StepClash turns daily movement into fun challenges, streaks, and real accountability.Garmin / Fitbit / Manual Tracking
StepClash
Privacy

Privacy Policy

Last Revised: October 13, 2026

Your Privacy Matters to Us

Stepclash ("StepClash," "we," "our," or "us") is operated as a sole proprietorship in Canada and is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and what choices you have when using our website, mobile tools, and related services.

1. Consent

This policy explains our practices; it does not replace consent required by law. You choose whether to submit optional information, share content, or authorize a connected fitness service. You can withdraw permission by disconnecting an integration or contacting us. Withdrawal may affect features that need that information and does not undo prior lawful processing.

2. Information We Collect

  • Personal Information: username, name, email address, date of birth, height, sex, region, timezone, account preferences, and authentication records. Depending on the features you use, we also collect steps, weight, body-fat percentage, muscle mass, workouts, food and hydration logs, habits, goals, progress photos, meal or label photos, and content such as posts, comments, messages, and support requests.
  • Technical and payment information: IP address, browser and device information, security and usage events, integration identifiers and authorization credentials, and sync timestamps. These can be personal information. Sponsorship records include amounts, currency, payment status, Stripe payment or subscription identifiers, and your selected public sponsor name. Stripe processes checkout payment details under its own privacy policy.

Google sign-in

Google sign-in is optional. When you choose it, Google shares your verified email address and a Google account identifier so we can authenticate you and link your account. We store that identifier, email address, and link time. We do not request access to your Gmail messages, contacts, or Google fitness data through sign-in. Google processes authentication under its own privacy policy. You can disconnect Google sign-in in Account Access settings after confirming your StepClash password; set a password using account recovery first if needed. Removing your StepClash account also removes its Google identity link. Short-lived app sign-in handoffs are used to securely return you to the Android app.

Connected fitness services

When you authorize Fitbit or Garmin, we sync activity information used by our step features. Fitbit currently requests activity, heart-rate, and profile permissions; the provider permission screen identifies the access requested. Withings connects weight and body-composition measurements, including body-fat percentage and muscle mass. We store provider identifiers and authorization credentials to maintain the connection. Disconnecting stops future authorized syncing but does not automatically delete measurements already stored in StepClash. You can also revoke access with the provider.

Android Steps, Health Connect and Samsung Health

If you connect Android steps in the StepClash Android app, we request read-only permission for step counts from your selected source: Health Connect or Samsung Health. Direct Samsung Health access uses the Samsung Health Data SDK and does not require copying records into Health Connect. Only one source is used at a time. We upload daily step totals and dates over HTTPS to your selected StepClash account to support your dashboard, challenges, leaderboards, and step achievements. This integration does not read location, heart rate, medical records, or other health data, and does not write to Health Connect or Samsung Health.

For Health Connect, background step access is optional. When you allow it and your device supports it, the app can sync periodically while closed; Android may delay this work to save battery. Without background access, Health Connect steps can sync while the app is open. Direct Samsung Health syncing runs while StepClash is open or when you choose Sync now. You can also enable optional Samsung background sync in Android steps. It aims to check about once an hour when online, but Android battery restrictions and Samsung Health availability may delay or prevent an upload. You can turn it off in the app. Automatic sync checks up to seven recent days, starting on your connection date. If you choose Backfill last 30 days, the app also reads available totals from the last thirty days, preserving existing totals before your connection date. The app stores an encrypted device connection credential on your phone; our server stores a hash of the credential, your account timezone, selected step source, daily totals, and connection and sync timestamps.

You can disconnect Android steps in the app or revoke step-reading permissions in your selected source at any time. Disconnecting stops future uploads but does not delete previously uploaded totals. Website logout pauses syncing on that device. You can request deletion of account data by contacting privacy@stepclash.com. We do not sell Health Connect or Samsung Health data or use it for advertising. Your synced steps may appear in challenges and leaderboards according to your participation and privacy settings.

3. How We Use Your Information

  • Provide and maintain StepClash Services.
  • Track step data, challenges, and progress features.
  • Improve performance and user experience, including analysing registration and onboarding events using an account identifier and a randomly generated browser-session identifier.
  • Communicate updates, support responses, or important notices.
  • Maintain a safe and secure platform.

4. Sharing of Information

We do not sell your personal information. We use service providers for hosting, email, payment processing (Stripe), and, when enabled, bot protection (Cloudflare Turnstile). These providers process information needed for their functions. We may disclose information where required by law or necessary to protect users and the service. Authorized staff may access records for support, security, and moderation. Connected fitness providers also process information under their own policies.

Visibility and sharing with other members

Your username, avatar, participation, step totals, rankings, achievements, and content you share may be visible to others through profiles, challenges, leaderboards, and community features. Visibility depends on the feature and applicable settings; a private profile does not necessarily hide challenge or leaderboard participation. Personal profile details require an opt-in to public display. Review profile, messaging, and sharing settings before posting. Recipients can copy or retain shared content. Sponsor names are displayed when you select public recognition.

5. Cookies and Tracking Technologies

StepClash uses sign-in cookies that can keep you signed in for up to thirty days after your last activity, plus browser or device storage for security and preferences. Signing out ends the website session. See our Cookie Policy. Blocking necessary cookies may prevent sign-in or other features.

6. Data Security and Retention

We use access controls and technical safeguards designed to protect information. No system can guarantee absolute security. We retain information only as long as necessary to provide StepClash Services, comply with legal obligations, or resolve disputes.

7. Your Rights and Account Deletion

To request access, correction, an export, or deletion of your account and associated personal information, email privacy@stepclash.com from your registered email address and identify your account. You can make a request without signing in. We may verify identity to protect your information. We will explain any information that must be retained for legal, payment, fraud-prevention, or dispute purposes and any limits on your request. Backup copies may remain until overwritten through the backup lifecycle. Disconnecting a tracker or uninstalling the app does not delete your account; account deletion does not itself cancel a Stripe subscription, so also request cancellation of recurring support.

  • Access or update your personal information.
  • Request deletion of your account.
  • Opt out of non-essential communications.
  • Contact us with privacy or data questions.

8. Children's Privacy

StepClash is intended for people aged 16 and older. Users under the age of majority need parent or guardian permission as described in our Terms. If you believe a child under 16 has provided information, contact us so we can investigate and address it.

9. International Data Transfers

StepClash may store or process data on servers located in multiple regions. Information processed abroad may be subject to the laws and lawful access requirements of that country. Contact us for information about the providers and processing locations applicable to your account.

10. Changes and Contact

We may update this Privacy Policy periodically and identify changes with the revision date. Material changes require appropriate notice and, where required, renewed consent. For privacy requests, complaints, or questions for the person responsible for privacy at StepClash, contact us at privacy@stepclash.com.