5. Server and security logs

When you access our website, API or app services, the following information in particular may be processed in server logs for technical reasons:

> IP address,

> date and time of access,

> URL or API function accessed,

> HTTP status code,

> technical request information,

> browser or client information and security-related events.

We use these data in particular to:

> provide our systems,

> analyse errors,

> detect technical faults,

> defend against attacks, and

> investigate abuse.

Server and security logs are stored for a maximum of three months and then deleted or overwritten as part of log rotation.

The legal basis is Article 6(1)(f) GDPR.

————————————————–

6. Cookies and similar technologies on the website

Our website may use cookies and similar technologies.

We distinguish between technically necessary technologies and optional services.

Technically necessary technologies may be required in particular for:

> security features,

> form features,

> session management,

> storing your privacy choices, and

> the proper technical operation of the website.

We also use optional services such as Google Analytics, YouTube and Google Maps. Optional services are activated only with your consent.

You can change or withdraw your consent at any time through the cookie settings on our website.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal. The legal basis for optional processing is Article 6(1)(a) GDPR.

————————————————–

7. Google Analytics

We use Google Analytics, a web analytics service provided by Google, on our website.

For users in the European Economic Area and Switzerland, Google services are generally provided by:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics helps us understand how our website is used and which content is relevant to visitors. The following information in particular may be processed:

> pages accessed,

> time and duration of visits,

> interactions with the website,

> browser used,

> device type,

> operating system,

> approximate geographical region,

> referrer or source of a visit, and

> technical usage information.

Google states that IP addresses of users from the EU and Switzerland are not logged or stored in Google Analytics. They are used technically to derive approximate location information and then discarded.

Google Analytics is activated on our website only with your consent.

The legal basis is Article 6(1)(a) GDPR.

The retention period for Analytics data is determined by the retention settings configured in our Google Analytics account.

We use Google Analytics for statistical analysis of our website and not as an analytics system within the Steps4Miles app.

————————————————–

8. Google Maps

We use Google Maps to display our business location. Steps4Miles does not request or process the user’s current location for this purpose.

When a Google map is loaded, however, your browser or device connects to Google. In particular, your IP address, technical
device information and information about the page accessed may be transmitted to Google. Google Maps is loaded only with the corresponding consent.

The legal basis is Article 6(1)(a) GDPR.

Google itself points out that embedded Google services may receive information from websites and apps, including the URL accessed and the IP address.

————————————————–

9. YouTube

Videos from the YouTube service may be embedded on our website.

YouTube is a Google service. Loading or playing an embedded video may establish a connection to YouTube. The following data in particular may be processed:

> IP address,

> technical device and browser information,

> page accessed,

> information about the embedded video, and

> any existing Google or YouTube cookies or account information.

Where technically possible, we recommend using YouTube’s privacy-enhanced mode for embedding videos. Google expressly describes this mode as a way to reduce the use of embedded video views for personalisation.

————————————————–

10. hCaptcha

We use hCaptcha to protect our website, forms and systems from automated submissions, spam and abuse.

The provider is:

Intuition Machines, Inc.
1065 SW 8th St #704
Miami, Florida 33130
USA

hCaptcha checks whether a submission is highly likely to come from a human or an automated system.

The following in particular may be processed:

> IP address,

> time of the request,

> browser and device information,

> technical interaction data, and

> security-related information.

Processing serves to protect our systems and users from abuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the security of our website and the prevention of automated attacks and spam.

Intuition Machines states that it participates in both the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework.

————————————————–

11. Contact form

If you contact us through our contact form, we process the data you enter, in particular:

> name, if provided,

> email address,

> the content of your message, and

> any other information provided voluntarily.

We use these data exclusively to handle your enquiry and the associated communication.

Depending on the content of the enquiry, the legal basis is Article 6(1)(b) GDPR if the communication is necessary to perform or prepare a contractual relationship, or Article 6(1)(f) GDPR for general enquiries.

