1. About this Policy

This Privacy Policy describes how PeppyStep LLC ("PeppyStep," "we," "us," or "our") collects, uses, discloses, retains, and deletes personal information in connection with the PeppyStep mobile applications, website, and related services (the "Service"). It applies to account holders, adults they invite (family members, walkers, and sitters), and teen profiles used under an adult's account. As stated in our Terms of Service, if this Policy and the Terms conflict, this Policy controls how we handle personal information. If you do not agree with this Policy, do not use the Service.

1a. Notice at Collection

This is the summary of what we collect and why. The sections below have the full detail.

We do not sell personal information, and we do not share it for cross context behavioral advertising. We do not run advertising, and we do not use your private content to train general purpose AI models.

2. Information We Collect

Account information. When you create an account we collect your name, email address, and birth date (used to confirm you are 18 or older), along with a password or a sign in identifier if you use Sign in with Apple or Google. You may optionally add a profile photo.

Dog profiles and care records. Information you choose to add about your dogs: name, breed, size, weight and weigh in history, photos, notes, and care records such as medications, dose logs, feeding logs, vet visits, grooming, and calendar events. These records describe your dog, but they are linked to your account and we protect them as personal information.

Walks and activity. When you track a walk we collect its time, duration, distance, phone measured step counts, estimated dog steps, and activity events you log during the walk. If you grant location permission, we collect GPS route data for the walk. Manual walk entries you type in are collected as entered.

Health platform data. If you explicitly connect Apple Health or Google Fit, we collect step and activity data from that platform to display and sync your activity in the Service. See Section 6.

Social features. If you use social features we collect your friend connections, challenge participation, activity feed posts, walks you choose to share, and the email addresses or share links you use to invite family members, walkers, sitters, or friends.

Preferences and settings. Your units, appearance, notification, reminder, and privacy choices.

Device, usage, and diagnostics. Device model, operating system, app version, usage information, and crash and error diagnostics collected through our error monitoring provider. When an error occurs, this may include a session replay capturing the actions leading up to it.

Purchases. Subscriptions are purchased through the Apple App Store or Google Play. We receive subscription status (for example, which plan is active and when it renews) but never your payment card details.

3. Sensitive Information

Some of what we collect is treated as sensitive personal information under state privacy laws, specifically precise geolocation and health and fitness data. We collect these only with your permission, use them only to provide the features you asked for, and do not use them to infer characteristics about you, sell them, share them for advertising, or use them for any purpose beyond operating the Service.

4. How We Use Information

We use personal information to: provide, maintain, and improve the Service; sync your data across your devices; deliver reminders and notifications you configure; operate the social and sharing features you choose to use; personalize content such as walking plans and guides; provide customer support; secure the Service and prevent fraud and abuse; and comply with legal obligations.

We do not sell personal information, and we do not share it for cross context behavioral advertising.

4a. Automated Features and AI

We do not use your personal information or the content you create to train general purpose AI models.

If we introduce an automated or AI assisted feature in the future, we will identify automated outputs as automated, use your inputs only to provide that feature, update this Policy, and obtain any consent required by law before that processing begins.

Some features described in this Policy may not be available yet; we do not collect or process data through a feature that is turned off.

5. Location Data

We collect precise location (GPS) data only if you grant location permission on your device, and we use it to record walk routes and show maps. Location is collected during an active walk, in the foreground and, with your permission, in the background while a walk is running. It is not collected outside of an active walk.

To display maps and nearby places such as parks and trails, approximate location may be sent to OpenStreetMap based services, specifically Nominatim (geocoding) and the Overpass API (map data). These are external services operated by OpenStreetMap and its mirror operators under their own terms.

You can revoke location permission at any time in your device settings; the Service will continue to work without route maps. Location tracking is not available through teen sessions.

6. Health Platform Data (Apple Health and Google Fit)

Connecting a health platform is optional and requires your explicit permission on your device. We use health platform data only to display and sync your step and activity information within the Service. We do not use Apple Health or Google Fit data for advertising or marketing, and we do not sell it or share it with third parties for their own purposes. You can disconnect a health platform at any time in the app or your device settings, and our use of that data is also governed by the applicable platform's rules. Health syncing is not available through teen sessions.

7. How We Share Information

People you choose. The Service is built for sharing dog care: family members you invite receive co owner access to your dogs' information, and walkers and sitters receive time limited access. Friends see what your privacy settings allow. You control who you invite and can revoke access; information another user received while sharing was active may remain in their account as part of a shared interaction.

Service providers. We use companies that process personal information for us to run the Service: Supabase (authentication, database, and storage), Vercel (hosting), Sentry (error monitoring and diagnostics), and OpenStreetMap based mapping services (Nominatim and Overpass, which receive approximate location to return map and place data). Service providers may use personal information only to provide services to us.

