Privacy Policy for Spinta

Effective date: November 5, 2026

Spinta ("the app") is a step challenge app for groups of people who want to walk more together. It is run by an independent developer in British Columbia, Canada ("we", "us"). If a company takes over the app, this policy will be updated to name it.

The short version: the app reads two numbers per day, your total step count and your walking and running distance, and shares them with the groups you join and the friends you add. We don't show ads, we don't use analytics or tracking tools, and we don't sell or rent your data to anyone.

1. What we collect

Your account

• Your email address, used to sign in.
• How you sign in: an emailed code or link, Sign in with Apple, or Sign in with Google.
• If you use Sign in with Apple: the email address Apple gives us (your real address, or a private relay address if you choose "Hide My Email"), and your name only if you choose to share it.
• If you use Sign in with Google: the name, email address and profile picture link that Google shares. They're stored with your account; the app doesn't show the picture.
• We never ask you for a password.

Your profile

• The display name you choose. Group members see it.
• Your phone's time zone (for example America/Vancouver). It's updated when you open the app, so each day's steps are filed under your own calendar date.
• When you created your profile.

Your steps and distance

• For each day, the total number of steps and the total walking and running distance for that calendar day in your time zone, read from Apple Health (iPhone) or Health Connect (Android).
• Whether the totals came from an iPhone or an Android phone, and when they were last synced.
• Each time the app syncs, it reads the last 30 days (further back, up to a year, if you're in a challenge that started earlier) and replaces those days' totals, because totals can change after the phone removes duplicates (for example, steps counted by both a phone and a watch).
• The first time you sync on a phone, the app also uploads your daily totals for up to the last 12 months, once, so the people in your groups can compare stats with you. Days before your phone recorded any steps are left out, and days already uploaded aren't changed.

The app reads only step count and walking and running distance. It doesn't read or upload individual samples, times of day, routes, heart rate, workouts, sleep, location or any other health data. The optional "step sources" view (Settings → Diagnostics) lists which apps or devices contributed steps. That list is worked out on your phone and never leaves it.

Your groups and challenges

• Groups you create or join: the group's name and invite code, your role (owner or member) and when you joined.
• Challenges you create (title, type, whether it counts steps or distance, dates, goal) and the challenges you take part in.
• For monthly goals: a personal goal, if the challenge's creator or the group's owner gives you one, and whether you left it (so later months leave you out until you join again).

Your friends

• Your friend code, a short code you can share so someone can add you as a friend.
• Who you're friends with and since when, friend requests you sent or got while they wait for an answer, and the 1-on-1 challenges you start with a friend.
• Cheers you send or get: who cheered whom and on which day, kept for 30 days so each person can cheer a friend once a day.

Notifications

• If you allow notifications, a push token for your phone (an address that only works for sending notifications to this app on this phone) and whether it's an iPhone or an Android phone. We store it with your account so we can tell you about your groups' challenges, friend requests and new friends, and cheers from your friends. It's removed when you sign out or delete your account. Notifications go through Expo's push service and Apple's (or Google's) notification service, which see the token and the notification's text. A notification can include a challenge's title, the names of people in your groups or your friends, your place on a leaderboard or how close you are to a goal (for example "You're at 80%"), but not your step or distance totals. A cheer is a notification with your name and a short friendly line.
• Which kinds of notifications you turned off in Settings → Notifications.
• The evening reminder is set up on your phone. Its text (your steps so far today) is put together on the phone and isn't sent to us.

Technical information

• When the app talks to our backend, our hosting provider's sign-in system and server logs record technical details such as your IP address, the app and device type, and the time. We use them only to keep the service secure and to fix problems.
• When the app checks for an update, Expo, which delivers app updates, receives technical details such as your IP address, the app version, the device type and a random number that identifies the installation. No account or health data is sent.
• Your sign-in session is stored on your phone, so you stay signed in.
• With Background App Refresh on, the app can sync your daily totals while it's closed, the same totals it syncs when you open it.
• If you test the app through TestFlight, Apple shares with us crash reports, your device model and iOS version, and any feedback or screenshots you choose to send. Apple's TestFlight terms cover what Apple collects.

What we don't collect

• No location, contacts, photos or advertising identifier.
• No analytics, advertising or tracking software. The app doesn't track you across other apps or websites.

2. How we use it

• To create your account and sign you in, including sending you sign-in emails.
• To show you, the people in your groups and your friends each person's daily steps, challenge rankings and results.
• To send the notifications you choose, including friend requests and cheers.
• To work out which calendar day steps belong to.
• To keep the service secure and fix problems.

We don't use your data for advertising, marketing or profiling, and we don't sell, rent or trade it.

3. Who can see your information

People in your groups. Anyone who is in at least one group with you can see your display name, your time zone, your daily step and distance totals (every day the app has uploaded, including up to 12 months from before you started using it, not only the days of a challenge), the challenges you're in, and when you last synced. They can't see your email address. When you leave a group, its members can no longer see your steps, unless you're still in another group with them or you're friends.

