Consumer Health Data Privacy Policy

Why this policy exists

Stride Quest is a walking-rewards app made by Stride Quest LLC. It counts your steps, and under several state laws, including Washington's My Health My Data Act, Nevada's consumer health data law, and Connecticut's data privacy law, step counts and similar physical-activity measurements linked to you are "consumer health data." This policy explains exactly what health-related data we collect, why, who can see it, and the rights you have over it. It supplements our Privacy Policy and applies to all users, not only residents of those states.

The short version: we collect your step counts to run the rewards program you signed up for, we never sell them, and we never share them with advertisers.

The consumer health data we collect, and why

• Step counts from your device's motion sensors: short-lived raw step readings, your running step total for the day, automatically deleted after about 48 hours, and milestone records tied to your account.
• Step collections in your token history: each time you collect a token from your steps (one token for every 300 steps, up to 50 a day), your token history records that collection and when it happened. A day's collections show that your phone had counted at least 300 steps for each one, but they do not hold the step readings themselves.

We use this data only to:

• provide the service you requested, counting steps toward daily milestones and token rewards, and showing you your token history;
• run integrity checks that keep the rewards program fair (for example, detecting implausible step patterns).

Stride Quest does not ask for location permission and does not collect GPS or precise location from your device. The app does store your device's time zone setting to compute your local day for streaks and daily limits and to decide which optional bonuses are offered in your region; a time zone can indicate the general region your device is set to, but it is not GPS or precise location, and it is described in our Privacy Policy. We do not collect biometric identifiers, medical conditions, diagnoses, or any data from third-party fitness services (no HealthKit, Fitbit, Strava, or similar integrations). We do not use consumer health data for advertising, profiling for ads, or any purpose beyond the two listed above.

Where the data comes from, and your consent

The only source of your step data is your own device's motion and fitness sensors, read through Apple's APIs. We collect it with your consent and to the extent necessary to provide the step-rewards service you signed up for.

We ask for your consent in the app before we collect anything. The app shows you a screen explaining what we collect and why, and step counting stays off until you choose "I agree, start counting my steps". That screen comes before the iOS Motion & Fitness permission prompt, so declining means the app never asks your device for motion access at all (and if you granted that permission on an earlier version of the app, declining means we stop using it). Both are required for us to collect step data: your in-app consent and the iOS permission. If you decline, the rest of the app still works. You simply do not earn from steps. We record the fact and date of your consent so we can show you its current state and honor a withdrawal.

You can withdraw consent at any time, and the app will stop collecting step data going forward:

• in the app, at Profile > Step Data Consent. This is the most direct route. Turning it off stops step collection immediately and deletes our record of your consent;
• turn off motion access in iOS Settings > Privacy & Security > Motion & Fitness > Stride Quest;
• email jordan@stridequest.tech from your account email; or
• delete your account in the app (Profile > Delete Account), which removes your health data as described below.

Who can see it

We never sell consumer health data, and we never share it with advertisers or ad networks. Ads in the app are served by Google AdMob, which receives no step or health data from us. Advertising identifiers are handled entirely separately from step data, by design.

The only third parties that process your step data are infrastructure providers acting on our instructions to run the service:

• Neon provides database hosting (where your account data, milestone records, and token history are stored);
• Railway provides application hosting (the servers the app talks to).

Tremendous, the service that fulfills reward redemptions, receives your name, email, the reward amount, and which reward it is for (the gift card or charity you chose, or the category it belongs to). It never receives step or health data from us. We have no affiliates, and no one else receives consumer health data.

Stride Quest does not ask for location permission, does not collect GPS or precise location, and does not use geofencing of any kind. The Google Mobile Ads software built into the app collects your device's IP address and uses it to estimate the general area a device is in, so that ads can be served and measured. Google collects that, not us. It is approximate, it does not come from GPS or any precise location, and Google receives no step or health data from us. Our App Store privacy label calls this coarse location.

How long we keep it

• Raw step readings are automatically deleted after about 48 hours.
• Milestone records (which milestone you reached, the date, and your step count at that moment) are kept while your account is active, so the rewards program knows what you have already claimed.
• Step collections in your token history (the time of each collection, one for every 300 steps) are kept while your account is active; the app shows the last 30 days of your token history (app version 1.0.2 and later).
• Deleting your account deletes your health data from our database at once. Our server logs are not cleared when you delete your account, and they can still show your account number next to a milestone spin you took. (Redemption records, which contain no health data, are retained for 30 days after deletion for fraud prevention, as described in the Privacy Policy.)

Your rights

You can, at any time: access the consumer health data we hold about you, withdraw consent to further collection or sharing, and delete your consumer health data.

The fastest way to withdraw consent is in the app, at Profile > Step Data Consent. It takes effect immediately, with no request to process. For access and deletion, or to withdraw consent without using the app, email jordan@stridequest.tech from the email on your account, or use the in-app account deletion. We will respond within 45 days (extendable once where the law allows, and we will tell you if so).

If we deny a request, you can appeal by replying with the word "Appeal". A second review will be completed within 45 days. If your appeal is denied, you may contact your state Attorney General (for example, the Washington, Nevada, or Connecticut Attorney General).

Changes and contact

If we change how we handle consumer health data, we will update this policy and its "Last Updated" date before the change takes effect, and material changes will be flagged in the app or by email. Questions: jordan@stridequest.tech (Stride Quest LLC).