Privacy Policy

For the StepIsle app and the website stepisle.de. Last updated: October 2026. The German version is legally binding.

The short version

• StepIsle shows no ads and uses no tracking or analytics tools. The website sets no cookies.
• The app only reads your steps with your permission. They are processed on your iPhone and only backed up to your own private iCloud.
• There is no separate server. The app uses Apple's iCloud service (CloudKit) to back up your island and share it with friends.
• Your data is never sold or used for advertising.

1. Controller

The controller responsible for processing personal data under the General Data Protection Regulation (GDPR) is:

There is no data protection officer, as there is no legal obligation to appoint one. If you have any questions about privacy, just write to the email address above.

2. The StepIsle app

2.1 Steps from Apple Health and the motion sensor

StepIsle is a game in which your steps drive your progress. To do this, the app reads your step count from Apple Health (which also includes the steps from your Apple Watch) and from your iPhone's motion sensor, with your permission. Only the step count is read, no other health data. The app does not write anything to Apple Health.

Step counts may be health data within the meaning of Art. 9 GDPR. They are processed on your iPhone and are not transferred to me or to third parties. The only exception is the backup in your private iCloud (section 2.2). When your island is shared (section 2.3), an exact step count is never transferred.

The legal basis is your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you give in the iOS permission prompts. You can withdraw it at any time: in the Health app via your profile picture under “Apps” › StepIsle, and in Settings under Privacy & Security › Motion & Fitness. Without this permission, the app does not count any steps.

2.2 Backup to your iCloud

If you are signed in to iCloud on your iPhone, the app backs up your game to the private iCloud database of your Apple Account. This lets you keep playing on a new device. The backup contains:

• your island with its buildings, supplies and progress,
• your player name, your island's name and your character's appearance,
• the step counts already credited per hour (so steps are not counted twice after switching devices) and your total steps in the game,
• the device type (such as “iPhone”), a random device identifier, the app version and the time of the backup.

I have no access to this private database. It is stored by Apple (section 4). The legal basis is providing the game you use (Art. 6(1)(b) GDPR) and, for step counts, your consent (Art. 9(2)(a) GDPR). You can stop the backup by turning off iCloud for StepIsle in your iPhone's settings (Settings › your name › iCloud). It is deleted with “Delete island and account” in the app (section 2.6).

2.3 Sharing your island with friends

So that friends can visit you, the app uploads a cleaned-up copy of your island to StepIsle's public iCloud database. This only happens if you are signed in to iCloud, and only while the app is open. The copy contains:

• your island code, your player name and your island's name,
• the island's shape, buildings, decorations, animals, the level of your hut and your character's appearance,
• your steps only as a rounded milestone, such as “10,000+”,
• the app version and the time of the last update.

It does not contain your exact step count, step counts per hour, your supplies or your Apple Account. Anyone who knows your island code can look at your island. I can view the public database through Apple's CloudKit console, for example to review reports. As with all iCloud records, Apple stores an identifier with each record that is unique to StepIsle. It does not reveal your Apple Account or your email address.

The legal basis is providing the visiting feature (Art. 6(1)(b) GDPR). The islands you save as friends are only stored on your device and in your Apple Account's iCloud storage. If you don't want your island to be shared, turn off iCloud for StepIsle. The copy remains stored until you remove it with “Delete island and account”.

2.4 Reporting islands

You can report another player's island, for example because of an inappropriate name. The island code, the reason and the time are stored. I only use reports to review content and remove inappropriate islands. The legal basis is my legitimate interest in a safe community in the game (Art. 6(1)(f) GDPR). Reports are deleted once they have been handled.

2.5 Other features

• Time: For seasonal decorations, the app requests the current time from www.apple.com. For technical reasons, Apple receives your IP address. No other data is sent (Art. 6(1)(f) GDPR).
• Required updates: When it starts, the app checks the public iCloud database to see whether an update is required. No data about you is stored in the process.
• Notifications: Notifications, such as when a building is finished, are created by the app on your iPhone. No push service is used. You can turn them off in the app or in iOS Settings.

2.6 Deletion

With “Delete island and account” at the very bottom of your profile, you delete your shared island and your backup in iCloud as well as the game on your device. If you delete the app without using this feature, the data in iCloud remains. You can ask me to remove your shared island at any time. You can also delete your private backup yourself in your iPhone's iCloud settings.

2.7 App Store

You download StepIsle from Apple's App Store. Apple processes data for this under its own responsibility, see Apple's Privacy Policy. If you have agreed in iOS Settings to share analytics with app developers, I receive aggregated statistics and crash reports from Apple that are not linked to you.

3. This website

The website is hosted on GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you visit it, GitHub processes technically necessary data, in particular your IP address, the date and time, the page visited and information about your browser. This is used to deliver the website securely and reliably. The legal basis is my legitimate interest in doing so (Art. 6(1)(f) GDPR). Learn more in GitHub's Privacy Statement.

The website sets no cookies, uses no analytics tools and loads no content from other providers. Fonts and images are served from the same server. Only when you click a link to the App Store do you leave the website and go to Apple.

4. Recipients and transfers to third countries

For iCloud and the App Store, Apple is a recipient of your data (for users in the EU: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). The website is hosted by GitHub, Inc. In both cases, data may be transferred to the USA. Apple and GitHub are certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). I do not share data with anyone else.

5. Your rights

You have the right to:

• access the data stored about you (Art. 15 GDPR),
• have incorrect data corrected (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw your consent with effect for the future (Art. 7(3) GDPR).

Just write to the email address in section 1. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in your country of residence or the authority responsible for me, the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

There is no automated decision-making or profiling.

6. Changes

If the app or the website changes, I will update this privacy policy. The version published here applies.