Privacy policy

Last updated: 15 October 2026

Pipstep is a walking and running coach for Apple Watch and iPhone. We built it so that it works on your devices, offline, and sends as little as possible anywhere else. This page explains, in plain words, what data exists, where it lives and what you can do about it.

The short version

Apple Health data stays on your devices. We never send it to our servers, never sell it and never use it for advertising.
Your location never leaves your device. GPS is used during a lesson to measure distance, pace and route, and the route is saved to Apple Health only.
You don't need an account. Lessons, the path, your streak and habit school work without one.
Friends features are optional. If you sign in, we store a small profile and your lesson results so friends, leagues and groups can work. Because lesson results and the backup include fitness details, we ask for your explicit yes before you sign in.
Progress backup comes with a profile. Signed in, your path, stars, streak, gems and settings are backed up so you can pick up on any iPhone. Apple Health data is not part of it.
Analytics are opt-in and anonymous. Nothing is counted unless you say yes.
No ads, no trackers, no third-party analytics or advertising SDKs. This website sets no cookies.
We don't track you. Nothing from Pipstep is combined with data from other companies' apps or websites for advertising, and nothing is shared with data brokers. The anonymous counts and crash reports (section 4) are never linked to you; everything else we keep belongs to your account and is used only to run Pipstep.

Who is responsible

Pipstep is made by Dodera Software S.R.L., Strada Banat 1, 440043 Satu Mare, Romania (registration number J2023000958306, EUID ROONRC.J2023000958306, CUI 49004234). We are the controller of the personal data described here. Questions and requests: office@doderasoft.com.

1. Data that stays on your devices

Apple Health

With your permission, Pipstep reads from Apple Health: workouts and workout routes, heart rate, resting heart rate, heart rate variability, heart rate recovery, VO₂ max, sleep, sleeping wrist temperature, workout effort scores, steps, walking and running distance, active energy, running speed, power and running form (stride length, vertical oscillation, ground contact time), body weight, date of birth (for heart-rate estimates), your heart-rate zones and Activity ring summaries. It uses them to suggest where to start and to set today's targets relative to you. If you turn on the water tracker, it also reads the water you or other apps log, to show your day's total.

With your permission, Pipstep writes to Apple Health: each lesson as a workout (with route, heart rate, distance, energy and one interval per lesson step), and the water you log in Pipstep (in the water tracker or when you tick a water break).

Apple Health data is processed on your iPhone and Apple Watch only. It is never sent to our servers, never shared with third parties, never used for advertising or marketing, and the app does not store it in iCloud. You can change Health permissions at any time in the Health app or in Settings → Privacy & Security → Health.

Location and motion

During a lesson Pipstep uses GPS (iPhone or Apple Watch) and motion sensors to measure distance, pace, route and steps per minute. On iPhone the app keeps using location while the phone is locked, but only while a lesson is running. Location is never sent to our servers.

Your progress and settings

Your path progress, stars, streak, gems, Pip's outfits, lesson history and settings are stored on your iPhone and Apple Watch and kept in step directly between the two devices (Apple's WatchConnectivity). They are included in your device backups like any app data. If you sign in, they are also backed up to our server (section 3).

Lesson logs

Each lesson on the watch writes a small diagnostic log (coach lines, sensor summaries every few seconds, audio and workout events). It is moved to your iPhone after the lesson and stays there. We never receive it unless you choose to share it with us, for example when asking for help.

Health check

Before your first lesson Pipstep asks a short health check (for example heart conditions, chest pain, pregnancy). Your answers are not stored: only whether Pip should coach extra gently (yes or no) is kept, in your settings on your iPhone and Apple Watch. It is never sent to our servers or counted.

Crash, performance and problem reports

Apple's MetricKit tells the app, about once a day, if it crashed, froze or used too much battery or memory. Pipstep also notes quieter problems on your iPhone and Apple Watch, for example a workout that could not be saved to Apple Health, no GPS signal for several minutes, Pip's voice failing to play or download, the watch and iPhone not syncing, or progress that doesn't add up (such as a streak that can't be right). These reports are kept on your iPhone, where you can see, export or delete them in Settings → Health & safety → Diagnostics. The watch's reports reach your iPhone inside its lesson logs. They are sent to us only if you said yes to anonymous counts (section 4).

2. Course updates

The app checks our content server for new lessons, coach lines and Pip's voice recordings and downloads them. These requests contain no account or device identifier. Like any web server, it sees your IP address while answering the request, but it doesn't log or keep it.

