AetherStep Privacy Policy

Last updated: September 5, 2026

AetherStep is a fitness role-playing game: real-world walking powers your character. This policy explains what we collect, why, and what control you have.

What we collect

• Sign-in identifier. When you sign in with Apple or Google we store the anonymous account identifier the provider gives us and a display name. We never receive your Apple or Google password. Email is not required for those sign-in methods, and is not stored unless your provider shares it and you consent.
• Email address and password. If you choose to sign in with an email address instead, we store that address so we can identify your account and send you verification and password-reset codes. We never store your password itself: we keep only a salted, iterated one-way hash of it, from which the password cannot be recovered. We use your address only for account security messages — not for marketing, and we do not share or sell it. Playing as a guest, or with Apple or Google, does not create any of this.
• Fitness data. With your permission, we read steps, walking/running distance, and workout type from Apple HealthKit or Android Health Connect, together with record times, time-zone offset, excluded manual-step totals, and the package names of apps that supplied Android step records. We convert it into in-game Energy on our server. On Android, if you separately grant background health access, AetherStep may read and send these daily aggregates about every six hours while the game is closed. We only read — the app never writes health data.
• Fitness device identifiers. Fitness sync includes a random identifier for this app installation and, when available, a one-way hash of the platform device identifier. We use these to detect the same steps being claimed by multiple game accounts.
• Gameplay data. Your character, inventory, guild, friends list, dungeon results, and leaderboard standings.
• Messages and moderation data. Text chat you send, player or guild names, blocks, and reports used to operate and moderate the game's social features.
• Purchase history. If you buy something, we retain the product id, store transaction id, and a one-way receipt hash to grant the item and prevent duplicate redemption. Apple or Google handles payment details; we do not receive your card or bank information.
• Device push token. If you allow notifications, a device token so we can send game notifications (party found, dungeon complete, daily reminder). You can turn these off in the app at any time.
• Diagnostics. Crash reports and basic usage events (app opened, sync completed, dungeon run) via Google Firebase Crashlytics and Analytics, tied to your player id.

What we do NOT do

• No advertising, and no sale or sharing of your data with data brokers.
• No tracking across other companies' apps or websites.
• No precise location collection.
• No collection of raw heart rate, sleep, or any health data beyond steps, distance, and workout type.

Where your data lives

Game data is stored on our servers (hosted on DigitalOcean, in the United States) and encrypted in transit (TLS). Fitness data read from your device is processed into game Energy; the step records we keep are the aggregated daily sync summaries used for gameplay and anti-cheat, not raw motion samples.

Your health-data controls

You can revoke AetherStep's foreground or background Health Connect access in Android system health settings at any time. Revoking background access stops closed-app uploads. Signing out or deleting your account cancels the scheduled Android upload and removes its local configuration.

Leaderboards and social features

Your display name, character class, level, power, weekly steps/Energy, and guild tag are visible to other players on leaderboards, in guilds, and in friends lists. Choose a display name you are comfortable showing.

Deleting your account

In the app: Options → Account → Delete Account (tap twice to confirm). This immediately removes your sign-in link, your email address and password hash if you had one, active sessions, device tokens, detailed fitness and device records, authored chat and report data, friends links, queue/party state, guild membership, and identifiable archived leaderboard entries, and anonymizes your player record. Non-identifying aggregate gameplay totals may be retained. Signing in again afterwards creates a brand-new account.

If you no longer have access to the app, use the AetherStep account deletion request page.

Children

AetherStep is not directed at children under 13 (or the applicable age of digital consent in your region), and we do not knowingly collect data from them.

Changes and contact

We will update this page when data practices change. Questions or requests: [email protected].