StepLock —

Privacy Policy for StepLock

Effective Date: August 6, 2026

Last Updated: August 16, 2026

Developer: Thinkbyte SRL (trading as ThinkByte)

Contact: info@thinkbyte.tech

Website: https://thinkbyte.tech

Introduction

StepLock is provided by Thinkbyte SRL, operating under the name ThinkByte ("StepLock," "we," "us," or "our"). This Privacy Policy explains how information is handled when you use the StepLock application for iPhone and iPad.

Privacy at a glance

• No StepLock account or sign-in is required.
• Your Apple Health step data stays on your device.
• The apps and categories you select through Screen Time stay on your device.
• StepLock sends limited anonymous product-interaction analytics to PostHog's EU service, without Health data, selected-app identities, or an account identity.
• StepLock uses Meta (Facebook) App Events to measure which of our ads led to an install or subscription. With your permission, this may include the device advertising identifier. Health data and the apps you block are never sent to Meta.
• StepLock does not sell personal information and does not show ads inside the app.
• Apple processes App Store payments, while RevenueCat helps validate and manage subscription access using an anonymous identifier.

1. Information processed on your device

Apple Health data

With your permission, StepLock reads step-count data from Apple Health. We use this information to validate walking activity, calculate earned screen time, display progress, and maintain your local activity history.

StepLock:

• reads step-count data only after you grant permission;
• does not add to, edit, or delete information in Apple Health;
• does not send Health data to ThinkByte, RevenueCat, Meta, advertisers, or data brokers; and
• does not use Health data for advertising, marketing, or user profiling.

Health data and step-derived records are processed and stored locally on your device.

You can revoke StepLock's Health access at any time from iPhone Settings → Privacy & Security → Health → StepLock. Some app features will no longer work without step-count access.

Screen Time selections

StepLock uses Apple's Family Controls, Device Activity, and Managed Settings frameworks to let you choose apps and categories you want to use more intentionally.

Your selections are stored locally in a secure App Group container shared only by StepLock and its system extensions. We do not receive a list of the apps or categories you select, and we do not send that list to Meta or any other advertising partner.

You can revoke Screen Time access in iPhone Settings. Revoking access prevents StepLock from shielding selected apps.

App activity and settings

The following information is stored locally on your device:

• earned and spent screen-time balance;
• step-validation records and progress history;
• goals, streaks, and carryover balance;
• selected preferences and permission status; and
• emergency-unlock status.

This information is used to provide StepLock's core functionality. Deleting StepLock generally removes its locally stored app data, subject to Apple's device backup and restoration behavior.

2. Subscriptions and purchases

StepLock offers auto-renewable subscriptions through Apple's In-App Purchase system. Apple processes payments under Apple's own terms and privacy policy. We do not receive or store your full payment-card details.

We use RevenueCat to validate purchases, restore subscription access, determine whether the StepLock Pro entitlement is active, prevent purchase fraud, provide subscription support, and understand subscription performance.

For these purposes, RevenueCat may process:

• a randomly generated anonymous App User ID;
• Apple purchase receipts and purchase history;
• subscription status, product, price, currency, and renewal information;
• first-seen and last-seen timestamps; and
• limited device and technical information needed to operate its service.

StepLock does not provide RevenueCat with your name, email address, Health data, Screen Time selections, or advertising identifier. We do not use a StepLock account identifier because the app has no account system.

RevenueCat's handling of information is also described in the RevenueCat Privacy Policy.

You can manage or cancel a subscription from iPhone Settings → [your name] → Subscriptions. You can restore purchases and access subscription-management tools from inside StepLock.

3. Product analytics

StepLock uses PostHog's European Union service to understand whether essential product flows work as intended. PostHog receives a randomly generated anonymous identifier and limited events such as:

• onboarding screens viewed and onboarding completion;
• permission prompts and whether permission was granted;
• paywall views, plan selections, purchase-flow outcomes, and restore actions;
• opening the app selector and the number of items selected, but not their names or identities;
• notification-permission actions; and
• app installation, update, open, and background lifecycle events.

These events may include a timestamp, app version, operating-system version, device model, locale, and limited technical context supplied by the PostHog SDK. They are used only for product analytics and are not linked to a StepLock account because StepLock has no account system.

StepLock does not send PostHog:

• Apple Health step counts or other HealthKit data;
• earned balances, goals, streaks, milestones, or other step-derived values;
• the names or identities of apps selected through Screen Time;
• onboarding answers such as age, activity level, or reported screen habits;
• your name, email address, or advertising identifier; or
• screen recordings, screenshots, text input, or automatically captured interface interactions.

Session replay, screen-view capture, and element autocapture are disabled. PostHog data is sent to the EU ingestion endpoint and is not used for advertising or to measure ads.

PostHog's handling of information is also described in the PostHog Privacy Policy.

4. Advertising measurement (Meta)

StepLock does not display advertisements in the app. We do run ads for StepLock on Meta platforms such as Facebook and Instagram. To know which of those ads led someone to install the app or subscribe, StepLock includes the Meta App Events SDK.

What Meta may receive

Meta may receive conversion signals with no Health or Screen Time payload attached:

• automatic install and session events from the SDK;
• that onboarding was completed;
• that Screen Time access was granted (not a refusal);
• that apps were selected for shielding, without their names or identities;
• that the paywall was shown or checkout was started; and
• that a free trial started or a subscription was purchased, including price and currency so we can measure return on ad spend rather than a raw conversion count.

If you allow tracking through Apple's App Tracking Transparency prompt, Meta may also receive the device advertising identifier (IDFA) so an install or subscription can be matched to a specific ad. The SDK may also receive limited technical context it needs to operate, such as crash diagnostics and other device data described in Meta's own privacy disclosures.

