Privacy Policy

Next Step is a companion app for eating disorder recovery. This policy explains what data the app and its optional Cloud Backup account collect, how it's used, who can see it, who it's shared with, how long it's kept, and the choices you have. We've tried to write it plainly, and to be clear about the limits too.

Consumer Health Data Privacy Policy

Our Consumer Health Data Privacy Policy describes the consumer health data we collect, how we use and share it, and how to exercise your rights over it.

Who operates Next Step

Next Step is operated by Cipher Haus, LLC, a Delaware limited liability company ("we", "us"), the party responsible for the data described here. You can reach us at [email protected].

The short version

• You can use Next Step without an account. Your recovery data then stays on your phone.
• Crash reporting is off unless you choose to share. The app asks the first time you open it. If you share, it sends technical details when something goes wrong, not your reflections or photos. You can change your choice in Settings.
• Cloud Backup is optional. If you use it, your data is stored on our server. It's protected in transit, but it isn't end-to-end encrypted, so our service can read it.
• If you connect with a clinician, they see the parts you allow. Your meal and snack check-ins and your questionnaires are shared by default when you connect; you can change that.
• We don't sell your data. Next Step has no ads and doesn't track you across other apps or websites. The only usage and performance data it sends is the crash and performance reporting described below, if you choose to share it, and, on Android, the diagnostics Google's ML Kit sends.
• Some things aren't removed the way you might expect. For example, if you revoke a clinician's access, your messages with them are hidden but stay on our server until one of you deletes your account. And if a clinician deletes their account, their messages stay in your conversation with them, and questionnaires they sent you stay with you. The details are below.

If you don't have an account

Next Step works fully offline. Without an account, everything you enter is stored only on your phone, in the app's private storage:

• your check-ins: when they happened, how each one went, your answers to check-in questions and anything you write;
• photos you choose to add to a check-in;
• your meal and snack schedule, optional Nourishment Bridge check-ins, Challenge Ladder steps (including the names of any support people you add), recovery goals and your own check-in questions;
• your settings, including reminder choices.

The app also keeps up to three automatic copies of its database. Each is made just before an app update changes how the data is stored, so the app can recover if an update goes wrong. If you restore one, the app keeps the data it replaced until the app next opens, so you can undo the restore.

Next Step doesn't add its own encryption to this data, so your phone's passcode or screen lock matters. The app marks its database and photos so they're left out of iCloud backups on iPhone, and out of Google backups and device-to-device transfers on Android. On iPhone, this is set each time the app starts, and it stays in place when you erase the app's data. Next Step doesn't store your recovery data in iCloud. This also means your data won't move to a new phone on its own: use Cloud Backup, or a backup file and a photo ZIP, for that.

If you export a backup file, a copy stays in the app's temporary cache until your phone clears it. The photo ZIP is removed from the cache once you've shared or saved it. Where you save or send a file after that (for example, iCloud Drive or email) is up to you. The photo ZIP isn't encrypted, so anyone who opens it can see your photos. It also holds a list of the photos (next-step-photos.json): when the ZIP was made, and each photo's file name and ID. A photo's ID includes the exact time its check-in was started, or the time you logged a past meal. For a photo that answers a check-in question you or a clinician added, the ID also includes when that question was created. Each photo's file name shows the date, the meal or snack, and what the photo is (for example, 2026-10-06_BREAKFAST_Plate.jpg). For a photo question you or a clinician added, that's the question's wording. File names don't show the time. The app uses the list to put photos back with their check-ins (see Photos). When a restore ends, the app deletes its own copy of the ZIP. If the app closes during a restore, that copy can stay in the app's temporary files until your phone clears them.

Check-in reminders are scheduled on your phone. Nothing is sent from a server. They're off until you turn them on, and by default the notification only says "A check-in is ready when you are."

What leaves your phone without an account

Nothing from Next Step itself, unless you choose to share crash reports. If you do, the app sends crash and error reports, with the performance samples and session counts described under Crash reports. Separately, if you've allowed your iPhone or Android phone to share diagnostics with app developers, Apple or Google may pass us crash information about Next Step; that's controlled in your phone's settings, not in Next Step. The app doesn't contact our server at all unless you create an account or sign in. Links you open from the app, like these pages, open in your browser, and the crisis-line Call and Text buttons open your phone's own phone or messages app.

