Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Jakob Freund
Postal address:
Jakob Freund
c/o POSTFLEX PFX-615-412
Emsdettener Straße 10
48268 Greven
Germany
E-mail for privacy questions: support@steplooper.fit

This statement applies to the StepLooper apps for Android and iOS, the StepLooper app for Wear OS watches, the StepLooper watch app for Garmin watches and the website steplooper.fit. We have not appointed a data protection officer because there is no legal obligation to do so.

Location permission: The app asks for your location when you want to use it: on the permissions screen after setup, to set the start of a loop, for a loop without a chosen starting point, for navigation, for calibration runs, for a detour and to create an offline map. You can choose the start on the map instead, and in the operating system you can also share only your approximate location; that is enough for planning, while navigation needs the precise location.

Navigation in the background: During a navigation that you have started, the app determines your position about every two seconds, even when the screen is off. On iOS, the frequency depends on your movement. On Android, a persistent notification shows the running navigation; on iOS, the system's location indicator does, and on request a Live Activity on the lock screen. Navigation continues when you remove the app from the overview of open apps and ends when you end it; it does not start by itself after a device restart. Your position is processed on your device and not sent to our server; our server only sees which map sections and path networks the app loads, and in the case of a detour also those around your current position (section 04).

Turn prompts and watches: Turn prompts appear as a notification and therefore also on the lock screen. If a smartwatch is paired, its companion app (for example from Samsung, Garmin or Google) can mirror these notifications to the watch; the settings and privacy terms of the respective manufacturer apply to this. The StepLooper app for Wear OS receives from the smartphone only the activity type, prompt text, turn direction, remaining distance, estimated arrival time, progress and status (for example paused or off route), no coordinates; it sends its measured pulse to the smartphone. The connection between smartphone and watch is established by Google Play services.

Navigation on a Garmin watch: Garmin watch apps cannot establish a direct connection to a third-party app on the phone, which is why navigation runs through our server. The optional watch app receives a random pairing secret from our server and shows a six-digit one-time code with it, which you enter in the app on the phone. Until pairing, the server stores the secret for at most five minutes, afterwards only a hash of it for up to 30 days after the last use, with no link to your account. As long as the app is open and transmission is switched on, the app reports its state to the watch about every two seconds; during an activity these are the turn prompt (text), distance, total length, phase, elapsed time and pause status, after an activity a summary with duration, distance, pace, speed, steps and heart rate (average, minimum, maximum). The watch sends its current pulse and the commands start and pause to your phone. The server stores the latest state in its database and deletes it about one to two minutes after the last update; these entries are excluded from the backups. If transmission is switched off on the phone, the server discards a pulse reported by the watch immediately. The server does not receive GPS coordinates. The watch's requests go through the Garmin Connect app on your phone to our server; Garmin's privacy terms also apply to this. You can remove the pairing in the app under Profile → Heart-rate strap & sensors or in the watch app's menu; if you unpair on the watch, the server keeps the hash for 30 days as blocked.

The purpose of the Garmin transmission is the navigation on the watch that you switched on, including the pulse display on the phone. For this we need your consent (Art. 6(1)(a) GDPR), and for heart rate and other health data your explicit consent (Art. 9(2)(a) GDPR). From app version 1.2.7, the app asks for this explicit consent separately before switching on, even if transmission was already switched on before; until then it stays off. Test versions before 1.2.7 do not yet ask for this consent; please update the app before you use Garmin navigation. You can end the transmission at any time with effect for the future by switching off Garmin navigation in the sensor settings and removing the pairing there.

Recording: The app stores the GPS track of a walk, run or ride on your device (section 05). It is synchronised to your account only with your consent (section 09).

Steps: If you allow it, the app reads the daily values of the last seven days from Health Connect (Android) or your iPhone's motion data when opened or resumed, so that daily goals and streaks are updated. It also reads steps during a manual sync and at the start and end of a walk. The values stay on your device unless you allow synchronisation; only the step counts of completed activities are synchronised. You can also enter your step count by hand.

