Privacy Policy

1. Who we are

Sproutstep is developed and operated by Mikkel Schröder ("we", "us", "our"). This Privacy Policy describes how we collect, use, store, and protect your personal data when you use the Sproutstep iOS application ("App").

We are committed to handling your data responsibly and in compliance with applicable privacy laws, including the EU General Data Protection Regulation (GDPR) and applicable Danish data protection legislation.

2. What data we collect

We collect the minimum data necessary to provide the Sproutstep experience. Here is a full overview of every category we process:

Data type	What we collect	Purpose	Legal basis (GDPR)
Account data	Display name (entered during onboarding)	Personalising the in-app experience	Contract performance
Step & health data	Daily step count; step goal progress; 30-day step history (read once during onboarding to suggest a personalised goal)	Core gameplay mechanics — sun/water bubbles, credit calculation, personalised goal suggestion	Contract performance
Step goal	Your chosen daily step goal, set during onboarding and adjustable at any time	Calculating bubble fill percentage and daily progress	Contract performance
Onboarding preferences	Your stated motivation (e.g. health, energy, weight loss); preferred walking time (e.g. morning, lunch, no fixed time); stated obstacle to walking (e.g. forgets, busy schedule, weather)	Personalising notification content and in-app messaging. Not shared with third parties or used for ad targeting.	Consent (collected through your explicit input during onboarding)
Notification preferences & token	Whether notifications are enabled; notification scheduling preference; APNs device token issued by Apple	Sending daily step reminders and motivational messages you opted into	Consent
Game state	Plant collection; credit balance; shelf layout; daily streaks; plant health status (healthy, at-risk, dead)	Syncing your progress across devices and sessions	Contract performance
Purchase data	Subscription status; transaction records (payment processing handled entirely by Apple)	Access control for premium features; ad-free experience	Contract performance
Device data	iOS version, device model, locale/language setting	App compatibility and debugging	Legitimate interests
Crash & error logs	Crash reports and technical error logs. These do not contain personally identifiable information.	Diagnosing and fixing bugs	Legitimate interests

We do not collect precise location, contacts, camera, microphone, or any health data beyond step count.

3. HealthKit data

Sproutstep requests read-only access to Apple HealthKit to retrieve your step count. This is the core data that powers gameplay.

• What we read: Step count (daily totals). During onboarding only, we also read the last 30 days of step history to calculate a personalised goal suggestion.
• What we do not read: Heart rate, sleep, weight, nutrition, or any other HealthKit category.
• Where it goes: Step data is processed on-device. Aggregated daily progress (e.g., goal reached: yes/no, credits earned that day) may be stored in your account on our backend to sync your game state. Raw step counts are not transmitted to our servers.
• Goal suggestion: The 30-day average is calculated on-device, rounded to the nearest 500 steps, and presented as a suggestion you can accept or adjust. The resulting goal is the only value stored, not the raw history.
• Revoke access at any time: iOS Settings → Privacy & Security → Health → Sproutstep → turn off Steps.

4. Push notifications

During onboarding, the App requests permission to send you push notifications. These include daily step reminders, motivational messages, and gameplay alerts (e.g., "your Monstera is at risk of dying — hit your goal today").

• APNs token: Apple assigns your device a push token (APNs token). We store this token in your account on our backend solely to route notifications to your device. It is not shared with third parties or used for tracking.
• Personalisation: Notification copy may be tailored to your stated motivation and preferred walking time (from onboarding preferences). This personalisation is done on our own infrastructure — it does not involve third-party profiling.
• We do not send marketing emails unless you explicitly opt in separately.
• Opt out at any time: iOS Settings → Notifications → Sproutstep → turn off Allow Notifications. You can also adjust preferences within the App at any time.

5. How we use your data

We use your data exclusively to:

• Provide and operate the App (calculate credits, track goals, manage plant health and collection)
• Suggest and store your personalised daily step goal
• Personalise push notification content based on your stated motivation and preferences
• Deliver push notifications you have opted into
• Sync your game progress across devices via your account
• Verify subscription status to unlock the premium, ad-free experience
• Diagnose crashes and fix bugs
• Respond to support requests

We do not sell your data. We do not use your data for cross-app behavioural profiling, targeted advertising based on your health data, or sharing with data brokers.

