Privacy Policy

Steps Academy · Last updated 17 August 2026

Steps Academy runs this app so that parents and guardians can see photographs of their own child, follow the weekly timetable, and stay in contact with the academy. This policy explains what we hold and why.

Who this is for

Accounts belong to parents and guardians, not to children. Children do not sign up and do not log in. A guardian creates an account using an invite code issued by the academy for their specific child.

What we hold about your child

• Their first name, as the academy records it on its roster
• Photographs taken at academy events, and which children appear in them
• Which courses they attend
• Optionally, a date of birth and notes kept by the academy

What we hold about you

• Your name and email address
• Your password, stored only as a cryptographic hash that cannot be reversed
• A guardian phone number, when the academy records one to send your invite code
• A device token, if you allow notifications, so we can send them
• Any feedback or requests you send us through the app

Who can see a photograph

A photograph is visible only to the guardians of a child who has been tagged in it. Being present at the same event is not enough. Guardians are linked to children by the academy — never by claiming a name in the app — so one family cannot reach another family's photographs.

What we never do

• We do not sell or rent any personal information
• We do not show advertising, and we do not use advertising trackers
• We do not profile children or build marketing audiences
• We do not share photographs with anyone outside the academy and the child's own guardians

How we improve the app

We record how the app is used so we can see what works and what does not: which screens are opened, which albums and courses families look at, where a sign-up is abandoned, and when something goes wrong. This is measured by us, on our own server. No analytics company is involved and no usage data is sent to any third party.

• We record that an album was opened — never which photograph was viewed, and never which child is in it.
• We never record names, email addresses, photographs, or anything you type.
• Usage records are kept for twelve months and then deleted automatically.
• Deleting your account deletes your usage history with it.

Where it is kept

Account and roster data is stored in a managed PostgreSQL database hosted in the European Union. Photographs are stored in private object storage and are only ever served through short-lived links generated for a signed-in guardian. Both are operated by established infrastructure providers on our behalf.

How long we keep it

We keep your account until you delete it. Photographs are kept by the academy as part of its record of an event, and are removed when the academy deletes the photograph or the album.

Your choices

• Delete your account at any time from Profile in the app, or by using our account deletion page.
• Ask what we hold about you or your child, and ask us to correct it.
• Ask us to remove a photograph of your child. Email us and we will take it down.
• Turn off notifications in your device settings.

Children's privacy

The app is designed for guardians. We collect information about a child only because their guardian and the academy have asked us to, and only for the purposes above. A guardian confirms consent when creating their account. If you believe we hold information about a child without the consent of their guardian, contact us and we will delete it.

Contact