What Meta does not receive

StepLock does not send Meta:

• Apple Health step counts or other HealthKit data;
• earned balances, goals, streaks, or other step-derived values;
• the names or identities of apps you choose to block;
• onboarding answers such as age, activity level, or reported screen habits; or
• your name, email address, or a StepLock account identifier (the app has none).

If you decline tracking

You can choose Ask App Not to Track. The app works the same either way. Measurement then uses Apple's SKAdNetwork only: aggregated, delayed install reporting with no advertising identifier. Declining tracking does not stop local notifications, Health, Screen Time, or subscriptions.

Why this is tracking under Apple's rules

When you allow tracking, conversion events and the advertising identifier may be linked with Meta's advertising data so we can measure and improve _our own_ ads. That is Apple's definition of tracking. It is not used to show ads inside StepLock, and it is not used to profile you from Health or blocked-app data.

Meta's handling of information is described in the Meta Privacy Policy.

5. Notifications

If you grant notification permission, StepLock may schedule reminders and progress messages on your device. These may include earning reminders, progress updates, subscription reminders, and streak notifications.

StepLock does not send advertising notifications. You can disable notifications at any time from iPhone Settings.

6. How we use information

We use the limited information described in this policy to:

• provide and maintain StepLock's features;
• calculate and display earned screen time locally;
• enforce the app-shielding rules selected by you;
• validate, restore, and manage StepLock Pro subscriptions;
• prevent fraud and resolve purchase problems;
• provide customer support;
• measure which of our ads led to an install or subscription, and improve that advertising;
• comply with legal obligations; and
• protect the security and integrity of the app and its users.

Where applicable law requires a legal basis, we rely on:

• your consent for access to Health, Screen Time, and notification permissions, and for App Tracking Transparency / the advertising identifier;
• performance of our agreement with you to provide app and subscription functionality;
• our legitimate interests in operating, securing, supporting, and improving the app, subscriptions, and our own advertising measurement where consent is not required (for example SKAdNetwork); and
• compliance with legal obligations.

You can withdraw a device permission at any time. Withdrawal does not affect processing that occurred before the permission was withdrawn.

7. How information is shared

We share information only:

• with Apple and RevenueCat when necessary to process, validate, restore, and manage purchases;
• with Meta, as described in section 4, to measure and improve ads we run for StepLock;
• with service providers acting on our instructions when necessary to operate or support StepLock;
• when required by law, court order, or a valid governmental request;
• to investigate fraud, abuse, security incidents, or violations of applicable terms; or
• in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to appropriate safeguards.

We do not sell personal information. We do not display third-party ads in the app. We do not share Health data or Screen Time app selections with anyone.

8. Data retention

On-device information remains on your iPhone until it is removed through the app, reset by the operating system, or deleted with the app, subject to Apple's backup and restoration behavior.

Apple and RevenueCat retain purchase and subscription records according to their own policies and for as long as reasonably necessary for purchase validation, accounting, fraud prevention, customer support, dispute resolution, and legal compliance.

Meta retains advertising-measurement events according to its own policies.

When we receive a support message, we retain the correspondence only as long as reasonably necessary to answer the request, maintain appropriate business records, resolve disputes, and meet legal obligations.

9. International data transfers

Apple, RevenueCat, Meta, and other authorized service providers may process information in countries outside your country of residence, including the United States. Where required, these transfers are protected using legally recognized safeguards, such as adequacy decisions or standard contractual clauses.

Your Health data, Screen Time selections, and local StepLock activity records are not transferred to us.

10. Your privacy rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, or a copy of personal information associated with you. You may also have the right to object to certain processing or lodge a complaint with your local data-protection authority.

Because StepLock does not require an account and RevenueCat uses a randomly generated anonymous identifier, we may need information from your device or purchase record to locate subscription information connected with a request. We may be unable to identify a record using only your name or email address.

To make a privacy request, contact us at info@thinkbyte.tech. We may ask for reasonable verification before completing the request.

You can directly control on-device information by changing permissions in iPhone Settings or deleting the app. Subscription records can be managed through your Apple Account.

To control advertising measurement:

• respond to the App Tracking Transparency prompt when it appears; or
• later, open iPhone Settings → Privacy & Security → Tracking → StepLock.

Declining tracking does not reduce the features of the app.

11. Children's privacy

StepLock is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action.

StepLock is not listed in the App Store's Kids category and is intended as a personal fitness and productivity tool rather than a parental-monitoring service.

12. Security

We use reasonable administrative and technical safeguards designed to protect the limited information handled through StepLock. Health data, Screen Time selections, and core app state are kept on the device using Apple-provided storage and permission systems.

No electronic storage or transmission method is completely secure, so we cannot guarantee absolute security.

13. Third-party services

StepLock relies on services provided by:

• Apple for Apple Health, Screen Time frameworks, App Store distribution, In-App Purchases, App Tracking Transparency, and SKAdNetwork;
• RevenueCat for subscription validation and management;
• PostHog for limited anonymous product analytics processed through its European Union service; and
• Meta for advertising measurement of ads we run for StepLock.

These services operate under their own privacy policies and legal terms.

14. Changes to this policy

We may update this Privacy Policy when StepLock's functionality, service providers, or legal obligations change. We will publish the updated version at this location and revise the effective date above.

If a change materially affects how information is handled, we will provide additional notice where required by law.

15. Contact us

For support, privacy questions, or requests concerning your information, contact:

Thinkbyte SRL Trading as: ThinkByte Email: info@thinkbyte.tech Website: https://thinkbyte.tech