StepLog is published by an independent iOS developer (Apple Developer Team ID ZM8LF8494F). For any privacy-related question, write to captainlongevity@gmail.com.
The app does not automatically send the following records to the developer for storage, advertising or analytics. User-selected exports, optional system services and support messages are handled as described in this policy:
We do not operate an app-record server. The app does not automatically send these fields to us; information you choose to include in a support message is an exception.
StepLog does not share any records with pharmaceutical companies, insurance carriers, specialty pharmacies, healthcare providers, professional medical associations, government agencies, or research databases. There is no advertising SDK, no analytics SDK, and no marketing-data partnership in the app. If a future release ever introduces any such integration, it will be strictly opt-in, with a clear in-app notice before any record leaves your device.
All archive data you enter is stored locally on your iOS device using Apple's SwiftData framework. This data may be included in your iCloud or iTunes device backup if you have device backup enabled.
Device-backup contents and recovery depend on your system settings, a successfully completed usable backup and Apple’s restoration process; enabling backup alone does not guarantee recovery of every record or original file. We cannot retrieve or restore your device backups.
Several features process data locally on your device only:
StepLog stores all records on your iPhone only. The app does not use iCloud sync, CloudKit, or any cloud storage of its own. If you lose your phone and have no backup, your archive is gone.
To protect against device loss:
We do not operate an app-record server and cannot retrieve your records for you. A usable Apple device backup and the supported manual archive tools are separate recovery options; neither guarantees recovery of missing original files.
Pro can export structured JSON records for an appeal workflow and import compatible treatment-failure records through the system file picker. The selected file is processed locally. No automatic account connection or developer-hosted record transfer takes place. A file you save or share can contain sensitive treatment information and is controlled by the destination you select.
Full-archive backup and restoration are separate. After validation, the current import offers replacement or merge with updates to matching identifiers, as detailed below. For a nonempty destination it requires a successful local pre-import safety copy before writes. Per-trial Markdown export remains free.
StepLog uses Apple StoreKit for a yearly subscription and a one-time non-consumable Lifetime purchase. Loading products, checking offer eligibility, purchasing, restoring and verifying access communicate with Apple. The app reads verified product and entitlement information, including expiration or revocation status where applicable, and keeps local access state. Apple processes payment; StepLog does not receive your payment-card details or Apple Account password. Current and supported historical purchase access depend on verified transactions. See the StepLog terms for the available plans and subscription handling.
You can revoke any of these permissions at any time in iOS Settings > StepLog.
StepLog does not predict treatment outcomes, recommend medications, calculate official disease activity scores, infer step-therapy approval likelihood, generate appeal letters, or perform any artificial-intelligence analysis on your archive. Failure reasons you record (lack of efficacy, adverse event, contraindication, cost, formulary change) are your own characterizations and are stored as text and category tags without further processing.
StepLog is not directed to children under 13. The app has no child account or developer-operated record collection. Contact support if a child has sent personal information to us. The app's age rating reflects this.
Selected record deletion is permanent in the active database after a successful save, with no in-app trash or soft-delete window. A condition deletion and file cleanup have the separate scope described below. Pro JSON export preserves only supported structured records and paths; free per-trial Markdown preserves a readable summary. Removing the App normally removes its local container, while original files, external exports, local safety copies and earlier device backups require separate care. We have no developer-operated record archive.
The app is published in English and is primarily marketed in North America. The app does not route your archive through a developer-operated record server. Apple services, website hosting, support correspondence and sharing destinations may process information outside your region, as described in this policy.
If we ever change how the app handles data, we will update this policy and surface the change in the app before you can use the affected feature. The "Last updated" date at the top of this page reflects the most recent revision.
The full-archive JSON contains structured condition, treatment, cycle, plan, and document metadata, including local file-path references. It is not password-encrypted and does not bundle the original document or photo files referenced by those paths. A compatible metadata restore cannot recreate missing originals on another device. Keep those files or a verified device backup separately. Local pre-import copies may retain records that you subsequently delete from the active store; removing a record does not erase those saved copies, external exports, or earlier device backups.
StepLog's widget displays locally prepared summaries of app records. The app and its widget exchange the relevant summary and preferences through an on-device shared container; this is not a developer-operated record upload. Information displayed by a widget can be visible to people able to view the Home Screen or Lock Screen where it is placed. Use the widget and device display settings to control that visibility. Screenshots and independent copies remain separate from the records you later edit or delete.