The data are deleted once the enquiry has been fully handled and there are no legal or legitimate grounds for further retention.

————————————————–

12. Newsletter

If you subscribe to our newsletter, we process in particular your email address and, where applicable, technical information about the subscription.

Processing is carried out to send you information about Steps4Miles, news, products and developments.

The legal basis is your consent under Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future, for example by sending a message to:

privacy@stepsformiles.com

After withdrawal, we no longer use your email address for the newsletter, unless statutory retention requirements prevent this.

The newsletter is sent through our own server infrastructure. We currently do not use an external email marketing service provider to send newsletters.

————————————————–

13. Registration and user account

A user account is required to use essential Steps4Miles features. The following data in particular may be processed during registration:

> username,

> first name,

> last name,

> email address,

> login details,

> date of birth,

> preferred language,

> time zone,

> information about required consents, and

> account status and email verification status.

We use this information to:

> create and manage the user account,

> authenticate users,

> communicate with the user,

> personalise basic settings,

> provide Steps4Miles features, and

> enforce our Terms of Use.

The legal basis is Article 6(1)(b) GDPR.

————————————————–

14. Minimum age

Steps4Miles is intended for people aged 16 and over. The date of birth provided during registration is used in particular to verify the age requirement. People under 16 cannot create a regular Steps4Miles user account.

————————————————–

15. Apple HealthKit and step data

Steps4Miles may access Apple HealthKit with your explicit permission.

We read only the data type

Step Count

In particular, we do not read:

> heart rate,

> calories,

> body weight information,

> sleep data,

> medical diagnoses,

> workout details, or

> other health data.

Steps4Miles does not write data back to HealthKit. Apple HealthKit requires separate user permission for each data type.

————————————————–

16. Which HealthKit data we store

We do not store individual HealthKit samples. We store only aggregated daily values or the daily information required for Steps4Miles, in particular:

> daily HealthKit step count,

> date,

> step data confirmed for Steps4Miles, and

> resulting reward or progress information.

We do not store whether the steps come from an iPhone or an Apple Watch, for example. Steps entered manually in Apple Health are excluded from processing. Steps from other applications or devices may be taken into account if they are properly provided through Apple Health and pass the Steps4Miles checks. Steps4Miles currently has no direct Fitbit, Withings or comparable third-party integration.

————————————————–

17. Purpose of step data processing

Step data are used to provide the core Steps4Miles features, in particular:

> personal progress,

> daily values,

> step confirmation,

> rankings,

> League System,

> friends’ leagues,

> challenges,

> community features,

> StepCoin calculation, and

> rewards.

We do not use HealthKit step data for personalised advertising and do not share them with advertising networks. Apple treats health and fitness data as particularly sensitive and restricts in particular the use of HealthKit data for advertising and advertising-related data mining. We therefore apply a heightened level of data protection to the step information obtained through HealthKit.

The legal basis is your consent under Article 6(1)(a) GDPR. Where the information concerned qualifies as a special category of personal data within the meaning of Article 9 GDPR in the specific context, processing is additionally based on your explicit consent under Article 9(2)(a) GDPR.

————————————————–

18. Withdrawal of HealthKit access

You may revoke Steps4Miles’ permission to access Apple Health at any time through the privacy or Health settings on your Apple device. After withdrawal, Steps4Miles can no longer retrieve new step information from HealthKit.

Withdrawal does not automatically lead to the retrospective deletion of daily values already transmitted to Steps4Miles. Data already stored may be deleted by deleting the user account or submitting a corresponding data protection request to us, unless legal grounds prevent this.

Without HealthKit access, step-based Steps4Miles features may be wholly or partly unavailable.

————————————————–

19. Step confirmation, plausibility checks and abuse prevention

Steps4Miles carries out technical plausibility and security checks to prevent manipulation, technically implausible step confirmations and abusive reward credits. In particular, incoming step counts, timing relationships and technical information relevant to confirmation are checked.

Values that do not meet the designated plausibility or validation rules may not be taken into account, or may not be taken into account in full, for confirmation or reward calculation.

