Privacy Policy

Step Trip game and website · last updated 2026-10-02

The short version. You can play Step Trip without creating an account and without giving us your name, email or location. Your progress lives on your device, optionally backed up under an anonymous account. We only personalise ads if you agree, gameplay statistics follow your consent and can be switched off, and for players under 13 nothing is personalised or tracked and no ads are shown.

Who we are

Step Trip (the mobile game and this website) is made and operated by Oleksii Maksymov, FOP (sole proprietor), Odesa, Ukraine ("we", "us"). We are the data controller. Contact: hello@steptrip.app.

What we collect in the game

Data	Why	Legal basis
Game progress — levels, stars, coins, items, settings. Stored on your device; a copy is synced to our server under a random, anonymous account ID so you don't lose progress.	To provide the game and cloud backup.	Contract (providing the service).
Birth year (not a full date), asked once.	Only to decide whether child-safe settings apply. Never shared.	Legal obligation / legitimate interest in protecting children.
Nickname for leaderboards — preset names; adults may type their own.	Shown on Daily Walk and Free Walk leaderboards.	Contract.
Scores and Daily Walk attempts.	Leaderboards and fair play (anti-cheat).	Contract.
Reward records — daily gifts, chests and coins for watching a rewarded video, with a one-time code from the ad network.	To grant each reward exactly once and prevent abuse.	Contract.
Gameplay statistics — events such as "level finished", performance samples, device type, app version.	To improve difficulty, fix problems and understand what players enjoy.	Consent where the law requires it (EEA, UK, Switzerland); legitimate interest elsewhere. You can switch them off any time in Settings → Privacy.
Crash reports — error message, technical stack trace, app version, platform.	To fix bugs.	Legitimate interest. Linked to your anonymous account only if you allow statistics; otherwise sent without any identifier.
Purchases — product, store, transaction ID (via RevenueCat). We never see your payment details.	To deliver what you bought and restore purchases.	Contract.

We do not collect your name, email, phone number, contacts, photos or precise location, and there is no chat.

Advertising

The game shows ads through Google AdMob. In the EEA, UK and Switzerland we first ask for consent with Google's consent form; on iOS we also ask for App Tracking Transparency permission. If you agree, ads may be personalised using your device's advertising identifier. If you decline, you receive non-personalised ads. Google may still process limited data (such as IP address and device information) to deliver and measure ads and prevent fraud — see how Google uses information from sites or apps that use its services. You can change your choice in Settings → Privacy → Ad & privacy choices. Buying "Remove Ads" turns off non-rewarded ads.

Children

Players who say they are under 13 (or under the digital-consent age in their country) get child mode: no ads at all (the ad SDK isn't even started), no tracking prompt, no personalised anything, statistics limited to two technical events (app start, performance) that are never linked to an account, preset nicknames only, and a parental gate before purchases, external links and notifications. We do not knowingly collect personal information from children beyond what is described here. Parents can contact us at any time to delete their child's data.

This website

We count visits to this website with our own cookieless statistics: page viewed, which store button or demo was used, approximate screen width, browser language, the language the site was shown in, and the referring site or campaign (UTM) tag. These statistics use no cookies, no device storage and no identifiers, so visits can't be linked to you. Only if you allow it in the cookie banner, we also use Google Analytics (cookies set by Google) to understand which pages help people find the game; you can change this any time via "Cookie & analytics choices" at the bottom of every page. The playable demo runs entirely in your browser.

Strictly necessary storage only: if you pick a language with the language switcher, we remember it in a small functional cookie (st_lang, kept for one year) that contains nothing but the language code and is never used for statistics; and if a cookie banner is shown, your answer to it is kept in your browser's local storage so we don't ask again. You can delete both at any time in your browser settings.

Who we share data with

Google (AdMob, User Messaging Platform) — ads and consent. Google acts as an independent controller for ad personalisation.
RevenueCat, Inc. (USA) — processes purchase receipts on our behalf.
Apple / Google — app stores, payments and app distribution, under their own privacy policies.
Hetzner Online GmbH (Germany) — hosts our server and this website.

We never sell your data. Some providers are outside your country (e.g. in the USA); transfers are protected by the providers' standard contractual clauses or equivalent safeguards.

How long we keep data

Statistics events and crash reports: 90 days. Game data on our server: until you delete it or the account stays inactive for 24 months. Account deletion is immediate and removes your cloud save, scores, rewards, statistics, crash reports and the purchase notifications we received for your install, and we ask RevenueCat to delete your purchase customer record. Apple and Google keep their own purchase records. Server logs are rotated automatically and kept only briefly.

Your rights

You can access, correct, export or delete your data, object to processing, withdraw consent at any time (without affecting earlier processing) and complain to a data-protection authority — in Ukraine the Ukrainian Parliament Commissioner for Human Rights, in the EU/EEA your local supervisory authority. Most of this works right in the game (Settings → Privacy); for anything else email hello@steptrip.app. To delete everything, see Delete your data.

Security

Data is encrypted in transit (HTTPS). Account tokens are stored only as hashes, and access to the server is restricted.

Changes

If we change this policy we'll update the date above and, for important changes, tell you in the game.