Privacy Policy

Last updated: 1 June 2026

This Privacy Policy describes how צעד צעד ("we", "us", "our") collects, uses, and protects information when parents and their children use צעד צעד ("Step by Step") (the "App").

Important: צעד צעד ("Step by Step") is designed to be used by parents on behalf of their children. Only parents (age 18 or older) create accounts. Children do not sign up, log in, or directly interact with our servers. All child information in the App is added and managed by the parent.

1. Who We Are

• Company: צעד צעד
• Address: Gharshevski 4/5, Mazkeret Batya, Israel
• Email: stepshabitsapp@gmail.com
• Website: https://stepbystep-app.vercel.app

We are the data controller for the personal information processed through the App.

2. Information We Collect

2.1 Information about parents

When you (the parent) create an account, we collect:

• Email address
• Display name
• Profile photo (optional)
• Authentication identifier (managed by Supabase Auth)
• Device information (operating system, app version, device model)
• Push notification token (if enabled)
• Subscription status and purchase history (managed by RevenueCat and the app store — we never receive or store your card number)
• Technical logs generated when the App contacts our servers (IP address, request logs), used only to operate, secure, and debug the service

We do not use any third-party advertising, analytics, or behavioural-tracking SDKs in the App.

2.2 Information about children

You may add information about your child to the App. This may include:

• First name (or nickname)
• Age or date of birth
• Gender (optional)
• Profile photo (optional, uploaded by you)
• Habits, tasks, and routines you set up
• Mood entries you or your child log
• Reward and progress data (XP, levels, achievements)

We treat this information as belonging to the child, and you (the parent) are responsible for the accuracy of what you upload. We do not ask children to provide information directly.

2.3 Information we do NOT collect

• Precise location (GPS)
• Contacts
• Microphone or audio recordings
• Browsing history outside the App
• Biometric identifiers
• Information for advertising purposes

3. How We Use Information

We use information only to:

• Create and operate parent accounts
• Display the child's habits, progress, and rewards in the App
• Send push notifications (only if enabled by the parent)
• Process and manage your subscription (through RevenueCat and the app store)
• Provide customer support
• Detect and prevent fraud or abuse
• Comply with legal obligations

We do not:

• Sell personal information
• Show advertising in the App
• Use child data to train AI/ML models
• Share child data with marketers or data brokers

4. Legal Basis for Processing (GDPR)

Where GDPR applies, we rely on:

• Consent — You explicitly consent at signup, on behalf of yourself and your child
• Contract — To provide the App service you requested
• Legitimate interest — To prevent fraud, secure the service, and improve reliability
• Legal obligation — When required by law

5. Service Providers (Sub-processors)

We share information with the following service providers, only to the extent necessary to operate the App:

Each provider is bound by a Data Processing Agreement (DPA) and is required to protect your information. We do not share data with any third party for advertising or marketing.

Payment card details are handled entirely by Apple or Google. We never see, receive, or store your full card number.

6. International Data Transfers

Some of our service providers operate outside Israel. When we transfer personal data internationally, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards approved under applicable law.

7. Data Retention

• Parent account data: retained while your account is active, plus up to 30 days after deletion to allow recovery, then permanently deleted.
• Child data: retained while linked to an active parent account. Deleted when the parent removes the child profile or deletes the account.
• Backups: may persist for up to 90 days, after which they are overwritten.
• Legal records: records we are legally required to keep (e.g., financial records) may be kept longer, as required by law.

8. Your Rights

You have the right to:

• Access — Request a copy of all data we hold about you and your child
• Correct — Update or correct any information
• Delete — Request deletion of your account and all child data
• Restrict — Ask us to limit how we use your data
• Portability — Receive your data in a machine-readable format
• Object — Object to certain processing
• Withdraw consent — Withdraw your consent at any time
• Lodge a complaint — Contact your local data protection authority

To exercise any right, email stepshabitsapp@gmail.com. We will respond within 30 days.

You can delete your account at any time directly inside the App: Settings → Account → Delete account.

9. Security

We use industry-standard security measures, including:

• Encryption in transit (TLS) and at rest
• Access controls and authentication
• Regular security reviews
• Limited employee access, on a need-to-know basis

No system is 100% secure. If a data breach occurs, we will notify affected users and the relevant authorities within the timeframes required by law (72 hours under GDPR).

10. Children's Privacy

The App is designed for use by parents on behalf of children. Children do not create accounts or directly interact with our servers. All information about a child is provided by the parent, who consents to its processing.

We do not knowingly collect personal information directly from children under 13 (or the applicable age in your country) without verifiable parental consent. If you believe we have collected information from a child without proper consent, please contact us at stepshabitsapp@gmail.com and we will delete it promptly.

For more details, see our Children's Privacy Notice.

11. Changes to This Policy

We may update this Privacy Policy. When we make material changes, we will notify you in-app and by email at least 14 days before the change takes effect. Continued use of the App after the effective date means you accept the updated policy.

12. Contact

Questions about this Privacy Policy or your data:

• Email: stepshabitsapp@gmail.com
• Mail: צעד צעד, Gharshevski 4/5, Mazkeret Batya, Israel

13. Region-Specific Disclosures

Israel

Processing is conducted in accordance with the Privacy Protection Law, 5741-1981 and its regulations. You may contact the Privacy Protection Authority (Rashut Hahaganat HaPratiut) at https://www.gov.il/he/departments/the_privacy_protection_authority.

European Economic Area / United Kingdom

You may lodge a complaint with your national data protection authority.

California (CCPA/CPRA)

California residents have the right to know what personal information is collected, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information.

United States (COPPA)

We do not knowingly collect personal information from children under 13 without verifiable parental consent. Parents can review, delete, or refuse further collection of their child's information by contacting stepshabitsapp@gmail.com.