Last updated: September 26, 2026
This Privacy Policy describes how Stepvale handles information in the Stepvale Android app, on this website, and when you use Stepvale Premium. App data such as tasks, goals, notes, daily energy-level entries, energy-level history, and world progress stays on your device and is not sent to Stepvale servers. When you subscribe to or purchase Stepvale Premium, we process a limited set of purchase-related data on Stepvale servers. Stepvale uses Yandex AppMetrica for product and technical analytics. Optional rewarded ads use Yandex Mobile Ads only after your consent; the advertising SDK may then process advertising-related technical data.
1. About this policy and Stepvale
This policy applies to the Stepvale mobile app, this website (stepvale.com), and the Stepvale backend used for Premium purchase verification and entitlements (api.stepvale.com).
Stepvale is the public product brand. The seller of Stepvale Premium for Russia is Belavin Sergei Andreevich, a natural person — Taxpayer under the professional income tax regime (self-employed). Taxpayer INN: 602712274121. Contact for data and support questions: support@stepvale.com. Premium Purchase Terms: https://stepvale.com/en/offer.
Stepvale is not a medical product, does not diagnose conditions, and is not intended to diagnose or treat depression or other illnesses. It does not infer medical conclusions from your energy-level entries or activity.
2. Data that stays on your device
Depending on the features you use, the app may store locally: your chosen energy level; today’s tasks and their status; custom tasks; goals and goal steps; energy-level calendar entries and day notes; world progress and world history; achievements; reminder, widget, theme, language, and ad-consent settings; and, if you subscribe to or purchase Stepvale Premium, a purchase session token and the email you entered for purchase confirmation in secure on-device storage.
To power the home-screen widget, a small amount of data may be written to storage shared between the app and its widget. Showing energy level and task titles on the widget is off by default.
Daily energy-level entries and energy-level history are stored locally on the device and are not transmitted to Stepvale servers. Tasks, goals, notes, and world progress are also not sent to Stepvale servers.
3. Data sent to Stepvale
You do not need to register or sign in to use the core app. Stepvale does not provide a general app login for on-device progress.
When you subscribe to or purchase Stepvale Premium, the app or the official Stepvale bot contacts Stepvale servers and may send: the email address you enter for purchase confirmation; the one-time confirmation code you enter; the Premium plan you choose; and authenticated requests needed to check Premium status, create a payment, or switch off auto-renewal. Stepvale stores a server-side user record keyed by that email, hashed confirmation codes, purchase-session tokens (hashed), payment records and provider payment identifiers, Premium entitlement state, and subscription or access state (plan, status, paid period boundaries, auto-renewal flag where applicable).
When you purchase through the official Stepvale Telegram bot, Stepvale may also process your Telegram user ID linked to the purchase session and Stars subscription status, to the extent needed to provide Premium and support payments.
For auto-renewing subscriptions via YooKassa, Stepvale additionally stores a technical identifier of the payment method saved at YooKassa. It is kept server-side only, is never returned to the app, and is used solely for permitted charges under your subscription.
For abuse protection, Stepvale may temporarily process request metadata such as IP address in memory for rate limiting. Operational server logs may include request metadata; secrets such as confirmation codes and authorization headers are configured to be redacted from logs.
In the Google Play version of Stepvale, the Google Play Billing countryCode is read on the device to decide whether to offer Premium purchase via YooKassa; it is not sent to Stepvale servers. In the RuStore version, Google Play Billing and this country check are not used.
4. Why we process data
On-device data is used to run Today, goals, the world, reminders, widgets, and related app features.
Premium-related server data is used to verify email ownership for the purchase flow, create and track payments, make permitted recurring charges for an auto-renewing subscription until it is cancelled, grant and restore Premium entitlement, deliver purchase information to the buyer and — for settlements in rubles via YooKassa — a settlement document (receipt) in the manner required by the NPD regime, prevent abuse, and respond to support or privacy requests.
Analytics and diagnostic information processed through AppMetrica is used for product and technical analytics, troubleshooting crashes and errors, improving stability, and improving Stepvale features.
We do not use Premium confirmation email as marketing consent, and we do not send marketing newsletters based on that flow.
5. Analytics and diagnostics
Stepvale uses Yandex AppMetrica, a product and technical analytics service provided by Yandex, to understand how the app is used, improve its stability, identify technical issues, and improve existing features.
The service may process technical information about the app and device, app and operating-system version, technical network data including the IP address, session information, events describing interactions with Stepvale features, and crash, diagnostic, and performance information. This information is used to investigate the causes of errors, crashes, and performance problems, to understand which features people use, and to improve the app.
Stepvale does not send a person's name, the contents of user notes or tasks, the email address associated with a Stepvale account, user-entered free text, the user's selected energy/state or wellbeing level, health information, payment details, purchase history or purchase value, precise device coordinates, or an internal Stepvale account identifier to AppMetrica.
In Stepvale’s AppMetrica configuration, locationTracking is disabled. Stepvale does not request GPS access for AppMetrica and does not transmit precise device coordinates. Even so, AppMetrica may technically process the IP address, and Yandex may use it to determine the device’s approximate geographic location, such as its country, region, or city; this IP-based estimate is not precise GPS coordinates. Advertising-identifier tracking and automatic revenue tracking are also disabled. The AppMetrica SDK may still process other technical app, device, session, crash, and diagnostic data under Yandex’s terms. AppMetrica is separate from Yandex Mobile Ads.
