This Privacy Policy explains how IDEATOWEB LTD ("we", "us", "our") collects, uses and protects your information when you use the SipStep app for iPhone, Apple Watch, Android and Wear OS, and the website at sipstep.com (together, the "Service"). We are the data controller for the purposes of UK data protection law.

1. Information we collect

Account information

When you sign in with Sign in with Apple (iPhone and Apple Watch) or Sign in with Google (Android and Wear OS), we receive an account identifier from Apple or Google and, if you choose to share them, your name and email address. You may add a profile name and photo.

Hydration and activity data

• Drinks you log — the amount, drink type and time of each entry.
• Steps and distance read from Apple Health, used to show your activity and adjust your daily water goal.
• Activity sessions (a walk or run you record) — duration, distance, steps, pace, calories and, on Apple Watch, heart rate.
• Optional health profile — if you choose to enter it, your year of birth, sex, height and weight, used only to personalise your daily goals within safe limits.

Goals, settings and preferences

Your daily water and step goals, measurement units, theme, chosen language, and your notification and privacy preferences.

When you first open the app we ask what brings you to SipStep (for example drinking enough water, walking more or keeping an eye on your weight). If you answer, we store your answers to set up your Today screen, and we look at them only in total, across all users, to understand what people use SipStep for. The question can be skipped.

Social features

If you use the optional social features: the friends you follow and who follow you, friend requests, users you block, challenges you join, and any stories or profile photo you post. Stories are visible only to your friends and are removed automatically after 24 hours.

SipStep Teams

If you join a team run by a workplace, gym or club (see section 5): which team you joined, when, the group an admin puts you in, and whether your request to join is waiting for approval.

If you apply for SipStep Teams on behalf of an organisation, or are added as a team admin: your name, work email address, phone number (if you give it), the organisation's name and website, your message to us, your admin role, and when you last signed in to the team portal. The portal also keeps a log of what admins do in it, such as adding a challenge or removing a member.

Device and subscription information

• A push notification token, so we can send the reminders and notifications you enable.
• Your subscription status for SipStep Plus. Payments are handled by Apple or Google Play; we and our payment processor RevenueCat receive confirmation of your subscription but never your card details. If SipStep Plus is included by a team you belong to, we record that it comes from the team, not a payment.
• Basic technical information (such as app version and, on our servers, IP address in request logs) needed to operate and secure the Service.

2. Health data and Apple HealthKit

SipStep connects to the health service on your device — Apple Health on iPhone and Apple Watch, Health Connect on Android and Wear OS. This is optional on both platforms. The app works without it, and you choose which permissions to grant.
Apple Health (iPhone and Apple Watch)
With your permission, SipStep reads steps and distance from Apple Health and writes the water you log and the workouts you record back to Apple Health, so they count towards your Activity rings. Data obtained through HealthKit is used only to provide the app's features. In line with Apple's requirements, we never use HealthKit data for advertising or marketing, and we never sell it or share it with third parties for their own purposes. You can turn Health access on or off at any time in the iOS Health app.
Health Connect (Android and Wear OS)
With your permission, SipStep reads the following from Health Connect: steps, distance, exercise sessions, active and total calories, floors climbed, heart rate, resting heart rate, weight and height. We read these to show your activity alongside your hydration, to count workouts towards challenges, and to set a daily goal that suits you.
SipStep writes two things to Health Connect: the water you log, and the workouts you record in the app. Nothing else is written.
If you allow it, SipStep reads health data in the background, so a workout recorded on your watch counts towards your challenges without you opening the app, and reads your earlier history so longer-term views are complete. Both are optional. Without them the app still works, with history limited to the last 30 days.
Health Connect data is read on your device. Only the values needed to keep your progress, streaks and challenges in sync reach our servers. Data obtained through Health Connect is used only to provide the app's features. We never use it for advertising or marketing, and we never sell it or share it with third parties for their own purposes.
You can review or withdraw any permission at any time in Health Connect settings on your device, and removing SipStep removes its access.

