Privacy Policy

This Policy applies to the Stepie iOS and Android apps, the stepie.net website (with stepwiseplanner.com retained as a compatibility domain), and services directly related to accounts, subscriptions, and customer support. Stepie does not currently offer a web version of the app.

The controller is Shenzhen Shanyin Workshop Technology Co., Ltd., registered at Building 3, Dormitory 247, No. 1 Huatian Road, Tongsheng Community, Dalang Subdistrict, Longhua District, Shenzhen, China. You can contact us at support@syworkshop.cn.

Information you provide. This includes your email, display name, and login credentials; goals, tasks, steps, notes, deadlines, reflections, settings, AI core memory, partner invitations, and collaboration records; prompts, conversations, and images submitted to AI features; and feedback, contact details, screenshots, or other material you send to support.

Information collected when you use the Services. This includes internal user IDs, login sessions, app language and region, feature and screen interactions, notification delivery and clicks, subscription state, purchase or restore results, product and transaction identifiers, app version, device and system details, network information, approximate region, errors, and diagnostic data. On iOS, we may also process standard attribution data supplied through Apple AdServices.

Information you choose to authorize. When you use the relevant feature and grant system permission, we may process images from your camera or photo library, push tokens, and calendar names, event titles, times, all-day status, locations, and notes for the requested period. When creating an event, we process the event details you confirm.

Information from third parties. This includes account identifiers returned by Apple or Google sign-in, subscription and transaction information returned by Apple App Store or Google Play, records created when a collaboration partner interacts with you, and processing results returned by providers that deliver a requested feature.

Do not submit sensitive personal data that is unnecessary for your request, or another person’s data that you are not authorized to provide, through AI conversations, images, calendars, or feedback.

We process personal data to:

• Create and maintain accounts, store and sync content, and provide planning, AI, calendar, collaboration, subscription, notification, and support features;
• Verify purchases and entitlements and handle restores, transaction records, refunds, and related disputes;
• Understand feature use and service performance, troubleshoot errors, and improve product reliability, usability, and security;
• Prevent fraud, abuse, and security incidents and protect users, the Services, and the lawful rights of others;
• Comply with tax, payment, cybersecurity, consumer protection, and other legal obligations and enforce our agreements.

Depending on the context, we rely on performance of our agreement with you, your consent, compliance with legal obligations, or legitimate interests that do not override your rights. We request permission before using device capabilities or processing data where consent is required. You may decline optional information, but the corresponding feature may not work.

Depending on the feature, we send the prompts, conversation context, relevant goals, tasks, notes, preferences, images, calendar tool results, or statistics needed to fulfill your request to model services such as Moonshot/Kimi API, Alibaba Cloud Model Studio, or DeepSeek. Web search also sends search queries and returns public web results. Different features may use different model services.

We do not sell your content or use it ourselves to train general-purpose models offered to the public. Model providers process data under the applicable agreement, product settings, and privacy terms. Different rules may apply when you use a provider’s own products directly. Submit only the information needed for your request.

Your device controls calendar access. Calendar data is read only after you grant permission and the relevant tool runs. The tool result is sent to Stepie and the applicable model provider to complete the request. You can review event details before they are written to your selected or default device calendar, and you can withdraw permission in device settings.

AI output may be inaccurate and should not replace professional judgment. We identify AI-generated content in the interface and, where required, add appropriate labels to generated or synthetic content that is copied, shared, downloaded, or exported. See the Terms of Service and Acceptable Use Policy for your responsibilities.

We do not sell personal data or share it for cross-context behavioral advertising. To provide the Services, we disclose relevant data to the following categories of recipients on a need-to-know basis:

• Alibaba Cloud: core infrastructure, object storage, transactional email, and Model Studio AI. It may process account-service data, uploads, and related AI inputs and outputs. See the Alibaba Cloud Model Studio privacy notice.
• Moonshot / Kimi API: model inference, image or file understanding, and web search. It may process relevant inputs, context, files, queries, and outputs. See Kimi API data processing and security.
• DeepSeek: model inference for features such as task breakdown and data analysis. It may process relevant goal or task content, statistics, AI core memory, instructions, and outputs. See the DeepSeek Privacy Policy.
• RevenueCat, Apple, and Google: sign-in, app distribution, purchase verification, and subscription management. They may process account or internal user IDs, products, receipts or purchase tokens, transactions, entitlements, and subscription state. RevenueCat may also receive a OneSignal ID and iOS attribution data. See RevenueCat, Apple, and Google.
• Mixpanel and Firebase Analytics: product analytics. They may process internal user IDs, feature, screen, and purchase events, device technical information, and limited event properties associated with the feature used. See Mixpanel and Firebase.
• Sentry: error diagnostics and user feedback. It may process errors, stack traces, limited app or device details, and feedback text, contact details, screenshots, or images you choose to submit. See Sentry.
• OneSignal: notification delivery and measurement. It may process internal or push IDs, a deliverable email address, device and notification information, notification interactions, and limited custom events. See OneSignal.

We may also disclose necessary information at your direction, in a corporate reorganization, to protect users or the Services, to resolve legal disputes, or to comply with law. A recipient’s own terms and privacy policy may also apply when it acts as an independent controller.

Stepie’s core services and uploads are primarily processed in mainland China. Analytics, diagnostics, subscription, notification, sign-in, and some AI services may be processed at a recipient’s facilities or where its subprocessors operate. Locations may vary with service configuration and provider arrangements.

When personal data is transferred outside your jurisdiction, we take measures required by applicable law, such as completing an assessment, imposing data-protection obligations on recipients, or using applicable standard contractual clauses or another lawful mechanism. Where separate notice or consent is required, we provide the required recipient, contact, purpose, method, data category, and rights information before the transfer and obtain consent as required. This Policy is a general description and does not replace a separate notice or consent required by law.

We retain personal data only for as long as needed for the purposes described in this Policy. We consider the type and sensitivity of the data, its purpose, your settings, security and dispute risks, contractual requirements, and legal obligations.

• Account, planning, collaboration, and AI conversation data is generally retained until you delete the relevant content or account;
• Account deletion has a 30-day recovery period. After that period, we schedule deletion or anonymization of account and linked data controlled by Stepie that is no longer needed, except where law, security, payment, or dispute resolution requires continued retention;
• Temporary files and intermediate data created for an AI request are retained only as long as needed to fulfill the request, troubleshoot failures, and complete routine cleanup. Timing depends on the data type, system task, and applicable provider;
• Transaction, subscription, and accounting records are retained as required for tax, consumer protection, and dispute resolution. Analytics, diagnostics, notifications, security logs, and provider records are retained according to their purpose, risk, contract, and system configuration;
• Deleted data may remain briefly in backups until the applicable rotation completes, with access restricted. Data retained by law is separated from ordinary use and used only for the applicable purpose.

Request deletion in Settings › Data Control › Delete Account. If you cannot access the app, use our web account deletion page. We may verify account ownership to protect your account.

Subject to applicable law, you may request access, a copy or export, correction, completion, or deletion; withdraw consent; object to or restrict certain processing; request an explanation of our practices; and complain to a competent authority. We respond within the period required by applicable law and explain any refusal and available remedy.

Use in-app data controls or contact support@syworkshop.cn to make a request. Manage camera, photo, calendar, and push permissions in device settings and subscriptions in Apple App Store or Google Play. Withdrawal does not affect processing that was lawful before withdrawal, but may disable the related feature.

We use technical and organizational measures appropriate to the risk, including access controls, encryption in transit, key management, log protection, least privilege, backups, and security monitoring, to protect data against loss, misuse, and unauthorized access, disclosure, alteration, or deletion.

No online transmission or storage method is completely secure. If a personal data incident may affect your rights, we take prompt remedial action and notify you and the relevant authorities where required by law.

Stepie is not directed to children under 14, and we do not knowingly process their personal data. If we learn that we have done so without valid guardian consent, we will stop the relevant processing and take steps to delete the data. Users who are 14 or older but below the legal age of adulthood where they live should use the Services with a parent or legal guardian’s consent and guidance.

We may update this Policy as features, providers, or laws change. If a change materially affects your rights, we will provide appropriate advance notice through the app, email, this page, or another suitable channel, and request consent again where required.

For privacy questions, rights requests, or complaints, contact support@syworkshop.cn. You may also complain to a competent privacy, data protection, or consumer protection authority. Translations are provided for convenience. If a translation conflicts with the Chinese version, the Chinese version controls unless applicable law requires otherwise.