Stepvale does not use AppMetrica for advertising profiling, personalized advertising, or selling data. Rewarded advertising is described separately in the Yandex Mobile Ads section.
Data processing by AppMetrica is carried out under Yandex’s terms and related documents: https://yandex.com/legal/metrica_termsofuse/ and https://yandex.com/legal/confidential/.
6. Advertising
Stepvale uses Yandex Mobile Ads for optional rewarded advertising. Rewarded ads are shown only after your consent. If you decline, the advertising SDK is not initialized and rewarded ads are not loaded. You can change or withdraw consent in app settings. Premium removes required rewarded-ad views for certain choices and does not require advertising consent for those bypasses.
Stepvale’s own ad request code sends the ad unit identifier and does not send your tasks, goals, notes, energy level, calendar, or world progress for ads.
According to Yandex’s developer guidance for Google Play Data safety, after consent the Mobile Ads SDK may collect and share device or other IDs such as the advertising ID when the relevant permission is available, for advertising and marketing purposes. Approximate location from IP may be processed by advertising infrastructure even when Stepvale does not request device location permissions. Stepvale does not enable optional precise/coarse location consent parameters in its ad integration.
Yandex’s privacy materials for advertising services apply to data processed by Yandex.
8. Email confirmation codes
Email is requested only in the Premium purchase flow to confirm that you can receive mail at that address. It is not used as a general Stepvale app login.
Stepvale sends a one-time numeric code by email through its email infrastructure (Timeweb SMTP in the current production setup), from an address such as no-reply@stepvale.com. The code itself is stored only as a hash. Codes are valid for a short functional period (currently 10 minutes) and become unusable after expiry, consumption, or too many failed attempts.
The same verified email may be used for Premium purchase transactional messages and, for payments in rubles via YooKassa, to deliver a settlement document (receipt) in the manner required by the NPD regime. This is not marketing.
Expired or used code records may remain in the database until manually removed; there is currently no automatic purge job for those rows. While the Premium account exists, the email address remains associated with the user record so entitlement can be restored on another device with the same email confirmation flow. After account deletion, the email is removed and previous Premium is not restored for that address.
9. Service providers and third parties
Depending on the feature, data may be processed by: Stepvale hosting and database infrastructure for the API; Timeweb SMTP for transactional Premium confirmation email; YooKassa for ruble payments; the Telegram / Telegram Bot Platform for Premium purchases with Telegram Stars through the official bot; Yandex AppMetrica for product and technical analytics; Yandex Mobile Ads for rewarded ads; Google Play / Google Play Billing for distributing the Google Play version and Play country checks used for Premium availability in that version; RuStore for distributing the RuStore version (without Google Play Billing); and, on this website, Google Fonts (Inter via next/font) which may involve a request to Google’s font delivery infrastructure when the page loads.
Each provider processes data under its own terms and privacy policy for the services it provides.
10. This website
This website can remember your language choice in a cookie and in browser local storage (stepvale-locale) so the next visit can open in that language. That is only a language preference.
The site does not use analytics cookies or marketing trackers. Ordinary web-server or hosting logs may record technical request data such as IP address and user agent as part of operating the site. The Premium payment return page does not collect payment form fields; payment details stay with YooKassa.
11. Retention
On-device app data remains until you clear app data or uninstall the app. Images you separately saved to your gallery may remain. Your device or OS may also keep backups according to system settings.
Confirmation codes stop working after their functional expiry, but database rows are not automatically deleted on a published schedule today. Purchase sessions expire after a configured TTL (currently 30 days by default) and then stop working; session rows are not automatically purged. Payment, subscription, and Premium entitlement records are retained to operate Premium, prevent fraud, and support accounting or dispute handling. The saved payment-method identifier is kept only while auto-renewal is active: it is removed when you cancel auto-renewal and when the account is deleted. We do not invent additional fixed deletion deadlines beyond what the systems currently enforce.
12. Account and data deletion
You can delete on-device Stepvale data by clearing the app’s data in system settings or by uninstalling the app.
You can delete the Stepvale account tied to your email from the app: Profile → Settings → Delete Stepvale account. You confirm with a fresh email code. This removes the server account, sessions, confirmation codes, Premium entitlement, and the email from account records, switches off subscription auto-renewal, and removes the stored payment-method identifier. It does not erase local tasks, goals, notes, energy level, or world progress on the device. Deleting the account itself is not a payment refund request, and an already paid period is not refunded automatically. After account deletion, Premium forever cannot be restored; re-registering with the same email creates a new account without the previous Premium. No email hash is kept specifically to restore Premium.
If the app is unavailable, use https://stepvale.com/en/account-deletion (or the Russian page) and email support@stepvale.com from the Premium address. Stepvale may ask for verification.
After account deletion, minimal financial and technical payment records may remain (provider payment id, amount, currency, status, timestamps, NPD details) with no user_id or email, for accounting, refunds, reconciliation, and fraud prevention. Those records are not used to restore the account or Premium. We do not promise instant removal from every backup copy.
13. Security
We use HTTPS/TLS for Stepvale API traffic, access controls on server systems, and keep payment provider secrets and SMTP credentials off the mobile app bundle. Confirmation codes and session tokens are stored hashed. No security measure is perfect, and we do not claim that data can never be disclosed or systems can never be compromised.
14. Children
Stepvale is not directed at children.
15. Changes
We may update this policy as the app, website, or Premium services change. The current version is always available on this page, with the last-updated date above.
16. Contact
Privacy and support contact for Stepvale: support@stepvale.com.
Website: https://stepvale.com