Crash reports

Crash reporting is off unless you choose to share. The first time you open the app, it asks "Share crash reports?". Until you choose Share crash reports, the app doesn't start its crash-reporting tool at all, so nothing is sent. If you choose Not now, it stays off and the app doesn't ask again. If you had the app before our October 2026 update, it asks you once; if you'd already turned crash reporting off, it stays off and isn't asked.

If you choose to share, then when the app crashes or hits an error, it sends a report to our error-monitoring provider, Sentry, which receives it in the United States. A report contains:

• what went wrong, and where in the app's code;
• your phone model, its operating system and the app version;
• device details such as language, time zone, memory, free storage and whether the app was in the foreground;
• a short trail of what happened just before, such as buttons tapped, the fact that the app logged a message (but not what the message said) and the server's name for any request;
• a random ID created for this installation of the app.

Reports don't include your name or email address. A report about a failed photo upload can occasionally include your account ID, and the random ID connects reports from the same installation, so they're pseudonymous rather than anonymous. We've set them up to leave out screenshots and what's on screen, the contents of requests, sign-in details, IP addresses and app or browser details, and anything after the server's name in a web address.

If you share, the app also sends a small sample of performance measurements (about 1 in 10), such as how long the app took to start, filtered in the same way, and may send counts of app sessions so crash rates can be worked out. Session counts, and reports of crashes in the phone's own system code, are made by Sentry's code on your phone, so our filters don't reach them.

Sentry receives the IP address a report comes from when it arrives, from the phone or computer that sends it. For reports made by our code, we tell Sentry not to add it to the report.

Our server sends its own error reports and performance samples to Sentry, and the clinician portal sends error reports. We remove request contents, sign-in details, IP addresses and app or browser details from them. Web addresses are cut to the server's name, except that a server report can name the path of a request to our server (without anything after a "?"). For System Console requests, that path can include an account's internal ID.

To change your choice: open Settings (the gear button on Home), then Privacy & Diagnostics, and use the Crash & Error Reporting switch. Turning it off stops reports straight away, and it stays off each time you open the app. This setting covers reports from your phone, not our server's or the portal's own reports. Our server doesn't keep your choice. Restoring a backup file or erasing the app's data (Settings, Data) keeps your choice.

If you create a Cloud Backup account

Cloud Backup is optional. You need it to back up to our server, restore on another phone, connect with a clinician and send messages. With an account, we store:

• Account details: your name (or "Recovery Companion" if you leave it blank), your username (if you don't choose one, the part of your email address before the @), your email address, and your password, stored only as a secure hash. We also keep whether your email address is verified, your two-factor settings if you turn them on, and your personal connection code once you've opened Care Team.
• Your recovery data, synced from your phone: check-ins with their timings, answers and reflections, and any affirmation you build during one; Nourishment Bridge check-ins; your meal and snack schedule, including the days each time repeats on, its nourishment bridge setting and when it was last changed; Challenge Ladder steps; recovery goals; your check-in questions; most of your settings; and items you've deleted but that are still in the trash.
• Photos you added to check-ins, in private cloud storage.
• Messages and meal comments between you and clinicians you connect with, with any reactions and when they were read. If you delete a chat on your side, we keep a note of how far you deleted it, so it stays deleted on all your devices.
• Practice chat: messages that clinicians in a practice, and you, write in a practice chat about you.
• Questionnaires a clinician sends you: the questions as they were sent, any note the clinician added, your answers and photo answers, and when it was sent and completed. Answers you've started but not sent are kept only on your phone. Photo answers are kept in private cloud storage, like check-in photos.
• Your connections: which clinicians you're connected with, the status of each connection, and what each one can see.
• What a clinician writes about you: notes a connected clinician keeps about you (general notes and session notes), and a nickname they can give you in their own client list. Only that clinician can read them. You can't see them in the app, and other clinicians, their practice and our staff can't see them either.
• Your confirmations: when you confirmed that you're 13 or older, when you agreed to this policy and our Terms (and which version), and when you gave your separate consent under our Consumer Health Data Privacy Policy (and which version).
• A record of clinician access: when a connected clinician opened or changed an area of your data (who, which area, and when, but not the content).

The first time you sign in on a phone, the app uploads the photos on it, including ones you added before you had an account. After that, it syncs when you make changes and when you tap Sync Now. Its first sync downloads your account and merges it with what's on the phone before it uploads the rest. A photo you restore from a photo ZIP is uploaded only if your account doesn't already have that photo of the check-in. If it does, the photo in your account is kept. The starting check-in questions aren't uploaded unless you've changed them. A few things aren't kept on our server. Your crash-reporting choice and your check-in reminder settings are sent when the app syncs, but our server doesn't store them. The art styles' Decoration and Plain text options never leave your phone.

