In short: StepWays works locally on your phone first, including fully offline in the mountains. The app creates no named account: no name, no email address, no profile picture. What never leaves your device is the medical part: your medical card, your health data and your emergency contacts. What is sent to our servers is a closed list: your trail progress, your packing checklist, a few effort measurements, your GPS tracks — pseudonymised — and your consent choices, timestamped, as proof of your decision, all stored under an anonymous identifier. Your photos are only uploaded if you decide so.
The website, however, does collect an email address, and that has to be said here. Since 12 October 2026, the StepWays presentation page invites you to vote for the next trail, and that vote doubles as subscription to our mailing list. It is the only collection of an email address in this whole policy, it happens only if you fill in that form, and it is set out in section 3. Everything above describes the app, and remains true: the app still asks for no address at all.
The controller for the personal data collected through the StepWays app is:
Only1Cent publishes the StepWays app, available on Android (Google Play) and iOS (App Store). For any question about your personal data, write to contact@only1cent.com: this is the contact point required by Article 13(1)(b) GDPR.
The terms of use are on a dedicated page: StepWays Terms of Use.
StepWays is built to work on your phone first, without a network. Three concrete consequences:
Pseudonymous, not strictly anonymous. The data that is uploaded is keyed to a technical identifier assigned automatically, with no link to your civil identity. It nevertheless remains pseudonymised and not anonymous in the GDPR sense: we therefore never describe it as "anonymous" inside the app.
Here is exactly what is sent to our servers, what never leaves your phone, and the permissions the app asks you for.
Current stage, distance walked, cumulative elevation gain, walking time, start date, whether the trail is completed. Lets you recover your progress after changing device.
The state of your pack: the ticked items of your gear list.
Date, number of days, average walking hours, total elevation gain and distance. Used to assess the feasibility of a future trek. Sent only with your "health data" consent; without it, the local database is not even read.
Eight items, and eight only: first use, last use, app version, build number, platform, OS version, language, time zone. No personal data. Used for support and diagnostics.
If you send us feedback: the text you write, the rating, the trail concerned, the date.
The points recorded during your hikes are sent to our servers, pseudonymised: they are keyed to your technical identifier, not to your identity. They let you recover your hikes after changing device and help us improve trail tracks. We would rather write it plainly: a GPS track says where you walked and when.
For each permission you have decided: your answer, the date (timestamped by the server and, separately, the date of your decision on the phone), the version of the text and what triggered the question. This is the proof of your decision — never the data that decision protects. See § 4.
If the app stops unexpectedly, Firebase Crashlytics sends the device type, the OS version and the error trace. No identifying data.
Blood type, allergies, treatments, medical history, heart rate, sensor readings. No upload channel exists in the code, and the closed list of permitted uploads does not name them.
Identity, date of birth, address, emergency contacts, doctor, insurance number, photos of your health cards. Stored in a dedicated folder, excluded from automatic backups.
Age, height, weight, sex: used locally for effort calculations, they are not uploaded.
Your journal accepts three photos per walking day, at most, and each photo is reduced in size before being saved.
The photo file stays on your phone. It is not uploaded to our servers. What travels with your account is the journal entry: its text, its date, the stage concerned, and the photo's reference — its location on the device and its size — not the image itself.
A consequence to know about: your photos do not follow a change of device. A photo that was never uploaded exists nowhere but on that phone. If the device is broken, stolen, lost or simply replaced, the photos go with it. The text of your journal, on the other hand, follows your account.
Your account is anonymous. There is therefore no name and no email address through which we could give it back to you.
The route provided is the recovery code: sixteen characters in four groups, generated by the app on your phone, shown to you once, and kept in the operating system's secure store. It is never sent to us — not by email, not by SMS, not to our servers. It is also what protects your local vault.
Write it down, and keep it somewhere other than the phone. Without that code, your account and the contents of your vault are permanently unrecoverable: we have no way of reopening them for you. This is not a stylistic caution, it is the consequence of anonymity.