These checks serve to:

> maintain the integrity of rankings and challenges,

> protect other users,

> prevent unauthorised rewards, and

> protect the Steps4Miles platform.

The legal basis is Article 6(1)(b) and (f) GDPR.

These checks are not used to profile users for advertising or marketing purposes. Steps4Miles currently does not make any solely automated decision that produces legal effects concerning the user or similarly significantly affects them within the meaning of Article 22 GDPR.

————————————————–

20. StepCoins and rewards

Steps4Miles uses an internal reward system with so-called StepCoins. As part of this system, we process in particular:

> StepCoins earned,

> the time and reason for a credit,

> reward calculations,

> StepCoin balance, and

> associated transaction information.

StepCoins are currently an internal points or reward system. There is currently:

> no payout in money,

> no payout in cryptocurrencies,

> no transfer of personal data to Miles & More, and

> no transfer of personal data to external reward partners.

If external reward partners are integrated in future and personal data are transferred as a result, we will update this Privacy Policy accordingly and, where required, obtain the corresponding consent in advance.

————————————————–

21. Rankings and League System

Steps4Miles offers rankings and various League features. The following in particular may be processed for these purposes:

> user identifier,

> username,

> step information,

> League level,

> ranking position,

> memberships, and

> challenge results.

These data are used to provide rankings, competitions and community features.

The legal basis is Article 6(1)(b) GDPR.

————————————————–

22. Visibility within the Steps4Miles community

Certain information may be displayed to other logged-in Steps4Miles users. This currently includes:

> username,

> first and last name,

> profile picture,

> displayed step count,

> League level,

> ranking position,

> friends’ leagues, and

> challenges.

In particular, the following are not displayed to other users:

> StepCoin balance,

> the internal value confirmed_steps as a separate data value,

> country, and

> account data not intended for community features.

This information is not intended as a public profile accessible to any internet user, but is visible only within the logged-in Steps4Miles area.

————————————————–

23. Friends and friends’ leagues

Steps4Miles enables users to connect with other users and to create or join their own friends’ leagues.

For this purpose, we process in particular:

> the user accounts involved,

> invitations,

> friendship or membership relationships,

> League assignments,

> ranking information, and

> steps or League values calculated from them.

These data are required to provide the social and League features selected by the user.

The legal basis is Article 6(1)(b) GDPR.

————————————————–

24. Challenges and league versus league

For challenges and competitions between friends’ leagues, we process in particular:

> participating users and leagues,

> challenge assignments,

> the start and end of a challenge,

> step counts relevant to the challenge,

> ranking or result information, and

> any resulting rewards.

These data are used exclusively to run and display the respective challenge.

————————————————–

25. Messages within the app

Steps4Miles enables communication between users. In particular, the following are processed:

> sender,

> recipient,

> conversation assignment,

> message content,

> time of the message, and

> technical delivery information.

Messages are stored on the server. Communication is currently not end-to-end encrypted.

Messages are generally stored for as long as necessary for the user account and the corresponding communication. If a user deletes a message using the designated feature, it is deleted from the production system. When the user account is deleted, the messages assigned to the account are deleted.

Due to backup rotation, deleted data may technically remain in backup copies for a maximum of three months.

The legal basis is Article 6(1)(b) GDPR.

————————————————–

26. Profile pictures

Users may voluntarily upload a profile picture. Profile pictures are visible to other logged-in Steps4Miles users. They are not intended for public access without logging in.

When a picture is uploaded, we currently store the original uploaded file. If this file contains embedded metadata, such as EXIF information or GPS data, these may technically also form part of the stored file. Users should therefore remove location information or other unwanted metadata from an image file before uploading it.

If a profile picture is replaced or deleted, the corresponding file is removed from the production profile picture storage.

————————————————–

27. Reports and moderation

Where users can report other users, content or activity within Steps4Miles, we process the information necessary to review such a report.