The legal basis for each processing activity is specified in the data table in Section 2. Where processing is based on consent (onboarding preferences, push notifications), you may withdraw that consent at any time without affecting processing that has already taken place.

6. Data storage (Supabase)

Your account and game data is stored using Supabase, a cloud database provider. Supabase stores data in EU data centres (AWS eu-west-1 by default).

• Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Supabase acts as a data processor on our behalf and is bound by a GDPR-compliant Data Processing Agreement.
• We use row-level security (RLS) policies so your data is only accessible to your own authenticated account.

7. Third-party services

Sproutstep integrates the following third-party services. Each processes data as described:

Service	Purpose	Data shared	Privacy policy
Apple HealthKit	Step data access (read-only)	Step count — read on-device only; not transmitted to Apple by us	apple.com/legal/privacy
Apple Push Notification service (APNs)	Delivering push notifications to your device	APNs device token; notification payload content	apple.com/legal/privacy
Apple App Store	App distribution; subscription and payment processing	Purchase and subscription records — managed entirely by Apple	apple.com/legal/privacy
Supabase	Backend database and authentication	Account data, game state, preferences, APNs token	supabase.com/privacy
Google AdMob	Displaying ads (free tier only; subscribers see no ads)	Device identifiers and/or advertising ID — subject to your ATT permission. See Section 8 for full details.	policies.google.com/privacy

We do not use third-party analytics SDKs such as Firebase Analytics or Mixpanel. Diagnostic data is limited to on-device crash logs and Supabase error reporting.

8. Advertising & tracking (AdMob)

Before any cross-app tracking occurs, the App uses Apple's App Tracking Transparency (ATT) framework to request your explicit permission:

• If you allow tracking: AdMob may use your device's advertising identifier (IDFA) to serve personalised ads based on activity across apps and websites.
• If you deny tracking: You will still see ads, but they will be contextual (non-personalised). Your IDFA will not be used by advertisers.
• Change your preference at any time: iOS Settings → Privacy & Security → Tracking → Sproutstep.
• HealthKit data is never used for advertising, regardless of ATT status. This is prohibited by Apple's HealthKit guidelines and our own policy.
• Onboarding preference data (motivation, walking time, obstacles) is never shared with AdMob or used for ad targeting.

For full details on how Google processes advertising data, see Google's Privacy Policy and AdMob data practices.

9. Data retention

We retain your data for as long as your account is active. Specific retention periods:

• Account and game data: Retained until you delete your account. Upon deletion, removed within 30 days.
• Financial records (subscription/purchase history): Retained for 5 years as required by Danish bookkeeping law (Bogføringsloven), even after account deletion.
• Crash and error logs: Automatically purged after 90 days.
• APNs tokens: Deleted when you disable notifications in-app or iOS settings, or when you delete your account.
• Onboarding preference data: Retained while your account is active. You may request deletion of this specific data at any time without deleting your entire account.

10. Your rights

Under GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of all data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure: Request deletion of your account and all associated personal data ("right to be forgotten"), subject to legal retention requirements.
• Portability: Receive your data in a structured, machine-readable format (e.g. JSON).
• Restriction: Ask us to pause certain processing while a dispute is resolved.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: For data processed on the basis of consent (onboarding preferences, push notifications), you may withdraw at any time. Withdrawing notification consent via iOS Settings takes effect immediately. To withdraw consent for preference data, contact us.

To exercise any right, email us at mikkelschrroederr@gmail.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Danish supervisory authority:

Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
datatilsynet.dk

11. Children's privacy

Sproutstep is not directed at children under 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under 13 without verifiable parental consent, we will delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at mikkelschrroederr@gmail.com.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. For material changes — such as adding a new data category, a new third-party service, or a new use of existing data — we will notify you via in-app message or email at least 14 days before the change takes effect. Continued use of the App after that date constitutes acceptance.

13. Contact

Data controller: Mikkel Schröder
Email: mikkelschrroederr@gmail.com