Google Health connection privacy
Last revised: October 17, 2026This notice supplements the StepClash Privacy Policy for members who choose to connect Google Health. StepClash is operated as a sole proprietorship in Canada. This optional connection is currently limited to invited testers.
What you choose to share
StepClash requests read-only activity and fitness permission from Google Health. Google groups several activity and fitness data types into this permission; StepClash uses it to request daily step totals from Google and Fitbit wearables and the identifiers needed to connect your fitness account. We do not request location, sleep, nutrition, ECG or write permissions, and this integration does not import heart rate or workouts.
We store daily step totals, your Google Health identifier, the legacy Fitbit identifier when needed to match an existing connection, encrypted authorization tokens, connection and sync timestamps, and short connection-error codes. We request up to 30 days of daily wearable steps when you connect, and revisit recent days during later syncs. We preserve the calendar dates returned by Google.
How we use your information
Your steps support your personal goals, progress, challenges, badges and leaderboards. Existing totals are preserved when an imported total is lower. Synced steps may be visible to other members according to your challenge participation and StepClash privacy settings. We do not sell Google Health data, use it for advertising, or use it to train general-purpose AI models.
When updating an existing Fitbit connection, StepClash checks that the identifiers match before switching. A successful switch disables the old Fitbit import and requests revocation of its old permission. If Google cannot confirm the account or required permission, your old Fitbit connection is kept.
Your controls and retention
Use Connected Apps in StepClash settings to disconnect. This immediately stops StepClash imports and removes the active tokens from the connection. A token may remain encrypted in a revocation queue until Google or Fitbit confirms revocation; failed requests are retried. You can also revoke StepClash access in your Google account. Disconnecting does not erase steps already imported.
Stored step history remains until you delete it through available StepClash controls or request account-data deletion. For access, correction, export, deletion, or privacy questions, email privacy@stepclash.com from your registered email address. The retention exceptions and backup handling in our main privacy policy apply.
Google user data policy
StepClash's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google processes its services under its own privacy policy.