Privacy Policy

This Privacy Policy explains how Stepify ("we", "us", "our") collects, uses, shares, and protects your information when you use stepify.tech, our browser extension, and related services (the "Service"). It applies alongside our Terms of Service.

In short: we collect what we need to run the Service, we use specialist AI and infrastructure providers to process your content, we do not sell your data, and we do not use your content to train our own models.

1. Information You Provide

Account information

• Email address
• Display name, if you provide one
• A salted password hash, if you sign up with email and password
• Your Google account ID, email, name, and profile picture URL, if you use Google sign-in

Content you submit

• Links you paste — YouTube videos, podcast episodes, public social videos
• Audio and video files you upload
• YouTube channels and podcast feeds you connect for automatic processing
• Transcripts and the outputs generated from them
• Chat messages, questions, prompts, and brand-voice or style settings

Payment information

Payments are handled by Polar, our Merchant of Record. We never receive or store your full card number. We receive only what we need to manage your subscription — a customer and subscription identifier, your plan, billing status and renewal dates, and limited billing details such as country and the last four digits of your card.

Support and feedback

If you contact us or submit feedback, we keep your messages and any information you choose to include in them.

2. Information We Collect Automatically

Log and device information

• IP address, browser type and version, operating system, and device type
• Pages viewed, referring page, access times, and actions taken in the Service
• Error and crash reports, including diagnostic details about what failed

Usage information

• Which videos and files you process, and with which settings
• Credit consumption, quota usage, and processing timestamps
• Subscription and billing history

3. Analytics and Session Recording

We use a product analytics provider to see which features are used, where people get stuck, and what breaks. This includes session recording, which replays interactions such as clicks, scrolling, and navigation so we can diagnose usability and performance problems. Recording runs only on signed-in product pages, and does not capture password fields or payment details.

We do not use advertising or cross-site tracking cookies, and we do not run ad networks on the Service. If you would like your session recordings excluded, email support@stepify.tech and we will opt your account out.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and secure the Service
• Transcribe and process the content you submit, and generate the outputs you request
• Create and manage your account, subscription, and credit balance
• Process payments and prevent billing errors
• Send service and account communications (see section 9)
• Respond to support requests and feedback
• Understand usage patterns, fix bugs, and improve performance and features
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms

Where the law requires a legal basis (for example under UK/EU GDPR), we rely on: performance of a contract to deliver the Service you signed up for; legitimate interests to secure, analyse, and improve the Service and to prevent abuse; consent where we ask for it, such as optional marketing email; and legal obligation for record-keeping and tax.

5. AI Processing and Service Providers

Running the Service means sending your content to specialist providers who process it on our behalf. They may only use it to perform their service for us, and they are bound by their own terms and confidentiality obligations.

• AI and transcription providers — to transcribe your media and generate the outputs you request
• Hosting and storage providers — to run the Service and store your files
• Payment provider — acting as Merchant of Record for your subscription
• Analytics and email providers — to measure product usage and send account email
• Google — for sign-in and for YouTube video metadata

We use these providers through their paid APIs, whose terms do not permit them to train their models on content submitted through the API. We do not train our own models on your content. These providers may change as we develop the Service.

6. How We Share Information

We do not sell your personal information, and we do not share it with advertisers. We share information only in these situations:

• Service providers — the providers listed in section 5, to the extent needed to run the Service
• When you publish — if you create a share link, the content in it becomes accessible to anyone with the link, and can be viewed and forked by them until you revoke it
• Legal reasons — where we reasonably believe disclosure is required by law, regulation, legal process, or a valid government request, or is necessary to protect the rights, property, or safety of our users, the public, or us
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, in which case we will notify you and the acquirer will remain bound by this Policy or give notice before materially changing it
• With your consent — or at your direction

Our staff may access your data where necessary for troubleshooting, support, security, and abuse investigation. Such access is limited to what the task requires.

7. Google API Services — Limited Use

Stepify's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google sign-in data only to authenticate you and maintain your account, and YouTube Data API data only to fetch the metadata needed to process the videos you request. We do not use this data for advertising, do not sell it, and do not transfer it to others except as needed to provide the Service, for security purposes, or to comply with the law. By using the Service to process YouTube content, you are also bound by the YouTube Terms of Service, and Google's Privacy Policy applies to Google's handling of your data.

8. Data Retention

• Uploaded audio and video files — deleted from temporary storage once processing completes or fails; we keep the resulting transcript and outputs, not the source file
• Transcripts and generated outputs — kept in your library until you delete them or your account is closed, so you can return to them
• Account information — kept while your account is active
• Billing and tax records — kept as long as required by law, typically six to seven years, even after account closure
• Analytics and session recordings — kept on our analytics provider's standard retention schedule
• Backups — deleted content may persist in encrypted backups for a short period before ageing out

When you delete your account, we delete or anonymise your personal data and content within 30 days, except where we must retain it for legal, tax, security, or fraud-prevention reasons. Aggregated, de-identified statistics that cannot identify you may be kept indefinitely.

9. Communications

We send service emails you cannot opt out of while you hold an account, as they are necessary to provide the Service: email verification, password resets, subscription activation and cancellation notices, payment failures, security notices, and alerts when your content is ready.

We may also send occasional product updates and offers. Every such email includes an unsubscribe link, and you can opt out at any time by using it or by emailing support@stepify.tech. Opting out of marketing does not stop the service emails above. We do not collect phone numbers and do not send marketing text messages.

10. Cookies and Local Storage

We use:

• Essential cookies — to keep you signed in and maintain your session; these are HttpOnly and Secure in production
• Analytics cookies — set by our analytics provider to distinguish sessions and users so we can measure product usage
• Local storage — for interface preferences such as theme, dismissed banners, and lightweight navigation state

Most browsers let you block or delete cookies in their settings. Blocking essential cookies will prevent you from signing in.

11. Security

• All traffic between your device and our servers is encrypted with HTTPS (TLS)
• Data is encrypted in transit, and at rest by our cloud infrastructure providers
• Passwords are stored only as salted hashes, never in plain text
• Session cookies use HttpOnly and Secure protections in production
• Database and infrastructure access is restricted to those who need it
• We keep dependencies patched and monitor for suspicious activity

No method of transmission or storage is completely secure, so while we work hard to protect your information we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and any relevant regulator as required by law.

12. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you, and receive a copy
• Correct inaccurate or incomplete data
• Delete your data and close your account
• Export your data in a portable format
• Restrict or object to certain processing, including profiling for marketing
• Withdraw consent you previously gave, without affecting processing already carried out
• Opt out of marketing communications
• Complain to your local data protection authority

You can delete individual videos, results, share links, and connected sources yourself at any time from the Service. To request account deletion, a copy of your data, or anything else above, email support@stepify.tech and we will respond within the time the applicable law requires — normally within 30 days. We will not discriminate against you for exercising these rights. If you decline to provide information we need to run the Service, some features may not be available to you.

13. Children's Privacy

The Service is not intended for children under 13, and we do not knowingly collect their personal information. If we learn that we have, we will delete it. If you believe a child has provided us information, contact support@stepify.tech.

14. International Data Transfers

We and our providers operate globally, and your information may be transferred to, stored in, and processed in countries other than your own — including the United States — whose data protection laws may differ from those where you live. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version here and update the "Last updated" date. Where changes are material, we will notify you by email or in the Service before they take effect. We encourage you to review this page periodically.

16. Contact Us

For privacy questions, or to exercise any of the rights above, contact support@stepify.tech. For general support, contact support@stepify.tech.