This may include in particular:

> reporting user,

> reported user or content,

> reason for the report,

> relevant contextual information, and

> processing status.

Processing serves to protect our users, enforce the Terms of Use and prevent abuse.

The legal basis is Article 6(1)(f) GDPR.

————————————————–

28. Apple App Attest

Steps4Miles uses Apple App Attest to verify the authenticity and integrity of the app and certain requests to our API. App Attest helps in particular to determine whether security-related requests originate from a legitimate instance of our app.

As part of attestation, technical security information is processed between the app, our server infrastructure and Apple.

We use these data exclusively to:

> secure the app,

> prevent manipulated API access,

> detect abuse, and

> ensure the integrity of the Steps4Miles services.

The legal basis is Article 6(1)(f) GDPR.

We do not use App Attest data for advertising or marketing.

————————————————–

29. Other Apple services

Within the Steps4Miles app, we currently use:

> Apple HealthKit, and

> Apple App Attest.

In particular, we currently do not use:

> Sign in with Apple,

> Apple Push Notifications for Steps4Miles communication,

> external Apple analytics features through Steps4Miles, or

> additional Apple services for user analysis.

If such features are introduced in future, this Privacy Policy will be updated accordingly.

————————————————–

30. App analytics and external tracking SDKs

Steps4Miles currently does not use external analytics, advertising or attribution SDKs within the app, such as Firebase Analytics, Crashlytics, Mixpanel, AppsFlyer or Adjust.

Google Analytics is used exclusively for the website and not to analyse user behaviour within the Steps4Miles app.

————————————————–

31. Email communication

For necessary emails relating to a Steps4Miles account, we may use the following data in particular:

> email address,

> username,

> account status, and

> technical information required for the respective message.

This includes, for example:

> email verification,

> security information,

> account changes, and

> other notifications necessary for operating the user account.

Emails are sent through our own server infrastructure. The legal basis is Article 6(1)(b) GDPR.

————————————————–

32. Recipients of personal data

Personal data may be transferred, to the extent necessary, in particular to the following categories of recipients:

Hosting and infrastructure

za-internet GmbH, Germany

Google services

Google Ireland Limited and affiliated Google companies for Google Analytics, Google Maps and YouTube.

Security service

Intuition Machines, Inc., USA, for hCaptcha.

Apple services

Apple or the respective responsible Apple companies in connection with HealthKit permissions and App Attest.

Beyond this, we share personal data only if:

> this is necessary to provide our services,

> there is a legal obligation,

> this is necessary to enforce or defend legal claims, or

> the corresponding consent has been given.

————————————————–

33. Transfers of data to other countries

Our own production server and backup infrastructure is located in Germany. When Google, Apple or hCaptcha services are used, however, data may be processed by group companies or service providers outside Switzerland or the European Economic Area, particularly in the USA.

Where personal data are transferred to countries for which there is no unrestricted statutory adequacy decision, the transfer is based on the applicable permissible data protection mechanisms, in particular:

> recognised data protection frameworks,

> adequacy decisions,

> standard contractual clauses, or

> other legally permissible safeguards.

Google governs European data transfers through, among other things, its data protection terms and standard contractual mechanisms.

————————————————–

34. Retention period

As a rule, we store personal data only for as long as necessary for the respective purpose. For active Steps4Miles user accounts, the data required for the account and the features used are generally stored for the lifetime of the user account. This may include in particular:

> account data,

> daily step data,

> reward data,

> StepCoin data,

> League and ranking information,

> community data,

> friend and challenge data, and

> messages.

> Server and security logs are stored for a maximum of three months.

Data from contact enquiries are deleted when the purpose of the communication has been fulfilled and there are no statutory retention obligations or legitimate grounds for further storage.

Newsletter data are stored until consent is withdrawn or for as long as necessary to manage the newsletter.

Statutory retention obligations remain reserved.

The FDPIC expressly points out that data subjects must be informed about the retention period or at least the criteria used to determine it.

