchase records (such as which products you own and transaction identifiers) so purchases can be unlocked and restored.

Notifications. If you allow notifications, OneSignal stores your device's push token and basic device information, along with the time of your last step sync and your city level, so reminders can be sent at the right time. Construction-complete reminders are scheduled locally on your device.

Feedback. If you send feedback from within the Application, the Service Provider receives your message, the feedback type, your platform and app version, your app user ID and mayor name, and, if you have linked an account, which provider you used and your account email.

App settings. The Application uses Firebase Remote Config to fetch settings and text that can be updated without an app update.

Photos. If you save or share a picture of your city, the image is saved to your photo library or passed to your phone's share sheet at your request. The Application does not upload these images.

Location. The Application does not request or collect your precise location.

How the Information Is Used

  • To run the game, including converting your steps into StepCoins
  • To back up your city and restore it on another device
  • To unlock and restore your purchases
  • To send notifications you have allowed
  • To fix crashes and improve the Application
  • To respond to feedback and support requests

The Service Provider may use the information you provide to send important information and required notices.

This Website

This website does not use cookies or analytics. It loads fonts from Google Fonts, and it is hosted on Firebase Hosting, which may log standard request information such as your IP address. The store buttons link to the App Store and Google Play, which have their own privacy policies.

Third Party Access

The Application uses third-party services that process information on the Service Provider's behalf and have their own privacy policies:

  • Google Firebase (Authentication, Cloud Firestore, Analytics, Crashlytics, Remote Config, Hosting)
  • RevenueCat
  • OneSignal
  • Apple (Apple Health, Sign in with Apple, App Store purchases)
  • Google (Health Connect, Google Sign-In, Google Play purchases)

The Service Provider does not sell your personal information and does not share it with advertisers or data brokers. Health data is never used for advertising or marketing.

The Service Provider may disclose User Provided and Automatically Collected Information:

  • as required by law, such as to comply with a subpoena, or similar legal process;
  • when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
  • with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.

International Data Transfers

The Service Provider or its third-party service providers may transfer personal data to countries outside your country of residence, including outside the European Economic Area (EEA). Where applicable law requires safeguards for international transfers, the Service Provider will use appropriate mechanisms.

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Adequacy decisions or other legally recognized transfer mechanisms
  • Your consent, where required and legally permitted

Data protection laws in other countries may differ from those in your jurisdiction. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

Data Retention

  • Game data on your device: kept until you uninstall the Application or delete your account
  • Cloud backup and account information: kept until you delete your account or ask for deletion
  • Analytics, crash and notification data: retained for up to 24 months from collection
  • Feedback: retained for as long as needed to respond to and act on it
  • Purchase records: retained as long as needed to provide your purchases and as required by law
  • Aggregated and anonymized data: retained indefinitely as it no longer identifies you

Deleting Your Data

If you have linked an Apple or Google account, you can delete it in the Application under Settings, Delete account. This deletes your city on your device, your cloud backup and your account. Your purchases are tied to your Apple or Google account, so they are not lost and can be restored with Restore Purchases.

Uninstalling the Application removes the data stored on your device and stops further collection, but does not delete information that has already been sent to the Service Provider or its service providers. To delete that information, including a cloud backup without a linked account, feedback you have sent, or analytics and crash data, email appstudio.abbas@gmail.com.

Your Rights

You may request access to, correction of, or deletion of your personal data held by the Service Provider. To exercise these rights, or to withdraw consent where processing is based on consent, contact the Service Provider at appstudio.abbas@gmail.com.

Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights. The Service Provider does not sell personal information. To exercise your CCPA/CPRA rights, contact the Service Provider at appstudio.abbas@gmail.com.

Children

The Application is not intended for children under 16 years of age, or such higher age as required by applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.

Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. The Service Provider does not knowingly collect personally identifiable information from children under 16 years of age in violation of applicable law. In the event the Service Provider discovers that a child has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider (appstudio.abbas@gmail.com) so that they will be able to take the necessary actions.

Security

The Service Provider is concerned about safeguarding the confidentiality of your information. The Service Provider provides physical, electronic, and procedural safeguards to protect information the Service Provider processes and maintains. Your cloud backup can only be read or written by your own app user ID.

Data Breach Notification

If a data breach occurs that affects your personal data, the Service Provider will notify you in accordance with applicable legal requirements, including, where required, providing information about the nature of the breach and the steps being taken to address it.

Changes

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at appstudio.abbas@gmail.com.

Your Consent

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action, such as allowing access to your step data or allowing notifications. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases is carried out as described above.

Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at appstudio.abbas@gmail.com.