3. How we use your information

• To provide the app and sync your data across your devices (iPhone, Apple Watch, Android and Wear OS).
• To send the reminders and notifications you switch on.
• To personalise your daily goals (using your optional health profile) within doctor-minded safe limits.
• To power optional social features — friends, challenges and stories.
• To manage your SipStep Plus subscription.
• To run SipStep Teams: letting you join a team, giving you SipStep Plus while the team's contract runs, running its challenges, and showing its admins the limited information described in section 5.
• To run the team portal for organisations: sending sign-in links and team emails, and invoicing.
• To keep the Service secure, prevent abuse, and comply with our legal obligations.

Our lawful bases are the performance of our contract with you (to provide the Service), your consent (for example, Health access and notifications, which you can withdraw at any time), and our legitimate interests in operating and securing the Service.

4. Who we share information with

We share data only with service providers who process it on our behalf to run the Service:

• Apple — Sign in with Apple, App Store payments, HealthKit and push notification delivery.
• Google — Sign in with Google, Google Play payments and Health Connect on Android.
• RevenueCat — to manage and validate your subscription.
• Google Firebase (Cloud Messaging) — to deliver push notifications.
• Bunny.net — to host profile images you upload.
• SMTP2GO — to send emails, such as team portal sign-in links and team notices.
• Stripe — to invoice organisations that buy SipStep Teams and take their payments. We never see card details.
• Our hosting provider for the sipstep.com servers and database.

Where you use social features, the limited profile information you choose to make visible (such as your name, photo and daily progress) is shared with the friends you connect with, according to your privacy settings.

If you join a SipStep Team, the limited information described in section 5 is shared with that team's admins, because you chose to join. We do not sell your personal data to anyone.

Some of these providers are based outside the UK/EU (for example in the United States). Where data is transferred internationally, it is protected by appropriate safeguards such as Standard Contractual Clauses.

5. SipStep Teams: what a workplace or gym can see

Some workplaces, gyms and clubs give their people SipStep Plus through SipStep Teams. Joining a team is always your choice: you enter the team's code or scan its poster, and the app shows you what the team will see before you join. Nobody can add you to a team without you.

What the team's admins can see about you

• Your profile name — not your photo.
• The group they put you in (for example a department) and the date you joined.
• Whether you were active this week — just yes or no, meaning you logged a drink or walked at least once.
• Your results in that team's own challenges, if you take part: your place, the number of days you completed, and whether you have met today's goal.

Admins also see totals for the whole team, such as how many members were active this month. They can download the information above as a spreadsheet.

What a team never sees

Your email address, your profile photo, what or how much you drink, your step counts or distance, your weight, height or age, your health profile, data from Apple Health or Health Connect, your friends, your stories, or anything about other challenges you take part in.

Leaving, and when a team ends

• You can leave a team at any time in the app, under Settings → Teams. Admins can also remove you. Either way, the team stops seeing you straight away and you are taken out of its current and upcoming challenges. Your SipStep account and history stay as they are.
• Your results in team challenges that had already finished stay in those challenges' results, and the team's activity log keeps a line saying that you joined or left.
• When the team's contract ends, SipStep Plus from the team ends and your account carries on as a free account. You stay listed in the team until you leave.

The organisation decides how it uses what its admins can see and is responsible for that use. If you have a question about it, ask your workplace, gym or club, or contact us.

6. Data retention and deletion

We keep your data for as long as your account is active. You can delete your account at any time from within the app — go to Settings → Delete account. Deleting your account permanently removes your account and all associated data from our servers, including your logs, activity sessions, goals, friends, challenges, team memberships and profile. Where a team's activity log mentions you, your name is replaced with "Former member". This action cannot be undone. Data written to Apple Health stays in Apple Health and is controlled by you in the iOS Health app.

You can delete your account from inside the app (Profile → Settings → Delete account) or, without installing anything, from sipstep.com/delete-account.

For organisations that use SipStep Teams, we keep the team, its admins' details and its activity log while the organisation is a customer, and keep invoices for as long as UK tax law requires. To close a team and have its data deleted, email us.

7. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. You can exercise most of these directly in the app; for anything else, contact us using the details below. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk. Our ICO registration number is ZC130233.

8. Children

SipStep is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date above and, for significant changes, provide notice in the app.

10. Contact us

IDEATOWEB LTD
Unit 82A James Carter Road, Mildenhall, Bury St. Edmunds IP28 7DE, United Kingdom
Company No. 16908716 · ICO Reg. ZC130233
Email: [email protected]