We don't collect your phone number, date of birth, location or contacts, and the app doesn't use your microphone. The app asks you to confirm that you're 13 or older, that you agree to this policy and our Terms, and, separately, that you consent to our Consumer Health Data Privacy Policy. It asks on the sign-up screen; on the set-password page, if our staff created your account; and, for an account that hasn't confirmed them yet (such as one from before October 21, 2026) or confirmed an older version, the next time you sign in or open the app. Until you confirm, current versions of the app don't back up that account's data. We store your answers with the time and the version you agreed to.

If our staff create an account for you (for example, at a practice's request), they enter your name and email address, and we email you a link to set your password.

If you use Next Step as a clinician

We also store your clinician profile (display name, credentials, practice or group, and role title), your connection code, practices you create or join (name, description, website and join code), the check-in question sets and questionnaires in your library, and the notes and nicknames you write about your clients. When you invite a client by email or connection code, your Sent invitations list keeps a partly hidden label (the first character of the address and its domain, or the first two characters of the code) and when you sent it; we also keep a one-way coded form of what you typed, so sending it again updates the same entry, and never the whole address or code. An entry is removed when you remove it, when that client approves the request, or 90 days after you last sent it. The clinician portal keeps you signed in by storing a sign-in token in your browser for up to 12 hours, and signs you out after about 20 minutes without activity. In the clinician portal, and on the set-password page of a clinician account our staff created, you're asked to agree to this policy and our Terms; in the app, you're asked the same three things as everyone else.

Who can see your data

You

Everything you've synced, on any phone where you sign in.

Clinicians you connect with

• A connection only starts when one of you sends a request using a code and the other approves it.
• You choose what each clinician can see, area by area, in the Care Team tab. Only you can change it.
• Meals & Photos (None or View) is set to View by default. With View, a clinician can see your meal and snack check-ins, including your answers and anything you wrote, your Nourishment Bridge check-ins, and their photos. They also see the name of the meal or snack time each check-in belongs to, as you named it in your schedule (for example, "After-school snack"). They don't see the rest of your schedule. If you rename a meal or snack time, a clinician who has your meal history open in the portal gets the new name the next time the page refreshes. They never see the affirmations you build during a check-in, whatever access you give: those are only for you.
• Questionnaires (None or View) is set to View by default. With View, a clinician can send you questionnaires and see your answers, your photo answers, and the scores and comparisons the portal works out from them, and export them. With None, they can't send you new ones or see any answers. Questionnaires already sent stay with you either way, and switching back to View shows the clinician all your answers again. A questionnaire can be one the clinician or their practice wrote, or one of the System questionnaires we provide in the portal for every clinician to use.
• Challenges, Goals and Templates (None, View or Edit) are set to None by default. With Edit, a clinician can add, change and delete items in your account, and send you check-in question sets they manage.
• You can change the defaults for new connections in Settings, under Clinician Access Defaults. Questionnaires isn't one of these defaults: it always starts at View, and you can change it for each clinician in Care Team.
• Clinicians see your account name, never your email address.
• Messages and meal comments are seen by both of you. Either of you can delete a chat on your own side (Delete chat). That removes the messages from your side only, on all your devices; the other person keeps their copy, and new messages after that show as usual. Practice chats don't have Delete chat; you can delete single messages you wrote.
• If a clinician deletes their account, you keep your whole conversation with them, both people's messages and meal comments, to read only. It's listed in Care Team under "Chats with a former clinician", and nobody else can read it. Their messages in a practice chat about you stay too, shown as from "A former clinician", unless they were the practice's only member, in which case the practice and its chats are deleted. Questionnaires they sent you stay with you, with your answers, shown as "Sent by a former clinician". This applies to connections that were active when they deleted their account. If your connection with them had ended, or was never approved, your conversation with them is deleted.
• If your clinicians belong to a practice together, they can use a shared practice chat about you. Only you and clinicians in that practice whom you've approved can see it.
• Check-ins you delete aren't shown to clinicians once the deletion syncs. Comments already made about a check-in stay in your conversation after you delete it, with the check-in's label (its name and date), but the clinician can no longer open the photo it was about.

We don't check clinicians' identities, licences or credentials. Anyone with a Next Step account can set up a clinician profile, so only connect with someone you know and trust.

