Privacy Policy

1. Who We Are

One Step (the "app") is operated by Justin Mayeur as a sole proprietorship trading as One Step Collective, based in Washington State, United States. References to "we," "us," and "our" mean Justin Mayeur d/b/a One Step Collective.

If you have questions about this policy or your data, contact us at onestepapp.feedback@gmail.com.

2. What We Collect

Information you provide

• Email address — used only to sign you in via a one-time magic link. We don't store passwords.
• Profile information — name, date of birth, biological sex, height, weight, and your fitness goal and dietary approach. You enter these during onboarding.

Information from Apple HealthKit

If you grant HealthKit permission, the app reads (but never writes) the following:

• Steps
• Heart rate samples (during workout sessions)
• Resting heart rate
• Heart rate variability (HRV)
• VO2 max
• Active energy burned
• Apple Exercise Time and Apple Stand Time
• Recorded workouts

HealthKit data stays on your device. Raw heart rate, raw workout records, GPS, and route data are never transmitted off your device. The app processes this data locally and only sends derived numbers — your fitness points, total steps, zone-minute counts — to our servers.

Two fitness measures are also stored with your account: your most recent VO2 max estimate and your resting heart rate. These sync so your profile and handicap calibration survive sign-outs and new devices. They are stored on your own account record and are never visible to other users.

Information generated by app use

• Daily fitness scores — workout points, nutrition points, step points, streak bonus, total points, and the input metrics they were derived from (steps, active calories, exercise minutes, time spent in heart rate zones 1–5).
• Nutrition check-ins — whether you logged on plan, fasted, or off plan that day.
• Challenges you create or join — challenge name, dates, configuration, invite code, participants.
• Reactions you send — fist bump or fire reactions on participants' daily scores within shared challenges.

Information we don't collect

• We don't collect your raw heart rate time series or individual workout records.
• We don't collect your location or GPS data.
• We don't access your contacts, photos, microphone, camera, or calendar.
• We don't use crash reporting SDKs (no Sentry, no Crashlytics, no Firebase). The only analytics services we use are PostHog and AppsFlyer, described in Section 4.
• Aside from AppsFlyer's SKAdNetwork-based install attribution and invite-link delivery (Section 4), we don't use advertising SDKs, social login SDKs, or any tracking pixels.
• We don't fingerprint your device to track you or build a behavioral profile. (AppsFlyer's invite-link matching briefly compares basic device signals — such as IP address and device model — solely to hand you an invite code on first open; see Section 4. It isn't used for tracking or profiling.)
• We don't ask about or collect any data related to alcohol, drug, or recovery status.

3. How We Use Your Information

• To authenticate you and keep your account secure.
• To calculate your fitness scores and apply your handicap multiplier.
• To show your scores and progress to other participants in challenges you've joined. People in a challenge with you can see your display name, your handicap multiplier, and the daily numbers behind your score: workout, step, and bonus points, total steps, zone minutes, active calories, exercise minutes, whether you closed your Move ring, rest days, streak days, and your nutrition check-in status (fasted, on-plan, or off-plan). People who aren't in a challenge with you can't see any of it.
• To send the optional notifications you've enabled (challenge updates, daily check-in reminders, streak alerts, participant activity).

We do not use your information for marketing profiling or sell it to advertisers. Apart from the install attribution described in Section 4, we don't use your data for advertising purposes.

4. Analytics and Attribution

We use third-party services to understand how the app is used and how people find it. PostHog provides product analytics: it records in-app events such as screen views, challenge creation, and check-ins, associated with your account identifier. AppsFlyer provides install attribution using Apple's SKAdNetwork framework, which tells us which ad campaign led to an install without identifying you personally. AppsFlyer also carries challenge invite links through the App Store: when you tap a friend's invite link, it matches that tap to your first app open so the invite code arrives ready. That match is used only to deliver the invite. Invite links contain the challenge code and a random share identifier — never your name, email, or any health data.

We do not use Apple's App Tracking Transparency identifier (IDFA) and do not track you across other companies' apps or websites. We do not send your health data, name, or email address to either service. Both process this information on our behalf under their own privacy policies: PostHog and AppsFlyer.

5. Where Your Data Goes

• Supabase (our backend provider) — stores your account information, computed fitness scores, and app activity such as challenges you create or join and invites you share. Access is gated by row-level security policies that scope reads and writes to your own data and challenges you participate in.
• PostHog (product analytics) — receives in-app usage events associated with your account identifier, as described in Section 4.
• AppsFlyer (install attribution and invite links) — receives SKAdNetwork campaign data that doesn't identify you personally, plus invite-link taps matched to first app opens solely to deliver invite codes, as described in Section 4.
• Apple Push Notification Service (APNs) — delivers push notifications, only if you've granted notification permission.
• Apple HealthKit — read-only, on your device only.

That's the complete list. We don't share data with any other third parties.

6. How We Store Data

Account data and fitness scores are stored on Supabase's infrastructure, which uses industry-standard encryption in transit (TLS) and at rest. Locally on your device, app data is stored using iOS's standard sandboxed storage and is protected by your device's security model.

7. Children

The app is not intended for children under 13. We do not knowingly collect data from anyone under 13. If you believe a child under 13 has used the app, please contact us and we'll delete the associated account and data.

8. Your Rights and Choices

• Access and correction — you can view and edit your profile information from inside the app.
• Deletion — to delete your account and associated data, email us at onestepapp.feedback@gmail.com from the address tied to your account. We'll confirm and delete within 30 days.
• Notifications — toggle any notification type on or off in the app's Settings, or revoke notification permission entirely in iOS Settings.
• HealthKit permissions — revoke any individual HealthKit permission in iOS Settings → Health → Data Access & Devices → One Step. The app will continue to function but workout-based scoring will stop until permissions are restored.

9. Data Retention

We retain your account data and scores for as long as your account is active. If you delete your account, we delete your data within 30 days, with the exception of records we're legally required to retain.

10. Beta Status

The app is currently in beta. During the beta period, we may make changes to data structures, scoring formulas, or features that could affect previously stored data. We'll communicate significant changes in advance where possible.

11. Changes to This Policy

If we make material changes to this policy, we'll update the "Last updated" date at the top of the page and, where appropriate, notify you in the app or by email.

12. Contact

Questions, deletion requests, or anything else: onestepapp.feedback@gmail.com