Steps in the background (Android only, only with reminders): If you have switched on reminders and additionally allowed “Access data in the background” in Health Connect, the app also reads your steps from today and yesterday from Health Connect at the set reminder time, even when the app is closed. It uses them only to remind you if your daily goal is still open and to count reached goal days for your streak. The values stay on your device and are not transmitted. Without this permission, the reminder uses the step count last seen in the app; you can withdraw the permission at any time in Health Connect.

Heart rate: If you allow it, during a walk, run or ride the app reads your heart rate from Health Connect (Android) or Apple Health (iOS), from a heart-rate strap via Bluetooth or from the StepLooper app on your Wear OS watch, in order to show you the curve, average, minimum and maximum, and stores it with the activity on your device, together with the source of the measurement (for example the name of your watch). With a paired Garmin watch, the app additionally receives the pulse from the watch via our server (section 02). While the app is open, it shows the pulse of a connected heart-rate strap and, on iOS, from Apple Health also outside an activity as a preview, without storing it. For a heart-rate strap, the app stores its name and Bluetooth address so that it can reconnect to it. On iOS, the app additionally asks for write access to workouts in Apple Health: only a running workout session makes AirPods measure the pulse. The app discards this session again and stores nothing in Apple Health.

Information about running and walking: For stride length you can enter your height. For running plans you state how long you have not run or how long you can run without stopping, and choose entry level, goal and surface; optionally a target pace and, for heart-rate guidance, your maximum heart rate are added, which you enter or have estimated from your age (the app does not store the age). Before the first running plan you confirm a health notice; the app stores when you confirmed it. After a run you rate effort and pain; the next day you can give feedback and later confirm that complaints have subsided. You delete the running profile with Reset settings (section 05).

On your device, in the account only with explicit consent: Heart rate, information about running and pain information stay on your device as long as you do not explicitly consent to synchronisation. With this consent, we store in your account the step count of completed walks, the heart rate of completed runs and rides, for runs your maximum heart rate for heart-rate guidance, your rating of effort and pain, your feedback on the next day and whether complaints have subsided (section 09). The heart rate of walks, height, running experience and target pace always stay on your device. A further exception is the optional Garmin pairing (section 02): the current pulse and, where applicable, heart rate values in an activity summary are processed briefly via our server. The app writes no data to Health Connect or Apple Health. Service providers process data on our behalf (section 12).

The use of data from Health Connect complies with Google's Health Connect Permissions policy, including the requirements for limited use (“Limited Use”). You can withdraw your permissions at any time in Health Connect, in the Health settings of iOS or in your device's app permissions.

The app loads maps, path networks and map fonts exclusively from our server steplooper.fit; the map data comes from OpenStreetMap. Map requests contain no account or device identifier, but as with any connection our server receives your IP address (section 06). The following can be inferred from the requests:

• Map display: The app loads the map sections you look at. This shows which area you are viewing.
• Route planning: Your device calculates the route. For this, the app loads the path network tiles within a radius of 1.5 to 60 km around the start, depending on the length of the loop; if needed, it requests the path network for an area whose centre is rounded to about 450 m. It does not transmit your exact starting point. If you request a detour on the way, the app loads the path network around your current position in the same way.
• Preloading: As soon as a route is displayed, the app preloads the map along the route so that it also works without a network on the way. This makes the course of the route recognisable at the precision of the map tiles.
• Offline map and saved routes: For up to five places, for example your home, the app loads the map and path network within a radius of about 11 km (about 23 km for cycling) around the chosen centre and updates them in the background when there is new map data. The same applies to the map along saved routes.

Public Overpass services: If an area lies outside the path networks stored on our server, our server retrieves the OpenStreetMap paths for it from public Overpass services (currently overpass-api.de and overpass.private.coffee). It transmits only the rounded centre and the radius of the area, neither your IP address nor an identifier. Our server keeps path network responses in memory for up to 24 hours; they contain only public map data.

On your device, the app stores your settings, your running and walking profile (section 03), your activities (walks, runs and rides with GPS track and, where measured, heart rate), an interrupted activity, your goal days for the streak, reminder times, saved routes, offline maps for up to five places, limited map caches, your feedback requests with their access keys (section 10), your answer on synchronisation and a random app ID (section 07). The sign-in to your account and the pairing secret of a Garmin watch are stored encrypted in the Android Keystore or the iOS Keychain. Storing and reading this data on your device is necessary for the functions you use (Section 25(2) no. 2 TDDDG).