3. Friends features (only if you sign in)

Your explicit yes first. Some of what an account stores can say something about your fitness and health: lesson minutes and distance, your walking and running speeds and the water you log. The law treats such data with extra care, so before the sign-in buttons work you tick "I agree that Pipstep keeps my lesson results and progress backup on its servers in the EU, including fitness details like minutes, distance, my walking and running speeds and the water I log" (your explicit consent, GDPR Article 9(2)(a)). If you'd rather not, simply don't sign in: lessons, the path, your streak and Plus all work without an account. You can take your yes back at any time by deleting your account (below), which deletes this data from our server. As proof of your yes, your account keeps when you ticked it and which version of this policy it was.

If you sign in on the Friends tab, we create an account on our community server and store:

What	Why
Sign-in identity: an ID from Apple, Google or your email address (Apple sign-in asks only for your name; Google sign-in gives us your Google account ID, email and name)	To sign you in and link sign-in methods
Display name, Pip colour and mood, the outfit Pip wears and Pip's growth stage, friend code	So friends and league members recognise you
Streak length and number of lessons	Shown on your profile to friends
Finished lessons: title, stars, XP, duration, distance and time	Weekly XP, leagues, friend quests, challenges, and the friends feed if you choose to share
Friends, friend requests, invites, blocks, groups, cheers, nudges and walk-together sessions	To make those features work
Reports you send about someone, reports others send about you, and what we did about them	To keep the community safe: each report is read by a person, never acted on automatically
Your best scores in Pip's Delivery Run (score, letters, distance, time played, the day)	The game's leaderboards: weekly, all-time and friends
If you have Pipstep Plus: product, expiry date, environment and Apple's original transaction ID; or a free Plus we gave you, and until when	To unlock Plus features that need the server, such as the bonus friend quest
If you allow notifications from friends: a notification token for your iPhone from Apple, and which kinds of friend notifications you want	To deliver Pipstep's own notifications. Deleted when you sign out or delete your account
Your progress backup: path progress and stars, XP, streak and calendar dots, campfires, gems, outfits and shop items, quests, habit-school progress, events, breaks, Plus status, settings, water you log in Pipstep (if the water tracker is on), your effort levels (Pipstep's own estimates of your walking and running speeds, steps per minute and typical lesson length and distance) and a short list of your last 60 lessons (date, lesson, stars, minutes, distance)	So your progress is safe and comes back on a new or second iPhone, merged without losing anything

What the backup never contains: anything read from Apple Health (heart rate, heart-rate estimates, water other apps logged, sleep and the rest listed in section 1), your health check answer, routes or locations, and the detailed lesson history (routes, heart rate, splits) — those stay on your devices. About your effort levels: Pipstep works them out from your lessons and, until you have done a few, may start them from your past workouts and VO₂ max in Apple Health. Only the resulting speeds and lengths are in the backup, never the Health data they came from. The backup is updated by itself after changes while you are signed in; Settings → Progress backup shows when it last happened. Signing out keeps everything on your devices. You can delete the backup with your account (it is deleted with everything else).

Sharing is off by default. Your finished lessons count for weekly XP and leagues, but friends only see them in their feed if you turn on "Share finished lessons with friends" in Settings. League members see only your display name, Pip (colour, outfit) and weekly XP. Pip's Delivery Run leaderboards show your display name, Pip and best score to other players. Nobody ever sees your route or location; we never receive them.

Finding friends: other people can find you in Pipstep only by typing your exact friend code, which you share yourself, or by opening an invite link you sent them. People who see you in a league, a leaderboard, a group or a walk together can tap you to see your name, Pip, your Delivery Run best and how many friends you have in common, and send you a friend request. Nobody becomes your friend until you accept, and you can decline or block anyone. Your streak and lessons are shown only to your friends. You can't be found by your name or your email address.

Email sign-in: we send you a 6-digit code and a sign-in link through our email provider (Zoho). We store only a scrambled (hashed) version of the code; it expires after 10 minutes.

Delete your account any time in the app: Profile → Settings → Community → Delete account (step by step on the help page). This deletes your profile, friends, posts, cheers, your progress backup and everything else listed above from our server for good. Your lessons and streak on your devices stay.

4. Anonymous counts (only if you say yes)

When you first open the app we ask whether you want to help improve Pipstep. If you say yes, the app keeps simple daily counters on your device (for example "a lesson was started", "lesson 3 was finished with 2 stars", "onboarding step 2 was shown", "the Plus screen was shown") and sends each finished day once to our server. The counts carry no account, device or advertising identifier. Our server only adds them to totals per day; it does not store your IP address, and the rate limiter uses a salted, one-way hash of it that is kept in memory only. You can turn this off at any time in Settings → Privacy, which also deletes any counts not yet sent.