Here is the exact list, taken from the app's Android manifest and its Info.plist file. Nothing more is requested.
| Permission | What it allows | When it is used |
|---|---|---|
| Precise and approximate location Android and iPhone |
Place you on the trail, show the map around you, follow your progress from stage to stage. | When you open the map or when you walk. |
| Background location Android and iPhone |
Keep recording your hike when the screen is off or the phone is in your pocket. | During an ongoing hike, and only then. |
| Foreground service of type "location" Android |
Keep GPS tracking running without Android interrupting it. It is this service that shows the persistent notification. | During an ongoing hike. |
| Notifications Android |
Show the persistent GPS tracking notification, and the app's reminders. | During a hike, and for reminders. |
| Battery optimisation exemption Android |
Stop the phone from suspending GPS tracking while the screen is off. Some devices cut it otherwise, and the track stops mid-stage. | Requested when you start a trek. You may refuse. |
| Keeping the processor awake Android |
Keep GPS capture running while the phone is asleep. | During an ongoing hike. |
| Network access Android |
Download trail data and map tiles, show the weather, sync your account. | When you have a network. The app works without one. |
| Bluetooth Android and iPhone |
Connect to a heart-rate chest strap and show your heart rate. On Android, the Bluetooth scan is declared without deriving location. | Only if you use a heart-rate strap. |
| Camera iPhone |
Take a photo for your hiking logbook. | When you tap "add a photo". |
| Access to your photos iPhone |
Pick a photo you have already taken to illustrate your logbook. | When you tap "add a photo". |
| Reading the Health app iPhone |
Read — read-only — your steps, heart rate, distance and calories, to show your hiking statistics. | Only if you grant the "health data" purpose. That data stays on the phone. |
Everything above is about the app. This part is about the website, and it is the only place in this policy where an email address is asked for. On the presentation page, a form invites you to vote for the trail you want to see next. That vote doubles as subscription to our mailing list: one address, one vote.
| What is recorded | Why |
|---|---|
| Your email address | To write to you when there is news, and to make sure one address votes only once. |
| The trail you chose | To build the ranking of trails, which weighs on the order of publication. |
| The date and time of your vote | To timestamp your consent, and to know when we last contacted you. |
| Your consent, which must be "yes" | Proof of your decision. Without that ticked box, the server refuses the record. |
| The date on which we will ask for your consent again, three years after your vote | To know when to come back to you, without having to recompute anything. |
| Where applicable, the free-text suggestion you write | To tell us about a trail missing from the list. That text is never published: see below. |
We ask for nothing else. No first name, no surname, no phone number, no postal address, no town: none of it would help count a vote or send an email.
Whatever you write in the free-text field appears nowhere on the site. This is not an editorial promise: the website has no read permission whatsoever on the recorded votes. Your browser may write to them, it cannot read them back, and the page therefore cannot display a visitor's text, not even by mistake. The ranking on display contains only trail names and numbers.
Legal basis: your consent (Article 6(1)(a) GDPR), given through a box that is not pre-ticked and that you tick yourself.
Retention period: three years, then we ask you again. This follows the French data protection authority's recommendation on prospect files. In practice, for you:
The date of that check-in is recorded at the moment you vote, next to your address: we do not have to guess it, and it cannot get lost. You need do nothing for this limit to apply, and you may leave sooner, at any time.
To unsubscribe, or to have your address erased: write to contact@only1cent.com. Your address is removed from the list and you receive nothing further. Every email we send repeats how to unsubscribe.
Where this data is hosted: with Google (Firebase / Cloud Firestore), like the rest of our server-side data. Recipients and transfers are described in sections 9 and 10.
Notifications are local: the ones you see are produced by the app on your phone — the persistent tracking notification and the reminders. No data selling: we do not sell, rent or share your data with any third party for commercial purposes.
You decide, purpose by purpose, what the app is allowed to do. Consent is collected through a clear affirmative action — no box is pre-ticked — and it is revocable at any time from Settings > Privacy, where a "Decline all" button withdraws the permissions in a single gesture.
Your consent choices are recorded on our servers, under your anonymous identifier, as proof of your decision. A consent that cannot be produced is not a consent obtained: it is a box ticked on a device, which uninstalling erases. Each decision is therefore kept with:
Only the purposes you have actually decided have a record. A question you have not yet seen has none: writing "declined" without a decision would manufacture a choice that never happened.