————————————————–

35. Deletion of the user account

Users may delete their Steps4Miles account using the designated feature. When an account is deleted, the personal data assigned to the user account are deleted from the production Steps4Miles systems. This includes in particular:

> account data,

> name and email address,

> date of birth,

> profile picture,

> step history,

> StepCoin and reward data,

> messages,

> friendships,

> League assignments,

> challenge data,

> community data, and

> associated personal profile data.

Active sessions are ended. Any existing StepCoin balance expires when the account is deleted. Due to our technical backup rotation, deleted data may remain in backup copies for a maximum of three months. After this period, those copies have also been overwritten or have expired.

Data that must be retained by law may be exempt from this where a corresponding obligation exists in the specific case.

————————————————–

36. Data security

We take appropriate technical and organisational measures to protect personal data against:

> loss,

> unauthorised access,

> manipulation,

> unauthorised disclosure, and

> other misuse.

Depending on the system, these include in particular:

> encrypted data transmission,

> authentication and session protection,

> access restrictions,

> server-side security controls,

> App Attest,

> plausibility checks and abuse prevention,

> logging of security-related processes, and

> regular data backups.

However, no digital system can guarantee absolute protection against all security risks.

————————————————–

37. Legal bases under the GDPR

Where the GDPR applies, we base processing in particular on:

Article 6(1)(a) GDPR — consent, for example for:

> optional cookies,

> Google Analytics,

> Google Maps,

> YouTube,

> newsletters, and

> HealthKit access.

Article 6(1)(b) GDPR — contract or pre-contractual measures, for example for:

> registration,

> user account,

> Steps4Miles app features,

> steps and rewards,

> Leagues,

> challenges,

> social features, and

> messaging.

Article 6(1)(f) GDPR — legitimate interests, for example for:

> IT security,

> server logs,

> App Attest,

> hCaptcha,

> abuse and manipulation prevention, and

> moderation and enforcement of our Terms of Use.

Where step data qualify as health data or other specially protected data under Article 9 GDPR in the specific context, we additionally base their processing on your explicit consent under Article 9(2)(a) GDPR.

————————————————–

38. Your data protection rights

Where the respective legal requirements are met, you have in particular the right to:

> access your personal data,

> rectification of inaccurate data,

> erasure of your data,

> restriction of processing,

> data portability,

> object to certain processing, and

> withdraw consent you have given.

Consent may be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Data protection enquiries may be sent to:

privacy@stepsformiles.com

For data protection enquiries, we may require appropriate measures to verify the applicant’s identity so that personal data are not disclosed to unauthorised persons. The FDPIC confirms in particular the right of access and the rights to rectification or erasure under Swiss data protection law.

————————————————–

39. Objection to processing based on legitimate interests

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing on grounds relating to your particular situation.

We will then cease processing the data concerned unless there are compelling legitimate grounds for processing that override your interests, rights and freedoms, or processing serves the establishment, exercise or defence of legal claims.

————————————————–

40. Right to lodge a complaint

If you believe that your personal data are not being processed lawfully, you may contact us at any time:

privacy@stepsformiles.com

People in Switzerland may also contact the:

Federal Data Protection and Information Commissioner (FDPIC)

Where the GDPR applies, data subjects also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged data protection infringement.

————————————————–

41. No use of step data for advertising

The step and activity information collected through HealthKit and Steps4Miles is not used to:

> display personalised advertising,

> create advertising profiles,

> segment users for advertising networks, or

> transmit HealthKit data to advertising networks.

Our website analysis through Google Analytics takes place separately from personal Steps4Miles step data. We do not combine HealthKit step data with Google Analytics data for advertising purposes.

————————————————–

42. Changes to this Privacy Policy

We may amend this Privacy Policy if:

> new features are introduced,

> our technical systems change,

> new service providers or partners are added, or

> legal requirements make an adjustment necessary.

The current version is published on our website. In the event of material changes affecting processing within the Steps4Miles app, we will inform users in an appropriate manner.

This Privacy Policy was last updated on: 6 September 2026