Privacy policy

StepRank (“we”) is a fitness leaderboard. This policy explains exactly what data we access, why, how we protect it, and how you can delete it.

1. Data we access

From your Google account (sign-in): your name, email address and profile photo, via the openid, email and profile scopes.

From the Google Health API (only after you grant it), via the read-only scope googlehealth.activity_and_fitness.readonly:

• Daily step count
• Daily distance
• Daily active minutes (moderate + vigorous)
• Daily total calories burned

We store one total per day per metric. We do not store minute-by-minute (intraday) data, and we do not access heart rate, sleep, location, body measurements, nutrition or any other health data.

2. Why we use it

• Steps, distance and active minutes rank you on leaderboards you take part in.
• All four metrics appear on your private dashboard, visible only to you.
• Your email is used only to identify your account; we don't send marketing email.

3. What other people can see

• Public leaderboards and your profile page (if “Show me on public leaderboards” is on): your display name, avatar, rank, and the value of the metric being ranked.
• Group leaderboards: members of groups you join see the same fields, even if you're hidden from public leaderboards.
• Never shown to anyone: your real name, email, calories, daily history or any other health data.

4. How we store and protect it

• Google access and refresh tokens are encrypted at rest with AES-256-GCM; keys are held outside the database.
• All traffic uses HTTPS (TLS 1.2+). The database is a managed PostgreSQL service with encryption at rest.
• Access to production data is restricted to authorized staff for operating the service.

5. Sharing

We do not sell your data, use it for advertising, or share it with third parties, except infrastructure providers that host the service on our behalf (hosting and database) under confidentiality obligations, or where required by law.

6. Google API Services User Data Policy — Limited Use

StepRank's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Health data is used only to provide the leaderboard and dashboard features described above; it is not used to train AI/ML models, not transferred for advertising, and not read by humans except with your consent, for security purposes, or as required by law.

7. Retention

• Daily totals are kept while your account exists so “All time” rankings work.
• If you disconnect health data, syncing stops and tokens are revoked and erased; you can choose to delete stored totals at the same time.
• Webhook delivery IDs (no health values) are kept for 8 days to prevent double-processing.

8. Your controls and deletion

• Settings → Privacy: hide yourself from public leaderboards at any time.
• Settings → Health data → Disconnect: revokes our Google access immediately.
• Settings → Delete account: permanently deletes your profile, activity history, group memberships and tokens from our database within seconds. Backups roll off within 30 days.
• You can also revoke access at myaccount.google.com/connections.

9. Children

StepRank is not directed to children under 13 (or the minimum age in your country), and we don't knowingly collect their data.

10. Contact

Questions or deletion requests: privacy@example.com (placeholder).