We have no access to this data. You delete it in the app under Activities → Storage & deletion (also reachable via Profile → Privacy and permissions → Manage local data: delete history, clear map cache, reset settings including running profile), under Profile → Offline map and Profile → Saved routes, and individual activities under Activities → History. When you uninstall the app, the operating system removes all app data.

Export: You can export activities as a GPX, CSV or JSON file and pass them on via your device's share menu; you choose the recipient yourself.

Device backups: On Android, cloud backup of the app data is switched off; however, when moving to a new device by cable or direct connection, the app data can be transferred as well. On iOS, app data can be included in your iCloud or computer backups. You control both in your device's settings.

Hosting: Our server is located in a data centre in Germany and is provided by ZAP-Hosting GmbH, Hafenweg 8, 48155 Münster. ZAP-Hosting processes the data on the server on our behalf (Art. 28 GDPR). The database, the backups and our e-mail server are located there; an encrypted copy of the backups is additionally kept on a dedicated backup device (section 11).

Cloudflare: All connections to steplooper.fit, from the app as well as from the website, run through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare protects our server from attacks and overload. To do so, Cloudflare accepts the encrypted connection at its servers and forwards it, encrypted, to our server; in doing so, Cloudflare processes your IP address and the content of the requests. This happens on our behalf on the basis of a data processing agreement with EU standard contractual clauses. Cloudflare is also certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission exists. The legal basis is our legitimate interest in a secure and available service (Art. 6(1)(f) GDPR). Further information: cloudflare.com/privacypolicy.

Encryption: The app and website communicate exclusively over encrypted connections (HTTPS).

Server logs: With every request, our server logs the IP address, time, method, requested address (for map requests including the map section), status code, data volume and duration. It does not log browser and device identifiers (user agent), the previously visited page, feedback access keys, the app ID (section 07) or the pulse of a Garmin watch (section 02). We use these logs for troubleshooting and to prevent abuse (Art. 6(1)(f) GDPR), do not combine them with accounts and delete them after seven days.

Request limits: To prevent overload and abuse, the server counts requests per IP address, for signed-in functions per account, for sign-in with e-mail per address (as a hash) and for Garmin navigation per pairing. The counters are deleted as soon as their time window has expired; the longest time window lasts 24 hours.

Error logs: The server and database log technical errors without IP addresses and without the values of your data. Only when a request fails because of a fault between the web server and the application, for example during an update, does the web server's error log record this request with IP address, requested address and browser identifier. These logs are limited in size and are overwritten continuously.

This website: We ourselves set no cookies on steplooper.fit, store nothing in your browser and embed no fonts, content or analytics services from third parties; the video is also hosted on our server. To detect automated access, Cloudflare may insert a verification script into the pages and, when it checks a request, set technically necessary security cookies such as __cf_bm or cf_clearance (Section 25(2) no. 2 TDDDG). Cloudflare may also ask your browser to report failed connections to Cloudflare (Network Error Logging). The statements in this section apply to visits to the website. Links to Google Play lead to pages of Google, to which Google's privacy policy applies.

Feature counters: For selected actions, for example when planning a loop, starting a navigation or opening the history, the app sends the name of that feature to our server. The server only increases a total per feature and stores neither an account or device identifier nor a location or time. The request itself, like any request, appears with the IP address in the server log (seven days) and in the request limits (time window up to 24 hours). This tells us which features are used and where improvements are worthwhile (Art. 6(1)(f) GDPR). From app version 1.2.8 you can switch off the feature counters under Profile → Privacy and permissions.

App ID: On first launch, the app generates a random identifier and uses it at every start to query which Plus features are unlocked; currently all are free. If you are signed in, the query goes to the server together with your sign-in. The identifier is neither stored nor logged by us (Art. 6(1)(b) GDPR).

