Privacy
Last updated 4 September 2026.
Lockstep is a step-count competition between people who already know each other. It needs your step counts to do that, and almost nothing else. This page says exactly what it holds, who else ever sees it, and how to make it go away.
The short version
- Your step counts are read from Apple Health and used for one thing: scoring the competitions you have joined.
- They are never sold, never shared with advertisers, never used for advertising, and never used for marketing or data mining. That is a rule Apple imposes on any app touching Health data, and it is also the whole design.
- There are no analytics, no advertising, no tracking and no third-party SDKs. Lockstep has exactly one dependency, the Supabase client, and it talks only to Lockstep's own server.
- Deleting your account removes your data.
What Lockstep collects
Health data
Step counts, and only step counts. Lockstep asks Apple Health for permission to read your daily step total. It requests no other Health type, and it requests no permission to write at all — the list of things it asks to share is empty, so it cannot add, change or remove anything in Health.
What leaves your phone is a number per day: a date and a step total. Not routes, not locations, not workouts, not heart rate, not the time of day you walked. The 90-day history is read once when you first connect Health, so the competitions you join can show something other than an empty chart.
You can revoke this at any time in iOS Settings → Privacy & Security → Health → Lockstep. Lockstep keeps working; it stops receiving new totals, and you can enter days by hand instead.
Your account
Lockstep uses Sign in with Apple and has no password of its own. Apple gives it a stable identifier for you and an email address — which is the private relay address if you chose to hide yours, and Lockstep neither knows nor cares which. The email is used to identify the account, and nothing is ever sent to it for marketing.
What you type in
A display name, a permanent username, an optional profile photo, an optional daily goal, your time zone, and the short note you can leave on a day. Steps you enter by hand are stored the same way steps from Health are, and are marked as manual so everybody in a competition can see which is which.
What Lockstep does not collect
No location, no contacts, no calendar, no photo library beyond the single image you pick for your profile, no advertising identifier, no device fingerprint, and no behavioral analytics of any kind.
Who else sees it
People you compete with. That is the point of the app. Everyone in a competition you have joined can see your display name, your username, your profile photo, your daily and total steps for that competition's date range, whether a day was entered by hand, and any note you attached to a day. Your friends can see your profile and your notes.
Nobody outside that. Lockstep has no public profiles, no feed, and no directory. Somebody who is neither your friend nor in a competition with you can find your username by searching for it — that is how people add each other — and sees your display name and photo, which is what a request has to show to be answerable at all. Blocking somebody removes you from their search results and them from yours, in both directions.
Two service providers, both as processors:
- Supabase hosts the database, authentication and photo storage, on
Amazon Web Services in the United States (
us-east-1). They do not use the data for anything of their own. - Apple provides Sign in with Apple, Health, and — once notifications ship — push delivery. A push notification's text passes through Apple's servers, which is unavoidable for any iOS notification.
There is nobody else. No advertising network, no analytics vendor, no data broker, no AI training.
How long it is kept
Daily totals are kept while your account exists, because a finished competition has to stay finished — a leaderboard from March is a record, not a cache. Finished competitions keep a stored result permanently for the same reason.
Deleting your account
In the app: Profile → Settings → Delete account. Your profile, your step data, your notes and your photo are removed. Where you appeared in a competition somebody else is still running, a placeholder stays in the standings so their history does not silently change shape underneath them — it carries no name, no photo and no steps.
If you would rather ask a person, write to support@locksteptracker.app and it will be done by hand.
Children
Lockstep is not directed at children under 13 and does not knowingly collect anything from them.
Changes
If this page changes in a way that affects what is collected or who sees it, the change is announced in the app before it takes effect, not only by editing this date.