Apple and Google. Sign in, health platforms, notifications, and subscription billing involve Apple or Google acting under their own terms for those functions. Subscription payments are processed by Apple and Google, not by us.

Legal reasons. We may disclose information when we reasonably believe it is required by law or legal process, or necessary to protect the rights, safety, or property of PeppyStep, our users, or others.

Business transfers. If PeppyStep is involved in a merger, acquisition, financing, or sale of all or part of its business or assets, personal information may be transferred as part of that transaction. This Policy will continue to apply to that information until it is changed under Section 15, and we will provide notice required by law.

With your consent, for anything else.

8. Teen Profiles (Ages 13 to 17)

A teen profile is created inside a parent or legal guardian's account and is not a separate PeppyStep account. There is no teen email address, password, or login. The parent or guardian consents to the teen's use and the data practices described here.

Through a teen session we collect only the profile information the account holder provides (such as a nickname, a preset avatar, and a birth year) and the walk and care entries the teen types in. Nothing about a teen is measured. Teen sessions do not have access to location tracking, motion or fitness sensors, health platform syncing, social features, payments, or AI features, and tracked data such as GPS routes, step counts, distance, and health figures is neither collected about a teen nor displayed to one. These limits are enforced on our servers, not only in the app.

The account holder can review the teen profile's information, revoke its paired device session, or delete the profile at any time. Entries a teen recorded remain part of the dog's care history in the account holder's records.

9. Children Under 13

The Service does not permit accounts or profiles for children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it, subject to applicable law. If you believe a child under 13 has provided us personal information, contact us at privacy@peppystep.com.

10. Your Choices and Rights

Access and correction. You can view and edit your account, dog, and care information in the app.

Deletion. You can delete your account in the app, in Settings, or by contacting us. Deleting your account removes your personal information from active systems, except for copies temporarily retained in backups, records we must keep by law, and content another user independently retains from a shared interaction. Deleting your account does not automatically cancel an Apple or Google subscription; we will provide the cancellation link before deletion.

Export. You can request a copy of your data by emailing privacy@peppystep.com. We will verify your identity and provide your information in a portable format within the time required by law.

Marketing. Marketing email is optional, separate from Service notices, and you can opt out at any time using the unsubscribe link or in the app.

Notifications and permissions. You control push notifications, reminders, location, and health permissions in the app and your device settings.

Opt out signals. We honor recognized browser and device opt out signals, including the Global Privacy Control (GPC), for users in all states. Because we do not sell personal information or share it for cross context behavioral advertising, this signal does not change how we handle your data, but we honor it regardless, and we would continue to honor it if those practices ever changed.

11. US State Privacy Rights

Depending on where you live, including California and other states with comprehensive privacy laws, you may have the right to know what personal information we collect and how we use it, to access and receive a portable copy of it, to correct it, to delete it, to opt out of sale, sharing for cross context behavioral advertising, and certain profiling, and to limit the use of sensitive personal information.

We do not sell personal information and we do not share it for cross context behavioral advertising, so there is no opt out of sale or sharing to exercise. We use sensitive personal information only to provide the Service you requested and for purposes permitted without an opt out, so no separate limitation request is required. See Section 1a for the Notice at Collection that California requires at or before collection.

We apply these protections nationwide rather than only where a law requires them. To exercise a right, contact us at privacy@peppystep.com. We may need to verify your identity, an authorized agent may submit a request where the law allows, and we will not discriminate against you for exercising your rights.

12. Data Retention

We keep personal information while your account is active and as needed to provide the Service. Deletion is triggered by your action, not by a rolling schedule: we do not delete an active user's walks, history, or records.

When you delete specific content or your account, we delete or de identify it from active systems promptly, and backup copies are purged on our routine backup cycle. Disposable operational data such as error and diagnostic logs is kept only for a short period and then deleted. Financial and transaction records are kept for as long as tax and accounting law requires. We retain information longer only where the law requires it, or where another user independently retains shared content.

13. Security

We protect personal information with measures including encryption in transit and at rest, multi factor authentication on administrative accounts, and per user access controls enforced at the database level. No method of transmission or storage is completely secure; if a breach affecting your personal information occurs, we will notify you and regulators as required by law.

14. Where We Operate

PeppyStep is offered in the United States only. We are based in the United States and process and store personal information there, as do our service providers. We do not target or offer the Service to users in the European Union, the United Kingdom, or the European Economic Area.

15. Changes to this Policy

We may update this Policy prospectively. We will provide reasonable advance notice of material changes and obtain renewed consent where required by law. The Effective date above shows the current version, and we keep prior versions so you can see what applied when you agreed. You can request any prior version by emailing privacy@peppystep.com.

16. Contact Us

Email: privacy@peppystep.com

PeppyStep LLC. Principal address: 1309 Coffeen Avenue STE 1200, Sheridan, Wyoming 82801. Mailing address: 12400 North Tatum Boulevard Unit 4094, Phoenix, Arizona 85032.