To stop sharing with someone, open Care Team and tap Revoke Access. They lose access to your data straight away. In the clinician portal, your meal history and your conversation clear from their screen within about 20 seconds, or as soon as they return to that browser tab, and the portal tells them their access has ended. Other pages they already have open can stay on their screen until they reload the page. A photo link they already opened keeps working for up to 15 minutes. Your message history with them is hidden from both of you, but it stays on our server until one of you deletes your account. Questionnaires they sent you stay with you, but they can no longer see them. If you reconnect later, your earlier messages and the access settings you'd chosen for them come back; the defaults for new connections don't apply.

We keep a record when a connected clinician opens your check-ins or photos, reads meal comments, opens your questionnaires and answers, sends you a questionnaire or cancels one, opens or writes their notes about you, or opens, adds, changes or deletes your Challenge Ladder steps, goals or check-in questions. Reading your messages or the practice chat isn't recorded, and neither is a renamed meal or snack time reaching an open portal page. There's no screen for the record in the app yet: email us for a copy. If saving a record fails, that access isn't recorded.

Cipher Haus, LLC

Cloud Backup data isn't end-to-end encrypted. Our server can read it, which is what lets us sync it and show it to the clinicians you choose. We only access your data to run Next Step, fix problems, answer your requests, or where the law requires it.

Our staff (the System Console)

Our staff use the System Console, our administration tool, to run the service. Each staff account has a role that sets which parts of the console it can see or change, and it must have two-factor authentication turned on before any part other than its own profile opens. Depending on their role, staff can see:

• account details: name, username, email address, whether it's confirmed, your confirmations (above), your connection code and whether the account is active or suspended;
• clinicians' profiles and practices, with their members;
• connections: who is connected with whom, each connection's status and what each clinician can see;
• photos in cloud storage (check-in, Nourishment Bridge, check-in question and questionnaire photos), which they can open;
• questionnaires sent to clients, including the questions and your answers. This doesn't depend on your Care Team settings.

Staff can also create accounts (we then email a link to set the password), move an unused invite to a different email address, correct a name, username or connection code, edit a clinician's profile, suspend a clinician's account, send a connection request (which you still have to approve) or end a connection, manage practices and their members (deleting a practice deletes its practice chats), cancel a questionnaire, remove a photo or a photo answer, and delete a client's account. The System Console has no way to read messages, practice chat, your check-ins and reflections, or clinicians' notes. Each thing staff do in the console is recorded (which staff account, what kind of action, on which account or item, and when; not what they saw). If saving a record fails, that action isn't recorded.

How we use your data

• To provide the features you use: backup, sync and restore, clinician connections, and messages.
• To send account emails. There are six kinds:
  • a code to confirm your email address;
  • a link to reset your password, when you ask for one;
  • if you ask for a reset before your address is confirmed, an email explaining why we can't send a link;
  • if our staff created an account for you, a link to set your password, which works for 7 days;
  • if our staff then move that unused invite to a different address, a note to the first address saying its link no longer works;
  • a connection request from a clinician. A clinician can type any email address, so this email can go to someone who doesn't have a Next Step account. Its subject line doesn't name the clinician or say what the app is for; the email itself gives the clinician's name and, if they have one, their connection code. Only a clinician whose own email address is confirmed can send one, at most 20 a day, and only one a day to the same address.
• To keep the service secure, for example by limiting repeated sign-in attempts. For this our server briefly keeps IP addresses in memory; it doesn't write them to its logs or database.
• To find and fix bugs, using crash reports.
• To answer you when you write to us.

We don't sell your data, and we don't use it, or share it with anyone, for advertising, marketing or data mining. Next Step doesn't send your recovery data to any AI service. We don't use it for profiling that leads to decisions about you. We don't use it to train AI models, including large language models, and we don't sell or share it for anyone else to do that.

Who we share data with

We share your data with clinicians you choose to connect with, as described above. We also use these service providers to run Next Step:

• Render hosts our server and database: your account and all synced data, plus our server logs.
• Cloudflare stores photos and the records of deleted accounts (Cloudflare R2).
• Resend sends all six kinds of account email listed above. It receives the address each one goes to and the email, including any code, link, name or connection code in it. For a connection request, that can be the address of someone who doesn't have an account.
• Sentry receives crash reports and performance samples from the app (only if you choose to share them) and our server, and error reports from the clinician portal, as described under Crash reports.
• Google, on Android: the app includes Google's ML Kit, which it uses only to scan a clinician's QR code. The scan itself happens on your phone. Google says ML Kit sends it information about the device and app, an ID for the installation, and performance measurements, for diagnostics and usage analytics.
• GitHub hosts these web pages (see This website).

