Privacy

Last updated 6 November 2026

Lockstep is a step-count competition between people who already know each other. It needs your step counts to do that, and almost nothing else. This page says exactly what it holds, who else ever sees it, and how to make it go away.

The short version
  • Your step counts are read from Apple Health and used for one thing: scoring the competitions you have joined.
  • They are never sold, never shared with advertisers, never used for advertising, and never used for marketing or data mining. That is a rule Apple imposes on any app touching Health data, and it is also the whole design.
  • There are no analytics, no advertising, no tracking and no third-party SDKs. Lockstep has exactly one dependency, the Supabase client, and it talks only to Lockstep's own server.
  • Purchases are made with Apple. Lockstep never sees your card or payment details.
  • Deleting your account removes your data.
What Lockstep collects

Health data

Step counts, and only step counts. Lockstep asks Apple Health for permission to read your daily step total. It requests no other Health type, and it requests no permission to write at all — the list of things it asks to share is empty, so it cannot add, change or remove anything in Health.

What leaves your phone is a number per day: a date and a step total. Not routes, not locations, not workouts, not heart rate, not the time of day you walked. The 90-day history is read once when you first connect Health, so the competitions you join can show something other than an empty chart.

You can revoke this at any time in iOS Settings → Privacy & Security → Health → Lockstep. Lockstep keeps working; it stops receiving new totals, and you can enter days manually instead.

Your account

Lockstep has no password of its own. You sign in with Apple, with Google, or with both, and each gives Lockstep a stable identifier for you.

Sign in with Apple: Lockstep asks Apple for your name and nothing else - not your email address.

Continue with Google: Google always shares your name and email address, so Lockstep holds that email for you. It is shown to you alone, in Settings beside "Google", so you can tell which Google account opens Lockstep. Nobody else sees it, and Lockstep never sends you email at it or anywhere else.

Either way, the name is only offered as your display name, which you can change. Deleting your account deletes both.

What you type in

A display name, a permanent username, an optional profile photo, an optional daily goal, your time zone, and a short note that disappears after 24 hours. Steps you enter manually are stored the same way steps from Health are, and are marked as manual so everybody in a competition can see which is which.

Purchases

Premium, the add-ons and All Access are bought from Apple, and Lockstep never sees your card, your billing address or anything else about how you paid. It keeps a record of what you hold so it can be unlocked on any phone you sign in on: which product it is, Apple's identifiers for the transaction, when a subscription ends, and whether it was refunded. Apple tells Lockstep's server directly when a subscription renews, ends or is refunded. If you are a Founder, the record says only that your account existed before Lockstep 2.0.

What Lockstep does not collect

No location, no contacts, no calendar, no photo library beyond the single image you pick for your profile, no advertising identifier, no device fingerprint, and no behavioral analytics of any kind.

Who else sees it

People you compete with. That is the point of the app. Everyone in a competition you have joined can see your display name, your username, your profile photo, your daily and total steps for that competition's date range, whether a day was entered manually, and any note you attached to a day. Your friends can see your profile and your notes.

Nobody outside that. Lockstep has no public profiles, no feed, and no directory. Somebody who is neither your friend nor in a competition with you can find your username by searching for it — that is how people add each other — and sees your display name and photo, which is what a request has to show to be answerable at all. Blocking somebody removes you from their search results and them from yours, in both directions.

Four service providers, all as processors:

  • Supabase hosts the database, authentication and photo storage, on Amazon Web Services in the United States (us-east-1). They do not use the data for anything of their own.
  • Apple provides Sign in with Apple, Health, in-app purchases, and push delivery. A push notification's text passes through Apple's servers, which is unavoidable for any iOS notification. The app stores a device token so Apple knows which phone to wake - whether or not notifications are on, because a silent push is how steps are brought up to date before a morning report. Signing out, or deleting the app, ends that.
  • Google provides Continue with Google, only if you use it. Lockstep opens Google's own sign-in page and receives your name and email address from it. The app has no Google code in it, and Lockstep sends Google nothing about you or your steps.
  • Resend delivers two kinds of email, both to the address at the top of the support page and never to you. One is the report you file about somebody, so a person can act on it: it carries what you reported — a note, a photo or a display name — along with your username and theirs. The other is a note when a new account is made, with its display name, username, time zone and the date, so a person knows who has joined. Nothing else is emailed to anybody, ever.

There is nobody else. No advertising network, no analytics vendor, no data broker, no AI training.

How long it is kept

Daily totals are kept while your account exists, because a finished competition has to stay finished — a leaderboard from March is a record, not a cache. Finished competitions keep a stored result permanently for the same reason.

Deleting your account

In the app: Profile → Settings → Delete account. Your profile, your step data, your notes and your photo are removed. Where you appeared in a competition somebody else is still running, a placeholder stays in the standings so their history does not silently change shape underneath them — it carries no name, no photo and no steps.

Your record of purchases goes with the account. Deleting the account does not cancel an All Access subscription - Apple bills it, so it is canceled in iOS Settings → your name → Subscriptions.

If you would rather ask a person, write to support@locksteptracker.app and it will be done by hand.

The World Board

Lockstep ranks everyone by lifetime Crowns and Medals on the World Board. Your friends, and anyone you have been in a competition with, see your name and photo there, as they already can on your profile. Everyone else sees only the first letter of your username, with your Crowns and Medals beside it - the rest of your username, your name and your photo are never sent to their phone. You are on it unless you switch it off in Settings, and switching it off takes you off at once. Family members are never on it.

Family members

A Lockstep account can keep steps for people who have no phone of their own - usually children with a pedometer. They do not use the app themselves. The adult keeping their steps - their caretaker - adds them and types in their numbers, and is the only source of anything Lockstep holds about them: a display name, an emoji or a picture made with Memoji, Genmoji or Image Playground (never a photo), a time zone, a daily goal, and their daily step totals, with the Crowns and Medals those earn. Lockstep never asks for or stores their age, and nothing is ever collected from the family member directly.

A family member has no username, cannot be found by search, has no friends, and posts no notes. Besides their caretakers, they are seen only by the people in the competitions their caretaker joins them to - always competitions that caretaker is in - who see their display name, picture, steps for the competition's dates, and which caretaker keeps them. They receive no notifications.

When a family member is 13 or older and has a phone of their own, any of their caretakers can let them take over: the caretaker confirms they are 13 or older and makes a one-time code, and the family member signs in with Apple on their own phone and enters it. From then on they have an ordinary Lockstep account, described by the rest of this page, with everything that was held about them as a family member - their steps, Crowns and Medals stay theirs. Their caretakers stop keeping them and can no longer see or change anything as their caretaker. Lockstep keeps a record that the takeover happened, which caretaker made the code, and that they confirmed the person is 13 or older; it does not keep their age.

Any caretaker can delete a family member. Their name and picture are removed straight away, and everything else is erased after seven days, during which any of their caretakers can undo it. Deleting your own account deletes, immediately, every family member nobody else keeps.

Lockstep is not directed at children under 13, and does not knowingly collect anything from them. A family member can only be given an account of their own after a caretaker confirms they are 13 or older. If you believe a child under 13 is using Lockstep themselves, write to support@locksteptracker.app.

Changes

If this page changes in a way that affects what is collected or who sees it, the change is announced in the app before it takes effect, not only by editing this date.