Privacy
STEPtember is a step challenge run by NAEO for the people taking part in it. It is not an advertising business, it does not sell anything, and it holds as little about you as it can get away with. Here is exactly what that is.
What we hold
Your name and email address
Your email is how you sign in and how invites reach you. Your name is what teammates see on the leaderboard and the feed — it comes from what you type during setup, and you can change it any time from the More tab.
Your daily step counts
The point of the challenge. Each entry is a date and a number that you type in yourself. There is no device to connect, and nothing is read from your phone, watch or health app automatically.
Your team and organisation
Which team you are on, and what role you hold in it. This determines what you can see and who you are ranked alongside.
Anything you post to the feed
Messages and likes you add to your challenge feed, shown to the rest of the challenge.
An avatar you pick from a set
You choose one of a handful of preset images. There is no photo upload, so we never hold a picture of you.
Basic sign-in records
When you last signed in, kept by the authentication system so it can keep you signed in and spot abuse.
Who can see it
Everyone in your challenge sees your name, your avatar, your daily step counts and your totals — that is what a leaderboard is. Your feed posts go to the same audience.
Your team captain can additionally correct your step entries, so that someone who is stuck can be helped.
The organisers can see the above plus email addresses, which they need in order to send and chase invitations.
Nobody else. Your step data is not public, is not sold, is not shared with advertisers, and is not used to train anything. People outside your challenge cannot see it.
Who processes it for us
Supabase
Hosts the database and handles sign-in. All of the above is stored there.
Vercel
Hosts and serves the site, and provides its privacy-friendly page-view analytics — which are aggregate, and set no advertising cookies.
Amazon SES
Delivers invitation emails. It sees the recipient address and the invite link, nothing else.
Groq
Writes Coach Stepy’s encouragement messages. It receives only the challenge title and how far through it you are — never a name, an email address, or any individual’s steps.
How long we keep it
Step data and results are kept between challenges so that past years can still be looked back on. If you ask us to delete your account we remove your profile, your step entries and your feed posts. Final standings that have already been published keep the name that was frozen into them at the time, because a past year's results are a record of what happened.
Your choices
You can edit your name and avatar, and correct or clear any step entry, from inside the app at any time. To get a copy of your data, or to have your account and its data deleted, email privacy@steptember.app from the address on your account and we will action it.
Taking part is voluntary. If you would rather not be on a leaderboard at all, tell your captain and don't join — nobody is added without an invitation they accepted.
Questions about any of this? Email privacy@steptember.app.