This policy explains what data Steel collects, why, and how to exercise your rights. It deliberately separates two very different kinds of data: your health data (menstrual cycle and body measurements), which never leaves your device, and your account and training data, needed to sync across your devices. Anonymous usage statistics, which you can turn off, come on top. The French version is the reference version.
1. Menstrual cycle data — processed on your device only
If you turn on the cycle tracking module, Steel records the start and end dates of your periods that you choose to enter, as well as your contraception situation. This information can reveal details about your hormonal status or reproductive health; we therefore treat it as health data within the meaning of Article 9 of the GDPR, even though it does not come from any medical sensor.
- No server transfer: this data is never sent to our servers or to any third party. It stays stored, encrypted, on your device only.
- No sharing: we have no technical access to this data, so we cannot view, share or monetize it.
- Encryption at rest: this data is encrypted locally on your device.
- Explicit consent: the cycle tracking module is off by default and only turns on after explicit, separate consent given in the app.
- Export and deletion: you can export your cycle data at any time (Profile → Account → Export my data) or delete it from the Cycle screen. Deletion is immediate and local — no request to our team is needed.
2. Body measurements — processed on your device only
If you use the “Weight & measurements” screen, Steel records your height, the weigh-ins you enter and, if you set one, your weight goal. Your body mass index (BMI) and your pace are calculated on your device from these values. Being close to health data, this information is handled like your cycle data:
- it stays stored, encrypted, on your device only and is never sent to our servers or to any third party;
- it is included in your data export and erased with your account or when you sign out;
- the BMI and goal displays can be hidden at any time.
3. Account and training data
To sync your session history across your devices and back up your data, Steel provides a minimal user account. We then collect:
- An account ID, created automatically: by default your account is anonymous, with no email address or password. The ID is shown under Profile → Account → Account ID;
- Your email address, only if you choose to save your account (Profile → Account → My account). It is used to send you one-time sign-in codes and to restore your routines and sessions on another device. These emails are sent by our email provider, Resend, which only receives your address and the message;
- Your session history, routines and training programs;
- Technical information about your premium subscription, if any.
This data is hosted by Supabase Inc., our technical processor for account sync and backup. It is used only to run the sync and backup of your account — we do not sell it and do not use it for advertising.
If you subscribe to the premium plan, your subscription status (active, expired, plan type) is shared with our subscription management provider, RevenueCat, solely to check your premium access and handle billing. RevenueCat has no access to your training data or your cycle data.
Apple Ads campaign measurement (iPhone only). When you install Steel on iPhone, the app sends RevenueCat an attribution token provided by Apple (AdServices framework). RevenueCat exchanges it with Apple to learn whether the install came from one of our Apple Ads campaigns and, if so, which one (campaign, ad group, keyword, country). We use it only to measure how well our campaigns work, for example how many free trials and subscriptions they bring. This mechanism does not use your device's advertising identifier (IDFA), does not track you across other apps or websites, and therefore does not trigger any tracking permission request. This processing is based on our legitimate interest in measuring our advertising; you can object to it by writing to the address below. You can also turn off Apple's personalized ads in Settings → Privacy & Security → Apple Advertising.
This data is kept for as long as your account is active. You can request the deletion of your account and this data at any time, directly from the app or through our account deletion page.
4. Anonymous usage statistics
To improve Steel, the app anonymously measures how it is used: screens viewed, the steps of the app's introduction and of the Steel Plus offer up to subscribing, sessions started and finished.
- Anonymous: these measurements are tied to a random identifier specific to your installation of the app, renewed every 13 months. They are never linked to your account, your email address or your subscription, and your IP address is not kept.
- Never your health data: they contain neither your cycle data, nor your body measurements, nor your answers to the daily question, which stay on your device.
- Limited use: they are only used to produce statistics for Steel, for example the share of people who finish the app's introduction. They are not sold, not used for advertising and not combined with other data.
- Hosting and retention: they are hosted in the European Union by our processor PostHog and kept for 25 months at most.
- Turning them off: you can turn them off at any time in Profile → Settings → Anonymous usage statistics. No data is sent anymore.
This processing is based on our legitimate interest in measuring the app's audience and improving it.
5. Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict and port your personal data. For cycle data and body measurements, these rights are exercised directly in the app, without any action on our side. For all of your data, you can:
- Export all your data (account, routines, sessions, settings, subscription, cycle and measurements) as JSON: Profile → Account → Export my data;
- Use the account deletion feature built into the app;
- Turn off anonymous usage statistics: Profile → Settings;
- Write to beauregardterence@proton.me for any other request (access, rectification, portability).
We answer every request within one month at most.
6. Minors
Steel is not intended for people under 16. We do not knowingly collect data about minors.
7. Contact
For any question about this policy or your data, contact us at beauregardterence@proton.me.