Your consent is requested again when the data it covers changes. A consent given six months ago covered what your card contained six months ago: if you add a treatment or an allergy today, the question is put to you again — once per change, and never on mere display: opening your card, reading it and leaving asks you nothing. It is also put again if this policy changes substantially.
It is your choices that are uploaded, never the data they protect. The register records that you granted or declined the "health data" purpose; the contents of your health card do not leave your device (see § 6).
Where no readable decision exists, the app treats you as having not consented: the default is closed.
One consequence to know about. Answering "Withdraw" to the question asked after saving your health card erases your body measurements (age, height, weight) from the device: that is what withdrawing this permission has always carried. Your health card itself remains saved.
| Purpose | What it allows | Sensitive data? |
|---|---|---|
| Navigation / location | Map, on-trail tracking, hike recording | Precise geolocation |
| Social sharing | Pseudonymous leaderboards, activity feed, community contributions | Nickname |
| Advertising | Personalised ads. If declined, ads remain but become non-personalised | Advertising identifier |
| Health data | Heart rate, phone health reading, body measurements, upload of effort measurements — optional | Yes — Article 9 GDPR |
A separate decision governs Google's and Apple's automatic backup. It is declined by default, before you have even seen the question.
Every processing operation rests on a named legal basis:
| Purpose | Data | Legal basis |
|---|---|---|
| Guiding you on the trail: map, navigation, hike recording | Precise geolocation, processed on the device | Consent — Art. 6(1)(a), plus the OS permission |
| Recovering your progress on another device | Progress, packing checklist | Performance of the requested features — Art. 6(1)(b) |
| Keeping your hikes and improving trail tracks | GPS tracks, pseudonymised | Consent — Art. 6(1)(a), plus the OS permission |
| Keeping your walking journal | Text, date, stage, and the photos' reference — never the image file | Performance of the requested features — Art. 6(1)(b) |
| Assessing the feasibility of a future trek | Effort measurements of past hikes | Explicit "health data" consent — Art. 9(2)(a) |
| Providing support and fixing failures | Device technical record, crash reports | Legitimate interest — Art. 6(1)(f) |
| Handling your feedback and your requests | Feedback text, rating, trail concerned | Consent — Art. 6(1)(a) |
| Funding the app through advertising | Advertising identifier, IP address, ad interactions | Consent — Art. 6(1)(a) and the ePrivacy Directive |
| Showing the map and the weather when you are online | IP address, coordinates of the requested point | Legitimate interest — Art. 6(1)(f) |
The identifier your data is stored under. On first use, the app opens an anonymous account for you with Firebase Authentication: a technical identifier, assigned automatically, with no name and no email address. Your progress, your packing checklist and your effort measurements are stored under that identifier. It carries neither civil identity nor advertising identifier.
In-app purchases. Purchases (trails, subscription, content) are processed by the App Store or Google Play. We never receive any payment data.
What we do not do: no analytics active by default, no behavioural profiling, no automatic calls to emergency services, and no transmission of your health data to anyone.
Health data is a special category: the law protects it more strongly than other data. This covers heart rate (Bluetooth chest strap or the phone's health reading), your body measurements, and the contents of your emergency card: blood type, allergies, treatments, medical history.
Accordingly:
Two limits we would rather state. On iPhone, an app's preferences cannot be excluded from iCloud by its publisher: your stage balance and your settings may therefore end up there — never the medical card, which lives in a separate, excluded folder. Furthermore, transferring from an Android phone to a device of another brand follows recent rules that the app does not yet declare; we will do so as soon as possible.
StepWays embeds the Google AdMob SDK. Three formats, and no others: banners; rewarded videos you choose to watch, which open 24 hours without advertising; and a full-screen ad, at most once per half-hour of use of the app.
Your choice is collected through Google's consent platform (UMP). In the European Economic Area, the consent form is shown before any ad request; a permanent button in Settings > Privacy lets you reopen that choice at any time. On iPhone, the system's "App Tracking Transparency" prompt is shown in addition to that form.
If you decline personalisation, ads remain but become non-personalised: the app then explicitly requests non-targeted ads. The AdMob SDK may automatically collect your IP address, the device advertising identifier, your ad interactions and diagnostic data.