You do not need an account for StepLooper. If you create one, you sign in with Google, on iOS with Apple, or with an e-mail address and password. To provide the account, we then store (Art. 6(1)(b) GDPR):

• a random account identifier and the time of creation,
• the linked sign-in services with the identifier at the respective provider and the associated e-mail address,
• for e-mail accounts, the address, a hash of your password (never the password itself) and the time of confirmation,
• your sign-in sessions as a hash with start, expiry (valid for 30 days), sign-out and the time you last confirmed your sign-in,
• where applicable, a Plus trial access and its end.

Sign-in with e-mail: For registration and for a new password, we send you a code from our own e-mail server, which is valid for 15 minutes. After ten wrong passwords, we lock sign-in for that address for up to 15 minutes; for this we store the entered address and the number of failed attempts until the end of the lock. If you link another sign-in service, we inform the e-mail addresses of your account.

Sign-in with Google or Apple: Here you sign in directly with Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). We receive a signed sign-in token and store from it only your identifier at the provider and your e-mail address, not your name or profile picture. Google and Apple process the sign-in under their own responsibility and may also transfer data to the USA in doing so; both are certified under the EU-US Data Privacy Framework. More in the privacy policies of Google and Apple.

Age: Account, synchronisation and Garmin pairing are currently available only to people aged 16 and over. From app version 1.2.7, the app asks for a corresponding confirmation before sign-in and before switching on the Garmin pairing. If you are younger, please do not use any of these functions.

Your account remains until you delete it (section 11).

Only if you explicitly consent in the app with an account do we store the following in your account:

• Walks: start and end, duration, distance, pace, steps and their source, elevation gain, route type and path filters, measurement quality and completion status, the recorded GPS track (positions with time, altitude and speed) and the planned route.
• Runs: start and end, duration, distance with running and walking portions, pace and split times, pauses and phase changes, the running plan (training level with running and walking phases, for heart-rate guidance with your maximum heart rate), surface and GPS quality, the recorded GPS track, the heart rate (average, minimum, maximum and a shortened curve), your rating of effort and pain after the run, your feedback on the next day and whether complaints have subsided.
• Rides: the same information as for walks, plus the average speed and the heart rate (average, minimum, maximum and a shortened curve).
• Saved routes: the planned route with start, course, length, duration and turn prompts as well as the time of saving.

If in an older app version you consented only to the synchronisation of walks, your consent continues to apply only to walks; the app asks you separately whether runs, rides and routes should also be backed up. Activities and routes that you saved without signing in are transferred only if you choose that. Settings, height, running experience, target pace and the heart rate of walks are not synchronised. From version 1.2.8, the app no longer transmits the names of the measuring devices, for example your watch.

The purpose is to back up your activities and routes and to use them on several devices. The legal basis is your consent (Art. 6(1)(a) GDPR); for heart rate, step counts and your rating after a run, which are health data, your explicit consent (Art. 9(2)(a) GDPR). We store when you consented to which version of the consent text.

You can withdraw your consent at any time in the app under Cloud synchronisation. We then delete the copy in your account immediately; the data on your devices is kept. You can also delete individual activities from the account in the history; a saved route that you delete is also deleted in your account. So that your other devices pick up a deletion, we keep the type and identifier of deleted entries, without further content, for 12 months. Without withdrawal, we store your activities and routes until you delete them or your account.

Feedback in the app: If you send us a message, we store it with category, app version and platform, plus the name and e-mail address you provide voluntarily. We do not need or store a persistent device identifier for this. If you are signed in, we link the message to your account. So that you can read replies in the app, the app stores an access key for each request and checks for new replies at launch and when switching between areas of the app; on our server, the key exists only as a hash. If you provided an e-mail address, we can also reply to you by e-mail.

E-mail: If you write to us at support@steplooper.fit, we process your message on our e-mail server in order to handle your request.

Retention: We delete completed requests from the app 90 days after completion, incomplete ones at the latest 12 months after the last change, and those linked to an account at the latest with the account deletion. We delete e-mails at the latest 12 months after receipt, and delivery failure notices for our e-mails after 30 days. We document requests about your rights under the GDPR (type of request, reference, processing status) until three years after their completion, in order to be able to prove that we have fulfilled them.

