Privacy Policy

1. Who we are

ByStep is operated by Gil Millasseau, an individual based in Portugal, who is responsible for your personal information (the data controller). For privacy questions, data requests or support, email bystepfit@gmail.com.

This policy explains how ByStep handles personal information in our website, mobile apps and pre-release test builds. It covers accounts, progress tracking, fitness challenges and optional integrations.

2. Information we handle

• Account information: your email address, display name, password hash, email verification records and session information. Session records can include your IP address and browser or device information. If you sign in with Apple or Google, they send us your name and email address.
• Fitness and challenge information: photo timeline names, measurements and their dates and units, workouts, activity types, duration, calories, distance, challenge membership, scores, titles, notes and comments.
• Strength log: the exercises, sets, repetitions, weights and hold times you enter, your training sessions and their link to a workout, your routines, and the names of exercises you create. If you connect Hevy, it also holds the sets, exercise names, workout titles and times that you import from Hevy, and your imported Hevy routines. Strength levels and personal bests are calculated from them.
• Body profile: gender, birth year and body weight, when you enter them or allow Apple Health or Health Connect to share body weight. They are used to calculate strength levels and to estimate energy. Birth year is also asked at sign-up and before you open Friends, and keeps members under 18 out of name search.
• Moderation records: when you report content or block a member, we keep who reported, what they reported and why, and who blocked whom. We also keep a record when we restrict a member's account.
• Preferences and notifications: units, week-start preference, notification settings, and a device push token and platform when you enable notifications.
• Connected services: connection status, provider identifiers and sync dates. Accounts that connected Strava before ByStep removed that connection keep the access and refresh tokens it stored. Imports contain activity records and retain the provider response with location, route and address fields removed before storage.
• App-open days: We record the days on which you open the app, without the time or device, to measure how often members come back. We delete these records after 180 days.
• Technical and support information: request paths, IP addresses, device or browser information, response status and timing, and information you send when requesting help.

3. Photos and device storage

Progress photo files and their local photo timeline metadata are stored on your device. The current app does not upload progress photos to ByStep servers. Two exceptions exist. Your profile picture is stored with your account so other members can see it. A photo that you attach to a manual workout, a comment, a flex or the challenge chat is uploaded to private ByStep storage. You can also share a video of up to 15 seconds in a comment, a flex or the chat. The app records sound with your microphone, and the video keeps that sound. Members of that challenge can see and hear what you share. ByStep deletes it when you delete the workout or comment, when you leave the challenge, when you delete your account, and 30 days after the challenge ends. Photo timeline information, measurements and your strength log sync to your account; “device-local photos” does not mean all fitness information stays on your phone.

Camera and photo-library access are used when you take, import, save or restore photos. Microphone access is used only when you record a video to share. Copies saved to your system photo library are managed by your device and any photo-cloud service you enable. Deleting a photo in ByStep does not delete those library copies. Signing out does not erase local photo files.

The app also stores cached account information and fitness records to support offline use. Your device settings and backups may affect local storage. Keep your device secure and retain your own copies of photos you want to keep.

4. Strength log

The strength log is stored with your ByStep account, so it is backed up and available on any phone where you sign in. Sets you saved on your phone before this change are uploaded to your account the next time you open the app while signed in. While you are offline, the app keeps new sets on your phone and uploads them when it reconnects.

Only you see your sets, exercises and routines. When “Share strength with challenge mates” is on in Settings, members of a challenge you share see your strength levels, your best set for each test exercise, and a summary of a logged session on that challenge workout: total volume, number of sets, number of exercises and the routine name. They never see your body profile or the rest of your log. Turn the setting off to hide all of it.

A strength session you log in ByStep counts as a strength workout in your challenges, unless a workout from your watch or another Health app covers the same time. Sets imported from Hevy or logged through a connected AI app do not change challenge points. Your strength log and body profile are never sent to the AI features in the next section. A connected AI app reads only what you allow when you connect it, as described in Connected AI apps.

5. Health and fitness integrations

Apple Health and Google Health Connect are optional and depend on platform and service availability. Other apps, such as Strava or Garmin, reach ByStep only when you let them write workouts to Apple Health or Health Connect. Hevy is the one exception; the Hevy paragraphs below explain it. When you connect and grant access, ByStep reads supported workout information, including activity type, date, duration, energy and distance, and sends imported activities to your ByStep account to support fitness history and challenge scoring.

When you allow heart rate, resting heart rate, VO2 max or speed, ByStep also reads three values for each workout: average heart rate, maximum heart rate and average speed. It reads your latest resting heart rate and latest VO2 max with their dates. ByStep stores these values only, never the individual readings. They are stored on our servers. Only you can see them. Other challenge members, rankings, scoring and AI features never receive them.

During a strength session, you can connect a Bluetooth heart rate sensor. The app reads the heart rate from the sensor and shows it on your phone. ByStep does not store the reading and does not send it to our servers.

Apple Health may refresh while the app is in the foreground or when you refresh a challenge. You can disconnect integrations in Settings and revoke access in the provider or device settings. Disconnecting stops future syncing but does not automatically erase activities already imported; delete those separately or request erasure.