We don't share your data with anyone else, except where the law requires it.

Security

• The app talks to our server over HTTPS.
• Passwords are stored only as hashes (argon2id), never as the password itself.
• In the app, your sign-in renews itself when the app syncs, for up to 180 days from when you signed in or last changed your password. In the clinician portal, a sign-in lasts up to 12 hours, and the portal signs you out after about 20 minutes without activity. Signing out or resetting your password signs you out on every device. Changing your password keeps you signed in on the device you used and signs you out everywhere else.
• Two-factor authentication with an authenticator app is available, and optional. Our staff's System Console accounts must have it turned on.
• Repeated sign-in attempts are limited.
• Photos are kept in private storage. The app and the portal get links to them that expire after 15 minutes; until then, anyone holding a link can open that photo.
• A backup file you export is encrypted on your phone with a passphrase you choose (AES-256-GCM). The passphrase is never stored or sent to us.

No system is completely secure, and some of these protections have limits: Cloud Backup isn't end-to-end encrypted, data on your phone isn't encrypted by the app itself, and the photo ZIP export isn't encrypted.

How long we keep it

• On your phone: until you delete it, erase the app's data or uninstall the app. Deleted check-ins, schedule items, goals and Challenge Ladder steps stay in the app's trash (Recently Deleted) for 30 days, then are permanently removed from the phone. For check-ins and journal entries, everything you wrote or photographed is erased from the phone at 30 days; if you use Cloud Backup, a record with no content (just when it was made and deleted) stays on the phone until it next backs up. Delete Forever (for schedule items, goals and Challenge Ladder steps) removes an item from the phone at once. The app keeps its three most recent automatic database copies and, after you restore one, the data it replaced until the app next opens.
• Your account and synced data: until you delete your account. Accounts don't expire.
• Items you delete, on our server: a deletion reaches our server the next time your phone syncs. Once 30 days have passed since you deleted an item, it's permanently removed the next time your phone sends a change to our server. If that doesn't happen first, an hourly clean-up removes it about 32 days after you deleted it. A schedule item, goal or Challenge Ladder step you remove with Delete Forever is removed from our server at your phone's next sync. If you changed the same item on another device after deleting it, or brought it back from a backup file, the newer version is kept. Once an item has been permanently removed, it doesn't come back.
• Clinicians' Sent invitations: each entry is kept until the clinician removes it, the client approves the request, or 90 days after it was last sent.
• Photos in cloud storage: once the change syncs, we stop giving out links to a photo you remove, or to one on a check-in you delete. A photo you remove from a check-in is deleted from cloud storage about a day later. The photos of a check-in you delete stay in cloud storage, shown to no one, until the check-in is permanently removed (about 32 days after you deleted it), so that it keeps them if it comes back because you changed it on another device. A few photos stay until you delete your account. These are photos you removed before our October 2026 update, and photos on check-ins permanently removed before then. A photo removed from a Nourishment Bridge check-in on its own also stays. Rarely, so does a photo removed before its upload finished, or on a phone whose clock is behind. If you'd like those deleted without deleting your account, email us (see Your choices and rights).
• Messages and meal comments: until the client in the conversation deletes their account, or until nobody can see them any more. A message is erased from our server once both of you have deleted the chat on your side since it was sent, or, in a chat with a former clinician, once the client deletes the chat. When a clinician deletes their account, their conversations with clients they were connected with at the time stay with those clients (see Clinicians you connect with); messages the client had already deleted on their side are erased then, and so are conversations over a connection that had ended or was never approved. A meal photo that only erased messages pointed to is deleted from cloud storage about a day later, unless a check-in still uses it. If you delete a single message, its text is removed, but a record that it existed stays: when it was sent, and any check-in summary or photo it pointed to. Revoking a clinician hides your messages but doesn't delete them, and they come back if you reconnect.
• Practice chat: until the client it's about deletes their account, or the practice is deleted. A clinician's account deletion leaves their messages in it.
• Questionnaires and answers: until the client deletes their account. A clinician's account deletion, or the end of a connection, doesn't remove them.
• Clinicians' notes and nicknames: until the client or the clinician deletes their account. Ending a connection doesn't delete them, and they come back if you reconnect.
• Your confirmations (age, policy and Terms, health-data consent): until your account is deleted.
• The record of clinician access: until your account is deleted.
• Email codes and links: email-confirmation codes expire after 24 hours, password-reset links after 1 hour, and set-your-password links after 7 days.
• Connection requests sent by email: to apply the daily limits, we keep a pseudonymous code made from each address a clinician sends a request to (with a secret key, not the address itself) for two days. The code goes sooner if the clinician deletes their account.
• A record that an account was deleted: when an account is deleted, we keep a small record of it, so that restoring a database backup can't bring the account back. It holds the account's internal ID (a random ID), whether it was a client, clinician or staff account, how it was deleted (in the app, by our staff or on request) and when. It doesn't hold an email address, name or any health data.
• Our server logs record each request's type, its path (without any query), the result and how long it took. They don't include IP addresses or what you sent. For requests made in our System Console, the path can include the internal ID of the account or item concerned. Render, our host, may keep its own records of requests, which can include IP addresses and full web addresses.
• Copies our providers hold, such as database backups and logs at Render, crash reports at Sentry and email records at Resend, are kept until those providers delete them under their own retention settings.

