Two Steps is a walking app that plans loops you have not walked before. It is built to keep your data on your device. There are no accounts, no sign-in, no advertising, and no third-party analytics. This policy explains what the app collects, what leaves your phone, and why.
Data that stays on your device
The app stores the following locally, and nowhere else:
- Your walks: the GPS trail, step count, duration, and the planned route for each walk.
- A coarse map of ground you have covered, kept as grid cells roughly 30 metres across. This is what lets the app avoid repeating your streets.
- Your settings, such as step goal, units, and notification preferences.
This data is kept on your device for as long as you keep the app installed, so that your history and covered ground remain available to you. Deleting a walk in the app removes it permanently. Uninstalling the app removes all of this data.
Location
The app uses your location for two purposes: to plan a route that starts from where you are, and to draw your trail while you walk. During an active walk the app continues to read your location in the background, so your trail keeps recording when the screen is off or you switch to another app. Background location is only used during a walk you started, and stops when the walk ends. Your trails are stored on your device only.
What leaves your phone when you request a route
When you ask for a new walk, the app sends a request to our route service. That request contains your approximate starting coordinates, your step goal, a random seed, and the identifiers of grid cells you have already covered. The service uses this to plan candidate loops and returns them to your phone. It works as follows:
- Coordinates are sent to Google Maps Platform (the Routes API and Places API) to compute real walking paths. Google processes this data under the Google Privacy Policy.
- Summaries of the candidate routes (distances, street names, novelty scores) may be sent to an AI model to choose and name the best one. The summaries describe the routes, and the request is not tied to any account or identity.
We do not operate a database of your requests. Route generation is transient: the service holds the request in memory only while it computes a response, and discards it once the response is returned. Our hosting provider (Cloudflare) keeps standard operational logs, such as IP addresses, as part of running the service; those logs are deleted automatically within 30 days.
Steps and motion
Step counts come from your phone's built-in pedometer. On iOS this uses Motion & Fitness access; on Android it uses the physical activity permission. Step data is read on your device and stays there.
Apple Health and Health Connect
You can choose to connect Two Steps to Apple Health on iOS or Health Connect on Android. This is off by default. If you turn it on, the app writes your finished walks (steps, distance, duration) to your health store, and on Android reads today's step total to show it on the home screen. Health data is never sent to our servers, and we never read your health records beyond the step totals described here. You can disconnect at any time in the app's settings or in your phone's health settings.
Maps shown in the app
The map you see in the app is rendered by the Google Maps SDK, which may collect device data as described in the Google Privacy Policy.
Notifications
Walk milestones, the optional daily reminder, and the Android walk-in-progress notice are all generated locally on your device. We do not send push notifications from a server.
App updates
The app periodically checks for updated code bundles using Expo's update service. This involves a standard network request from your device and does not include your walks, location, or health data.
Data retention and deletion
We do not store or retain any user data on our servers. Two Steps has no accounts and no user database, so there is no copy of your walks, trails, coordinates, step counts, or health data held by us to retain or to delete.
- Data on your device — walks, trails, covered ground, and settings — is retained on the device until you delete it. Deleting a walk removes it immediately and permanently. Uninstalling the app erases everything the app stored.
- Route requests sent to our route service are processed in memory and discarded as soon as the response is returned. They are never written to a database or to a file.
- Operational logs from our hosting provider (Cloudflare), which include IP addresses, are retained for no more than 30 days and are then deleted automatically. They are used only to run and troubleshoot the service.
- Data you choose to write to Apple Health or Health Connect is retained by that health store under your control, not by us. You can delete it in your phone's health settings at any time.
To delete everything associated with Two Steps, delete individual walks in the app or uninstall the app. Because we hold no personal data, there is no deletion request to make of us, but you can write to hello@twosteps.app with any question about this. Coordinates passed to Google Maps Platform and route summaries passed to the AI provider are retained by those providers under their own policies, linked above.
Children
Two Steps is not directed at children under 13, and we do not knowingly collect data from them.
Changes to this policy
If we change how the app handles data, we will update this page and its effective date. A change that meaningfully affects what leaves your device will be called out in the app.
Contact
Questions about this policy can be sent to hello@twosteps.app.