Hevy is optional. You connect it by pasting a Hevy API key that you create in your Hevy account. The key is stored only on your phone, in the secure storage of the device. ByStep servers never receive or store it. Disconnect deletes the key from your phone.

Your phone reads your Hevy workouts, exercises, sets and routines directly from Hevy. ByStep saves to your ByStep account only the sets, exercise names, workout title and times of a Hevy workout that matches a strength workout you already have in ByStep, and your Hevy routines (name, exercises, target sets and reps). ByStep does not save Hevy workouts that have no matching ByStep workout.

Imported data becomes part of your strength log. It counts for personal bests and strength levels. Challenge mates can see strength details of a linked workout if you share strength, as described above. It does not change challenge points. ByStep sends nothing to Hevy and does not change your Hevy account. You can remove the imported workouts and routines in the app at any time. Account deletion removes them with the rest of your data.

We do not sell personal information or use health or fitness data for advertising, marketing, data brokerage or training general-purpose AI models.

6. What other members can see

Challenges are shared spaces. Members can see member names, workouts, activity metrics, scores, rankings and comments. Manual and imported activities can automatically create workouts in joined challenges whose dates include the activity. This can share health-derived workout metrics with other challenge members, even if the original activity was private in its source service.

Join challenges and connect sources only when you are comfortable with this sharing. Avoid putting sensitive information in names, titles, notes or comments. Other members may retain screenshots or copies of content they can access. Leaving a challenge does not itself delete your earlier contributions.

Workout notifications can include your display name, challenge name and workout duration, and may appear on recipients’ lock screens.

7. Friends

Sharing with friends is on by default. Friends see your workouts, your daily steps, active calories and distance, your points and your trophies. You can turn sharing off in Privacy & sharing or hide one workout. Friends never see your heart rate, body weight, progress photos or measurements. Friends see a challenge only when they are in it with you. You can remove a friend or block a member in Privacy & sharing.

Find me by name: this switch is off by default. When you turn it on, members outside your challenges can find you by your display name in Add friends and send you a friend request. They see your name and profile picture only. Members under 18 and members with no birth year are never findable. If you choose Nobody under who can send friend requests, the switch is disabled.

Friend link: you have a personal link that adds you as a friend. Anyone who opens the link sees your display name, but no photo. Search engines do not index the page. A signed-in member sees a confirmation before anyone is added. Reset the link in Privacy & sharing and the old link stops working.

8. Why we use information

We use information to create and secure accounts, provide progress tracking and challenges, calculate scores, sync activities, send account emails and requested notifications, provide support, and diagnose failures or misuse.

Where European data protection law applies, ordinary account and service processing is based on performing our agreement with you; security and troubleshooting on our legitimate interest in operating a reliable service; and legally required records on legal obligations. Optional access relies on your permission. Where fitness information qualifies as health data, processing requires your explicit consent. You may withdraw consent and stop optional processing without affecting the lawfulness of earlier processing.

Account information is needed to provide signed-in features. Optional health access, photos and notifications are not required to create an account. Challenge scores are automated calculations for the app’s rankings, not decisions with legal or similarly significant effects.

9. AI features

Three features use AI models through OpenRouter. Snapper, the daily challenge post, is written by a language model from that day’s challenge numbers. Workout type suggestions use a classification model to suggest a type for a workout that arrived without one. Referee uses the same model to catch mistakes in your imported workouts, for example a night out saved as a run.

For Snapper we send the challenge board for every member: points for the day and for the whole challenge, rank today and before today, the gap to the next place, days in a row with points, days without points, whether the member’s data has synced, and the days left in the challenge. We send workout type, workout count, minutes and distance only for members who turned on AI features. Members are sent as codes such as M1 and M2; ByStep adds the names back after the reply. For a type suggestion we send the workout’s app name, weekday, local start time, duration, calories and distance, that day’s steps, and a summary of your own typed workouts from the last 120 days. Referee sends the same workout details when a workout looks unusual, for example a very long session or a start in the middle of the night.

We use your data in these features only after you agree. The app shows a short card under a Snapper post and asks once. Setup also asks once, on a Referee step: choose Turn on Referee to agree, or No thanks to decline. One answer covers Snapper, type suggestions and Referee. If you decline, ByStep still sends your points, rank and gaps in the Snapper request, as part of the challenge board. It leaves out your workout type, minutes and distance, and sends no workout for a type suggestion or a Referee check. Referee still marks an unusual workout without AI. To withdraw, turn off Use my stats in AI features in Settings. The change applies to the next request.

We send no names, email addresses, user ids, photos, comments or locations. OpenRouter passes each request to the company that runs the model. Every request asks OpenRouter to use only model providers that do not collect or train on the data. A suggestion never changes your workout or your points until you tap Apply. Snapper posts are visible only to the members of that challenge. You can turn off Snapper notifications in Settings.

10. Connected AI apps

You can connect an AI app, such as Claude or ChatGPT, to your ByStep account. You start the connection in that app. You then sign in on bystep.fit and press Allow on a page that lists what the app can do.