Your choices and rights

Wherever you live, you can:

• Find out what we hold. Ask us whether we hold data about you, and for access to it.
• See and correct your data. You can see and change most of it in the app. You can change your name and email address in Cloud Backup, under Profile. Changing your email asks for your current password, and we email a code to the new address so you can confirm it. Email us to correct anything else you can't change yourself.
• Get a copy. Export an encrypted backup file and a photo ZIP from the Backup tab. Some data is only on our server and can't be exported in the app yet: messages, meal comments, practice chat, your connections and the record of clinician access. Email us and we'll send you a copy in a common, machine-readable format. We only send a copy to an email address you've confirmed (see Confirming your email address).
• Delete your data. Delete your account in the app or by email (see Delete your account), and erase the data on your phone in Settings, under Data. To delete specific data without deleting your account, such as a removed photo that's still in cloud storage, email us.
• Stop sharing or withdraw consent. Change or revoke a clinician's access in Care Team (including their access to your questionnaires), turn off crash reporting, or stop using Cloud Backup and delete your account. There's no switch in the app to withdraw your consent under the Consumer Health Data Privacy Policy on its own; email us. If you withdraw consent by email, we'll stop the processing it covered as soon as we can, and within 15 days.
• Opt out of sale, targeted advertising and profiling. We don't do any of these, so there's nothing to opt out of.
• Appeal if we turn down a request.

To make a request, email [email protected] from the address on your account. We'll reply to that address to confirm the request came from you before we act on it. If that address was never confirmed, we can still delete your account or correct your details (other than your email address) this way. To get access to your data or a copy of it, confirm your address first: sign in, enter the code we email you, and then write to us again. You don't need an account to ask us something. We'll respond within 45 days. If we need longer, we'll tell you why within those 45 days, and take up to 45 more. Requests are free.

If we turn down a request, we'll explain why. You can appeal by replying with "Appeal" in the subject line, and we'll answer in writing within 45 days. If you're not satisfied with the answer, you can contact your state attorney general (see our Consumer Health Data Privacy Policy).

Children

Next Step isn't meant for children under 13. To create a Cloud Backup account you must be 13 or older. The app asks you to confirm this with a checkbox (on the sign-up screen, on the set-password page if our staff created your account, or the next time you sign in if you haven't confirmed it yet), and we record when you did; we don't verify it. If we learn that an account belongs to a child under 13, we'll delete it. If you're a parent or guardian and think your child under 13 has an account, please email us.

The app itself can be used without an account and doesn't ask anyone's age. If someone chooses to share crash reports, it sends the reports described above.

This website and tracking

These pages are hosted on GitHub Pages. GitHub logs the IP address of visitors. The pages have no cookies, scripts, analytics or advertising.

Next Step and these pages don't track you across other apps or websites, and no other company tracks you across sites through them. Because there's no tracking to switch off, a browser's Do Not Track signal doesn't change anything here.

Changes to this policy

If we change this policy, we'll publish the new version on this page and update the "Last updated" date above. We won't apply a material change, such as a new use of data we already hold or a new kind of recipient, to data we already hold without your consent.

Contact us

Questions, data requests or concerns: [email protected]. Security issues: [email protected]. Help with the app: Support.