Privacy Policy

What we collect and why

• Fitness data: Step counts, distance, floors, date, and source device are processed locally. When you sign in and use Social, daily summaries may be sent to StepMelon servers for friend activity, private-group leaderboards, and challenges. They are used for app functionality, never advertising.
• Account and contact information: Name, username, email address or phone number, and Apple/Google account identifiers are used to create, secure, and recover your account. Authentication tokens and limited security records are used to protect the service.
• Profile and user content: You may add a biography, profile photo, country, time zone, and featured achievement. We store your privacy choices, reports, and block list. Other members receive only fields authorized by your settings and relationship.
• Social activity: Friend requests, friendships, private-group memberships, challenge participation, invitations, referrals, and permitted activity items are stored to operate Social.
• Contacts: Contact access is optional and requested only when you choose Find Friends. Raw address-book entries are processed on-device. StepMelon sends and stores one-way hashes of selected email addresses or phone numbers for matching; raw contact values and contact names are not uploaded.
• Photos: A profile photo you select is cropped and uploaded to private StepMelon storage, then delivered through short-lived authorized URLs. Saving a share card or badge uses the device photo-library controls. StepMelon does not upload unrelated photos.
• Purchases: Apple and Google process payment details. The apps read subscription/product status for premium access; StepMelon does not receive your card or bank details.
• Optional Android analytics: Firebase Analytics is off by default and can be enabled or disabled in Settings. When enabled, privacy-limited app-interaction, paywall, purchase-flow, permission-state, app-version, device-platform, and short error-category events may be collected. Step counts, profile content, raw contacts, and health records are excluded. Apple builds do not include a third-party analytics SDK.
• Support and moderation: If you contact support or report content, we store the information needed to respond, investigate, prevent abuse, and document the action.

Health and device access

StepMelon uses HealthKit, Motion & Fitness, Health Connect, activity recognition, and step-sensor APIs only after the relevant device permission. The apps may read steps, distance, floors, exercise, and active-calorie information supported by the platform to calculate and display progress. Health permissions are not used for advertising or data-broker activity. Detailed device history remains local; only the daily social summary described above is sent to StepMelon when an authenticated social sync occurs.

Who can see social data

New profile controls default to private or nobody. You can separately choose who may see your profile, steps, streak, achievements, and group memberships; whether you can be discovered by contacts or everyone; and who may send friend or group invitations. A block in either direction overrides friendships and shared groups. Watch apps receive only a minimal read-only summary of the signed-in member and server-authorized friends/groups; hidden profile fields and photos are not included in that watch payload.

Sharing and service providers

We do not sell personal data and do not use it for cross-app advertising tracking. We disclose data only to the people you authorize through Social, to infrastructure providers that host or secure StepMelon, to Apple or Google for sign-in and purchases, to Firebase when Android analytics is enabled, when required by law, or to protect people and the service. Providers process data under their own contractual and security obligations.

Retention and deletion

• Local fitness history, goals, themes, and app preferences remain until you clear app storage, remove the app, or use the applicable device controls. Apple iCloud data is controlled through your personal iCloud settings.
• Account, profile, social, contact-hash, and daily-summary records remain while the account is active. Expired security and operational records may be removed on shorter schedules.
• Android's recent local analytics history is retained for up to 90 days. Firebase retention follows the configured Firebase project settings.
• Reports and minimal audit/security records may be retained after content or account deletion where reasonably necessary to prevent abuse, document moderation, meet legal obligations, or protect the service. Audit records are designed not to contain profile text or photo contents.

Delete your account in the app from Social → Profile → Edit Profile → Delete Account. This revokes tokens and deletes the account, profile photo, contact hashes, invitations/referrals, and account-linked social records through database deletion rules. You can also use our web deletion request page. App-store purchase records remain with Apple or Google under their requirements.

Safety and user content

Profile photos, biographies, usernames, groups, and activity content must follow the StepMelon Community Guidelines. The apps provide reporting and blocking. Reports are reviewed and content or accounts may be restricted or removed. For urgent safety concerns, contact support@stepmelon.app.

Children

StepMelon's account-based social features are not directed to children under 13 (or the minimum digital-consent age in their country). A parent or guardian should not create a social account for an underage child. Contact us if you believe an underage account was created so we can investigate and delete it.

Security and choices

StepMelon uses encrypted network connections, scoped access tokens, private photo storage, signed photo delivery, rate limits, and server-side authorization. No system is risk-free. You can decline optional contacts, photo, notifications, analytics, and social features; revoke device health permissions; change each privacy setting; block another member; export locally available history; or delete your account.

Contact and changes

Sandia Software Services operates StepMelon. Email support@stepmelon.app or visit Support. We aim to acknowledge privacy and deletion requests within 7 business days. Material policy changes will be posted here with a new effective date.