Your friends. Friends see the same things as people in your groups: your display name, time zone, daily step and distance totals, the challenges you're in with them, and when you last synced. You become friends when you add someone's friend code, when someone adds yours (anyone you give your code to can add you, so share it only with people you want as friends), or when you accept a friend request from someone in one of your groups. Your friend code is shown only to you, and you can replace it at any time. A friend request and a cheer are seen only by the two people involved. When you or your friend removes the friendship, you can no longer see each other's steps, unless you're still in a group together.

Service providers who run parts of the app for us, only as needed:

• Supabase (database, sign-in and hosting) stores all the data above. Our project is hosted in the United States (Amazon Web Services, Northern Virginia), which may be outside your country.
• Google: sign-in emails are sent through a Gmail account, so your email address and the email pass through Google's mail servers. If you choose Sign in with Google, Google handles that sign-in.
• GitHub (Microsoft) stores the weekly database backups, in a private repository, for 35 days (section 6).
• Expo (650 Industries) delivers app updates and relays notifications to Apple's and Google's notification services (section 1). It doesn't store your steps or distance.
• Apple: Sign in with Apple, if you use it, TestFlight, and notifications on iPhone.
• Google, on Android: notifications (Firebase Cloud Messaging).

When the law requires it. We may disclose information if we're legally required to, for example by a court order.

We don't share your information with anyone else.

4. Apple Health and Health Connect

• The app asks for permission to read step count and walking and running distance, and nothing else. It never writes to Apple Health or Health Connect.
• On Android, the app also asks Health Connect to read those same totals while the app is closed (so your groups see new steps without you opening it) and from before you installed the app (for your history). Both are optional, and turning them off only limits those two things.
• You can turn access off at any time: on iPhone in Settings → Health → Data Access & Devices → Spinta, on Android in the Health Connect app's permissions. The app then stops uploading new totals. Totals already uploaded stay until you delete them (section 6).
• Step and distance data from Apple Health or Health Connect is used only to run the app's step challenges for you, the groups you choose to join and the friends you choose to add. It is not used for advertising, marketing or data mining, it is not sold, and it is not shared with third parties other than the service providers in section 3 that store it for us.
• Health data is not stored in iCloud.
• Use of information received from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements.

5. How your information is protected

• All data travels encrypted (HTTPS) between the app and our backend.
• Database access rules make sure you can read only your own data and the data of people you share a group with or are friends with, and change only your own.
• No system is perfectly secure, but we take reasonable steps to protect your information and to limit who can access it.

6. How long we keep it, and deleting your account

• We keep your information while you have an account.
• Delete your account in the app: Settings → Delete account. This immediately and permanently deletes your sign-in account, your profile, all your step and distance totals, your group memberships, your challenge participation and any personal goals, your friend code, your friendships, friend requests and cheers.
  • If you own a group, it passes to the member who has been in it longest. A group with no other members is deleted, along with its challenges.
  • Challenges you created stay in their group for the other members, without your name.
  • Your 1-on-1 challenges with friends are deleted.
• Removing a friend ends the friendship at once and deletes your 1-on-1 challenges with them. Your friend isn't told. A record of cheers between you stays until it's 30 days old.
• If you signed in with Apple, also remove the app from your Apple Account in Settings → [your name] → Sign-In & Security → Sign in with Apple. You can do this at any time.
• If you can't sign in to delete your account, email us at [email protected] and we'll delete it.
• We back up the database once a week, in case something goes wrong. Each backup is kept for 35 days, then deleted. So after you delete your account, or something in it, it can stay in a backup for up to 35 days, and we never restore it from there except to recover from a failure.
• Our hosting provider keeps server logs (section 1) for a limited time, after which they're deleted.
• Copies of the sign-in emails we sent you stay in the Sent folder of the Gmail account the app sends them from. They contain only your email address and a sign-in link and code, which stop working after one hour.

7. Your choices and rights

You can:

• see and change your display name in the app;
• remove a friend, decline a friend request, or replace your friend code, at any time;
• ask us for a copy of your information, or to correct it;
• delete your account at any time (section 6);
• turn off step access (section 4);
• turn off notifications, or some kinds of them, in Settings → Notifications or in your phone's settings, and background syncing by turning off Background App Refresh for the app.

To make a request, email [email protected]. We'll reply within 30 days. If you're not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.

8. Children

The app isn't meant for children under 13, and we don't knowingly collect information from them. If you believe a child under 13 has an account, email [email protected] and we'll delete it.

9. Changes to this policy

When we change this policy, we'll post the new version at this address with a new effective date. If a change affects how your step data is used or shared, we'll tell you in the app or by email before it takes effect.

10. Contact

Questions or requests: [email protected]

Spinta, British Columbia, Canada