Deleting a condition cascades to its medication trials and step-therapy cycles after a successful save. Independent insurance-plan and document-vault records remain; separately stored original files are not guaranteed to be removed by that cascade. There is no Recently Deleted. Full-archive import validates the selected file. Merge updates supported fields for matching identifiers, adds missing records and can skip content-equivalent records with different identifiers; it does not simply skip every matching identifier. Replace removes the supported destination records first. For a nonempty destination, a successful local JSON safety copy is required before import proceeds. A failed import restores its affected records while retaining unrelated pending edits. Undo replaces the supported record collections using the saved metadata copy, including replacing later edits and newly added records after import; it cannot reconstruct missing original files. Export current records separately before Undo if needed. Safety copies and exports can retain data after active records are deleted.
Privacy questions: captainlongevity@gmail.com
These StepLog legal pages are served by Vercel. Opening a page sends ordinary request information, such as IP address, browser information and the requested URL, to the host for delivery and security; see Vercel's Privacy Notice. These pages contain no advertising or analytics scripts. If you email support, we receive the address and information you choose to send to answer your request. Avoid including sensitive records that are not needed for that request.
The updated App pauses the normal record interface if its persistent database cannot be opened. New recording and editing through that interface are blocked. The App keeps the existing database and attachment files without opening a replacement archive. Database-dependent startup work in that interface is paused; previously scheduled reminders, widget snapshots or independent copies may remain.
Check available device storage, close and reopen the App, and contact support before deleting or reinstalling it. This recovery screen is not a backup, a repair guarantee or an automatic restoration of missing records. Older installed versions may behave differently until updated.
The updated App checks saving before completing a new condition, trial, cycle, plan, onboarding record or document record. Detached creation forms are inserted as a checked operation, and canceling a new form does not roll back other pending edits. Existing bound editors keep their ordinary live editing and autosave behavior; Cancel is not a guaranteed undo of saved or pending edits. If saving current edits fails, a visible notice provides retry. Unsaved form text, scan images and pending edits can remain only in memory and can be lost if the App closes before saving; they are not a backup.
A scan is a generated local PDF copy, without a guarantee of original image metadata or original-quality recovery. If the PDF file is written but its document record cannot be saved, the updated editor keeps that known file and scan available for Retry or an explicit Discard rather than creating a new copy on each retry. A successfully saved scan is independent of later Cancel in the trial editor. Discard can leave a queued local file when cleanup fails.
Deleting a document first records its known vault filename in a local cleanup queue and then checks the database deletion. A failed queue preparation or database save blocks completion. Only after the database change is committed does cleanup check all current saved document references before removing an unreferenced, app-created vault file. A shared file is kept. Cleanup does not scan or recursively delete unknown files and does not follow symlinks. Failed known-file cleanup retains the file or queued filename for retry on App launch, foreground or the visible retry control. A saved database deletion is not proof that its original file, an export, a pre-import safety copy or a device backup was erased. Original system media is separate.
Deleting a condition still cascades to its trials and cycles; independent insurance plans and document-vault records and files remain, including a document whose old trial link no longer resolves. Archive Replace, metadata Undo and exact-duplicate cleanup do not purge original vault files, prior exports, preferences or older backups. A document-path reference does not recreate missing original bytes.
Amount fields keep existing Decimal precision. Incomplete or invalid temporary numeric text remains in the field without replacing the last valid amount with zero or a numeric prefix; finish or clear it before Save. This is input validation, not a medical, billing or insurance determination.
Full-archive import validates supported versions, identifiers and relationships. Merge updates supported fields on matching IDs, adds missing records and can skip equivalent content under other IDs. Replace changes the supported condition, trial, cycle, plan and document collections. A nonempty destination requires a readable local JSON safety copy first; that copy and the in-memory Undo snapshot contain supported structured records and file paths, not original scan binaries or every setting. Failed import or Undo retains the affected original graph and pending edits. Existing scans can remain even when no active document row references them.
The separate treatment-file exchange exports selected failure records and imports the compatible legacy JSON format. Import matches a condition by normalized name or creates one, then adds the incoming failure records. It does not deduplicate repeated imports, import an appeal outcome or connect accounts automatically. The file format remains compatible; user-directed sharing can send sensitive treatment information to the selected destination. Review its contents and the recipient before sharing. Neither JSON format is a password-encrypted archive or a guarantee of recovery after reinstalling the App.