The legal basis is Art. 6(1)(b) GDPR where it concerns your account or use of the app, otherwise our legitimate interest in answering your request (point (f)); for documenting privacy requests, our legal obligation to demonstrate compliance (Art. 5(2), Art. 6(1)(c) GDPR).

You can remove your account at any time in the app under Profile → Account & Plus → Delete account permanently; for this, you briefly confirm your sign-in beforehand. Without the app, write from the e-mail address of your account to support@steplooper.fit; we reply to that address and delete the account as soon as you have confirmed the deletion. Instructions can be found under Delete account.

In doing so, we immediately delete your account, your sign-in services and sessions, your consent to synchronisation, the synchronised walks, runs, rides and routes, and your feedback requests linked to the account.

Backup: The database is backed up in encrypted form every night on our server. A dedicated backup device outside the data centre fetches these encrypted backups daily so that they also survive a failure of the server. On the server as well as on the backup device, we delete backups after 14 days; until then, previously deleted data may still be contained there. We do not include the state of Garmin navigation (section 02) in the backups. So that an account deletion remains effective even after a backup is restored, we store the identifier of the deleted account and the time of deletion for 30 days.

Log of administrative access: Access by our team to personal data, for example opening a support request or searching for an account, is logged with time, acting team member, type of access and the object concerned (for example account identifier, ticket number, search term or recipient address of a support e-mail), and we delete these entries after 12 months (Art. 6(1)(f), Art. 32 GDPR).

We do not sell data and do not pass it on to advertising partners. Personal data is received only by:

• ZAP-Hosting (server operation, Germany) and Cloudflare (network and protection, USA) as our processors (section 06),
• Google or Apple, if you sign in with them (section 08),
• on Android, Google Play services on your device, which provide location, sign-in and the connection to the watch; whether they send data to Google in doing so, for example for Google location accuracy, depends on your device settings,
• Garmin, if you use Garmin navigation: your watch's requests run through the Garmin Connect app (section 02),
• your device's speech output for announcements by the running coach; depending on the chosen speech engine, its provider may process the announcement text,
• the recipients' e-mail providers, when we send you an e-mail,
• authorities, where we are legally obliged to do so.

Public Overpass services receive only a map area with no link to you (section 04). Transfers to the USA rely on the EU Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), and for Cloudflare additionally on EU standard contractual clauses (Art. 46 GDPR).

Data on your device remains until you delete it or uninstall the app (section 05).

• Contract (Art. 6(1)(b) GDPR): maps and path networks, app ID, account and sign-in, support for your account.
• Consent (Art. 6(1)(a) GDPR, for health data Art. 9(2)(a) GDPR): the synchronisation of your activities and routes, including heart rate, step counts and your information after a run, as well as Garmin navigation with pulse and activity summary. Access to location, Health Connect, Apple Health and sensors takes place only after your permission in the operating system; the data stays on your device unless you consent to its synchronisation.
• Legitimate interest (Art. 6(1)(f) GDPR): security and abuse prevention (Cloudflare, server logs, request limits), backups, feature counters (can be switched off), support without an account, log of administrative access.
• Legal obligation (Art. 6(1)(c) GDPR): documentation of privacy requests.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)); the lawfulness of the processing up to that point remains unaffected. To do so, write to us at support@steplooper.fit. You can also lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live.

You are not obliged to provide us with data: without location permission, you choose the start on the map; without an account, your activities stay on the device. Without an internet connection, however, the app cannot load new maps. There is no automated decision-making including profiling (Art. 22 GDPR).

We adapt this statement when the app or the legal situation changes. The version published here at any given time applies.

This section summarises StepLooper's privacy practices for international users and store reviewers. The full policy is set out above; the German text is authoritative.

All data is encrypted in transit (HTTPS). Data is never sold or used for advertising.

Account deletion: Users can delete their account in the app under Profile → Account & Plus → Delete account permanently, or by e-mail from the account's address to support@steplooper.fit (see Delete account). Encrypted backups, on the server and on our own off-site backup device, are deleted after 14 days.

Contact: For privacy questions, write to support@steplooper.fit.