A connected app can read and change your strength routines, search the exercise list, read your strength log by day, add strength sessions and delete the sessions it added, and read, add, change and delete your body measurements. A session it adds never counts as a workout and never earns points in your challenges. It acts only when you ask it. It cannot read workouts, steps, heart rate or calories from Apple Health or Health Connect. It sees a workout that you typed by hand only as a day, a start time and a length, and only while it has no sets. It cannot read points, challenges, friends, other members or progress photos.

ByStep sends the requested data to the company that runs the app, for example Anthropic for Claude or OpenAI for ChatGPT. That company is not a ByStep service provider. It handles the data under its own privacy policy and settings. ByStep does not control whether it stores the data or uses it to improve its models. ByStep cannot delete data that the company already received.

Disconnect the app in ByStep Settings › Connected apps, or remove the connector in the app. ByStep then refuses its requests within 15 minutes. Account deletion removes every connection.

11. Bug and feedback reports

When you send a report from the app or from bystep.fit/report, ByStep creates a private issue in its GitHub repository. The issue holds the text you wrote and up to three pictures you attach. The report page lists what else we add: your member id, display name, role and account creation date, the time of the report, your app and device details, the screen you were on, your Health connection status and last sync time, the ids and types of your active challenges, and your last sessions. We never add your email address, session cookies, tokens, push tokens, Health values, exact location or the names of other members. We keep no copy of a report in the ByStep database. Only the ByStep team can read the issues. Ask us to delete a report through the support page.

12. Service providers and transfers

We use DigitalOcean for hosting, Cloudflare R2 to store the photos and videos you share, Resend for account email, Expo for app updates, Expo and Apple or Google push services for notifications, OpenRouter to reach the AI models described above, and GitHub to hold the bug and feedback reports you send. They receive the information needed for those functions, such as hosted account records, shared photos and videos, email addresses and email content, push tokens and notification content, the pseudonymous numbers sent to an AI model, or the text, pictures and technical details of a report (see below). Connected fitness providers also process information under their own privacy policies. Hevy is not a ByStep service provider. ByStep shares no data with Hevy, and the Hevy privacy policy covers what Hevy holds. Apple and Google separately handle App Store and Google Play distribution, and test-build feedback. When you connect an AI app, ByStep sends the data you ask for to the company that runs it. That company is not our service provider; see Connected AI apps.

When the app checks for an update, Expo receives a random install ID, the platform, the app’s runtime version and the update in use, and the IDs of updates that failed to start. After a failed start, Expo also receives the error text. Expo sees your IP address in the request. The app sends no account, Health or photo data to Expo. The Expo privacy page describes how Expo handles these requests.

Information may be processed outside your country, including by international service providers. Where required, transfers must be covered by an adequacy decision or appropriate contractual safeguards. You can contact us for information about the safeguards applicable to your data.

We may disclose information when legally required or necessary to address fraud, security incidents or threats to people’s rights. Access to service data is limited to operating and supporting ByStep.

13. Retention and deletion

Account and fitness records are retained while needed to provide your account and history, unless you delete them or request erasure. Archiving a challenge hides it but retains its records for restoration. Disconnecting an integration, leaving a challenge, signing out or uninstalling the app does not delete your server account.

Retention depends on the purpose of the record: active account history, resolving a support request, investigating a security incident, or satisfying a legal obligation. When you request erasure, we will explain any information that must be retained and why. Residual copies in backups may remain until those backups are replaced and are not used for ordinary service operation.

Use Settings → Delete account to permanently remove your account and associated server records, including your strength log. Shared challenges transfer to a remaining member; your workouts and comments are removed. The mobile deletion flow clears its account cache and linked app photo copies, preserving your photo-library originals. Other devices and backups may retain local copies until you remove them there. Contact us for a copy of your server data. We cannot retrieve device-only photos from our servers.

If an account is suspended for breaking the community rules when it is deleted, we keep a keyed hash of its email address. The hash cannot be turned back into the address. We use it only to apply the same suspension if that address signs up again.

14. Your choices and rights

Depending on your location, you may have rights to access, correct, erase or obtain a portable copy of your information, restrict processing, object to processing based on legitimate interests, and withdraw consent. We may need to verify your identity before acting on a request.

Where the GDPR applies, we normally respond within one month. If a lawful extension is necessary, we will explain it. You may also complain to your local data protection authority, including in the country where you live or work. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).

Essential cookies keep you signed in; browser and device storage support sessions, preferences and offline features. Blocking or clearing them may sign you out or affect those features. You can control camera, library, health and notification permissions in your device settings.

15. Young users

ByStep is for people aged 13 and older, or the higher age required by the App Store rating in their country or applicable law. The service is not intended for children under 13. Users below the legal age of adulthood must involve a parent or legal guardian as described in our Terms of Service.

An App Store rating does not verify a user's age. Where parental authorization is legally required for personal-data processing, that authorization is also required. If you believe a child below the permitted age has provided personal information, or want help exercising a child's data rights, email bystepfit@gmail.com so we can investigate and arrange appropriate deletion or other action.

16. Updates to this policy

We will update this page when our practices change and revise the date above. Material changes will be communicated through the service or email where appropriate. If a new use requires consent, publishing an updated policy does not replace obtaining that consent.