StepLog Privacy Policy

Effective date: 2026-05-14 · Last updated: 2026-05-14

Short version: StepLog stores your treatment chronicle — chronic conditions, medication trials with failure reasons, step-therapy cycles, insurance-plan history, provider documents, side-effect photos, and lab values — on your iPhone only. Nothing leaves your device. We have no servers and no analytics. The only network communication the app performs is with Apple's StoreKit servers (subscription verification). To protect your archive against device loss, back up your iPhone to iCloud or iTunes regularly — Apple's standard device backup includes StepLog's records.

1. Who we are

StepLog is published by an independent iOS developer (Apple Developer Team ID ZM8LF8494F). For any privacy-related question, write to captainlongevity@gmail.com.

2. Information we do not collect

We do not collect, transmit to our servers, store on a server we operate, sell, share, or analyze:

Your chronic conditions, diagnoses, comorbidities, or current status
Your medication trial records, medication names, medication classes, start / end dates, failure reasons, failure descriptions, side effects, dosage, schedule, or prescribing providers
Your step-therapy cycle records, required-meds lists, current step, or target medication
Your lab values, reference ranges, imaging reports, or attached documents
Your insurance plan names, plan types, formulary notes, step-therapy-policy snapshots, costs, or out-of-pocket amounts
Your name, email, phone, date of birth, address, or any account identifier
Device identifiers (IDFA, IDFV) for advertising or tracking purposes
Location data
Crash reports or analytics events sent to any third party

We have no servers. The fields above never reach us.

3. No data sharing with pharmaceutical companies or insurers

StepLog does not share any records with pharmaceutical companies, insurance carriers, specialty pharmacies, healthcare providers, professional medical associations, government agencies, or research databases. There is no advertising SDK, no analytics SDK, and no marketing-data partnership in the app. If a future release ever introduces any such integration, it will be strictly opt-in, with a clear in-app notice before any record leaves your device.

4. Information stored on your device

All archive data you enter is stored locally on your iOS device using Apple's SwiftData framework. This data is included in your iCloud or iTunes device backup if you have device backup enabled.

5. On-device processing

Several features process data locally on your device only:

Document scanning uses Apple's VisionKit on-device. Scanned images of denial letters, lab reports, or provider notes never leave your phone.
PDF report generation uses Apple's PDFKit on-device. No archive content is transmitted during generation. The Step Therapy Defense Pack, Medication Trial Chronicle, Adverse Event Summary, Insurance History Report, and Annual Treatment Summary are all built from your local records and rendered on-device.
App Lock uses Apple's LocalAuthentication framework. Your Face ID or Touch ID biometric data never leaves Apple's Secure Enclave; the app only receives a success or failure signal.
Step-therapy cycle reminders are scheduled via Apple's UserNotifications framework and fire locally on your device. No remote push servers are involved.

5a. Device backup is your archive's lifeline

StepLog stores all records on your iPhone only. The app does not use iCloud sync, CloudKit, or any cloud storage of its own. If you lose your phone and have no backup, your archive is gone.

To protect against device loss:

Keep iCloud Backup on (iOS Settings > [your name] > iCloud > iCloud Backup). When enabled, Apple includes StepLog's SwiftData store in your nightly encrypted device backup, and a new iPhone restore recovers your archive automatically.
Alternatively, back up to iTunes / Finder on a Mac or PC. StepLog's records travel with the device backup.
Pro users can also export the entire archive as a JSON file via Settings > Data > Export full archive, save it to Files, email it to yourself, or copy it to a USB drive for an additional offline copy.

We have no servers and cannot retrieve your records for you. Apple's device backup is the canonical recovery path.

6. AuthGuard schema coordination (Pro)

Pro users can export the StepLog archive as a JSON file for use with AuthGuard (the "StepLog-AuthGuard schema", for single-event appeal forms). The JSON file is generated on your device. It is exchanged between apps via the iOS Share Sheet or Files app, never via a remote server. AuthGuard is a separate application with its own privacy policy; we do not receive any data exchanged between the apps. The reverse direction (importing an AuthGuard payload back into StepLog) operates the same way.

7. Subscriptions and StoreKit

StepLog offers an optional Pro subscription (Monthly, Annual, or Lifetime one-time) via Apple's StoreKit 2. When you subscribe, restore a purchase, or when the app verifies your entitlement, your device communicates directly with Apple's servers. StepLog receives only the entitlement status (active or inactive) and a purchase identifier. We do not see your Apple ID, payment method, billing address, or transaction history. Apple's handling of subscription information is governed by Apple's Privacy Policy.

8. Permissions the app requests

Camera — only when you tap "Scan document" on a medication trial or document entry.
Photo Library — only when you tap "Import photo" or "Import document".
Face ID — only after you enable App Lock in Settings.
Notifications — only after you enable step-therapy cycle or trial-followup reminders.

You can revoke any of these permissions at any time in iOS Settings > StepLog.

9. No AI, no automatic medical inference

StepLog does not predict treatment outcomes, recommend medications, calculate official disease activity scores, infer step-therapy approval likelihood, generate appeal letters, or perform any artificial-intelligence analysis on your archive. Failure reasons you record (lack of efficacy, adverse event, contraindication, cost, formulary change) are your own characterizations and are stored as text and category tags without further processing.

10. Children's privacy

StepLog is not directed to children under 13. We do not knowingly collect any information from anyone, including children. The app's age rating reflects this.

11. Data retention and deletion

You control retention completely. Records you delete in the app are removed permanently from the on-device store on the next save. There is no in-app trash, no soft-delete recovery window, and no remote copy on our servers for us to delete because we do not have servers. Pro users can export the entire archive to a JSON file before deleting anything (Settings > Data > Export full archive); free users can export individual medication trials as Markdown from the trial editor. To remove every trace of your archive: delete the app from your device. If you have an iCloud device backup, that backup may contain prior versions of the StepLog store — you can manage iCloud device backups via iOS Settings > [your name] > iCloud > Manage Account Storage.

12. International users

The app is published in English and is primarily marketed in North America. Because we operate no servers, we do not transfer your data internationally.

13. Changes to this policy

If we ever change how the app handles data, we will update this policy and surface the change in the app before you can use the affected feature. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact

Privacy questions: captainlongevity@gmail.com