With the same yes, crash and freeze reports are summarised and sent too: the kind of problem, the place in Pipstep's own code where it happened (a program name and a number), the app and iOS version and the iPhone model family (a code such as "iPhone17", never your exact model), plus a day. No message text, no account, device or advertising identifier, no location or lesson data, and no IP address is stored. Our server only adds them to counts per problem and day.

Problem reports are sent the same way: the kind of problem and a short code name chosen by our app (for example "workout not saved to Health" with Apple's error number, or the name of a progress rule), the app and system version, the iPhone or Apple Watch model family, iPhone or watch, the day and how often. To count how many installations a problem affects, they carry a random number made for this installation of Pipstep. It is not your device's identifier and is not tied to your account; our server never stores it, only a one-way code made from it that changes every day, so it can't follow anyone from one day to the next. The number is forgotten when you turn anonymous counts off or delete the diagnostics. The owner of Pipstep gets an email when a new kind of problem appears, so it can be fixed quickly; that email contains only these summaries.

5. Purchases

Pipstep Plus is sold by Apple through the App Store. We never see your payment details. The app checks your subscription with Apple on your device.

Tips are optional in-app purchases, also handled by Apple. When you leave a tip, the app sends Apple's signed receipt for it to our server so it counts toward the community tip jar: which tip it was, when, the App Store's transaction number and a random number the app makes for your installation (so several tips from one phone count as one supporter). If you are signed in, the tip is linked to your account and a small heart shows next to your name for friends and in leagues. Apple tells our server about refunds, and a refunded tip stops counting. If you delete your account, your tips stay counted in the jar but are no longer linked to anyone. We never see your payment details.

6. Who else is involved

Apple: Apple Health, Sign in with Apple, the App Store and in-app purchases, under Apple's own privacy policy.
Google: only if you choose "Continue with Google", under Google's privacy policy.
Hosting: our servers run at Hetzner Online GmbH in Germany, which processes the data for us only.
Email: sign-in emails, and the emails you send us, go through Zoho (Zoho Corporation B.V., EU data centre), which processes them for us only.

Apple and Google decide for themselves how they handle the data of their own services. If you use them, data may be processed outside the European Economic Area, under their own safeguards (such as the EU–US Data Privacy Framework or the EU's standard contractual clauses). Our own servers and email provider are in the EU.

We don't sell or rent personal data, and we don't share it for advertising. We only hand over data when the law requires it.

7. How long we keep things

On your devices: until you delete the app or its data.
Community account data: until you delete your account. Sign-in codes expire after 10 minutes; walk-together sessions after 3 hours.
Anonymous daily totals and crash counts: as long as they help us improve Pipstep. They can't be linked to you.
Crash, performance and problem reports on your iPhone: 30 days at most.
Problem reports on our server: 90 days, then deleted.
Server logs: our app server notes which kind of request arrived (no IP address, no account) to find faults. The log has a fixed size and old lines are overwritten automatically, usually within days.
Delivery Run scores: your all-time best until you delete your account; past weeks' bests are removed automatically.

8. Why we may use your data (legal bases)

To provide what you asked for (a contract with you): your account, friends features, leagues and leaderboards, progress backup, purchases and tips.
Your explicit consent (GDPR Article 9(2)(a)) for the fitness details stored with an account: lesson results and the progress backup (section 3). You take it back by deleting your account.
Your consent: Apple Health access, notifications and anonymous counts. You can withdraw it at any time in the app or in your iPhone's settings; that doesn't affect what happened before.
Our legitimate interest in keeping Pipstep safe and working: preventing abuse and cheating, handling reports, fixing faults and keeping short server logs.
Legal obligations, for example keeping records the law requires.

9. Your rights

Under the GDPR and similar laws you can ask to access, correct, delete or export your data, object to or restrict processing, and withdraw consent. Most of this you can do in the app (for example Delete account, or turning off sharing and anonymous counts); for anything else write to office@doderasoft.com and we'll answer within a month. A copy of your data: ask us by email, from the email address of your account or with your friend code, and we'll send you everything our server holds about your account (profile, friends, lesson results, progress backup and the rest listed in section 3) as a file (JSON) that other services can read. We may ask a question or two first to make sure the account is yours. Pipstep doesn't make decisions about you by automated means that have legal or similarly significant effects. You can also complain to a data protection authority: in Romania that is the ANSPDCP (dataprotection.ro), or the authority where you live or work.

10. Children

Lessons and Apple Health work without an account, for everyone. To sign in and use the friends features you must be at least 16 (you confirm it when you tick the consent box before signing in). If you believe someone younger has signed in, write to us and we will delete the account.

11. This website

This website is static. It sets no cookies, loads nothing from other servers and uses no analytics.

12. Changes

If we change this policy we will update the date above and, for important changes, tell you in the app.