When advertising disappears. Never during the hike: while you are walking, no advertising is shown, in any format. Nor is any shown if you purchased the trail concerned, if your subscription is active, during the 24 hours opened by a rewarded video, or in showcase mode.
Recording a hike means following your position even when the screen is off: without that, the track stops as soon as you put the phone in your pocket. The app therefore requests background location permission.
Real-time position sharing is not active in this version. The app contains the screens and the code for sharing your position with relatives or a group, but no action in the app triggers them to date, and our server security rules refuse those writes. None of your positions is therefore published to our servers. The day this feature is opened, this policy will be updated beforehand, and your consent will be requested.
Your data is entrusted to the following technical providers, exclusively for the purposes described above:
| Recipient | Role | Data concerned |
|---|---|---|
| Google Ireland Ltd / Google LLC — Firebase Authentication | Processor | Anonymous account identifier; where applicable, Google or Apple sign-in if you choose it |
| Google — Cloud Firestore | Processor (hosting) | Progress, packing checklist, effort measurements, pseudonymised GPS tracks, journal entries (without the photo files), the register of your consents, device technical record, feedback |
| Google — Firebase Crashlytics | Processor | Crash reports, OS version, device model |
| Google — Firebase Analytics | Processor | No data by default: analytics is switched off at start-up and only activates with your consent |
| Google — AdMob | Advertising partner | Advertising identifier, IP address, ad interactions |
| Google Cloud Storage | Processor | Download of trail data and updates — download only |
| OpenStreetMap Foundation | Map tile provider | IP address, requested tiles |
| Open-Meteo | Weather provider | IP address, coordinates of the requested point — no account, no key |
| Apple / Google Play | Payment collection | Handled by the store; we receive no payment data |
Google processing is covered by the Google Data Processing Terms.
Google and Firebase services may process data on servers located in the United States. These transfers are governed by:
For more information: firebase.google.com/support/privacy.
| Data | Period |
|---|---|
| Website: email address, trail voted for, date and consent (and the free-text suggestion, if you wrote one) | Three years, then we ask whether you want to stay; without a reply, the address is deleted. The date of that check-in is recorded at the moment of the vote. Unsubscribe sooner at any time by writing to contact@only1cent.com. |
| Progress, packing checklist, effort measurements on our servers | As long as the anonymous account exists. Deleted on your erasure request. |
| The register of your consents on our servers | As long as the anonymous account exists. It is proof: it has to outlive the decision itself, or it proves nothing. Deleted with the account. |
| Anonymous account identifier | As long as the account exists; erased with it. |
| Device technical record | Rewritten each time you return to the app; deleted with the account. |
| Map and weather caches, on your phone | 7 days — recomputable data, purged automatically. |
| Local copy of already-synced contributions | 30 days after synchronisation. |
| Completed sync queue, on your phone | 7 days. |
| Crash reports | Kept by Firebase Crashlytics under Google's retention policy (90 days). |
| Pseudonymised GPS tracks on our servers | As long as the anonymous account exists. Deleted on your erasure request. |
| Journal entries on our servers (text and photo references) | As long as the anonymous account exists. Deleted with the account or on your request. |
| Medical data: medical card, health data, emergency contacts | On your phone, under your sole control. Removed with the app or by erasing your data. |
| Your journal's photo files | On your phone, under your sole control. They disappear with the app, or with the phone. |
Under the General Data Protection Regulation you have the following rights:
Erasure from the app. The settings offer deletion of your data: it purges the local database, the caches and your consent decisions on the device, and issues a request to delete the documents linked to your identifier on our servers.
To exercise any other right, write to contact@only1cent.com. We will reply within 30 days. As the app does not know your name, we may ask for your technical identifier in order to locate your data.
You also have the right to lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr), or with the supervisory authority of your own country.
StepWays is not directed at children under 15 and offers no content intended for them.
We do not knowingly collect data about a child under 15. If you are a parent or guardian and believe your child has provided us with data, write to contact@only1cent.com so that we can delete it.
We may update this policy. Any substantial change is published before it takes effect, and results in:
Any functional change that would alter what the app transmits — active analytics, photo synchronisation, position sharing actually opened — requires this text to be updated first.
For any question about this policy or about exercising your rights:
We undertake to answer any request within 30 days.