StepForgePrivacy Policy
Effective date: 2026-10-26
1. Who we are
StepForge is a platform made up of the stepforge.pro website (account, forum, app catalog) and apps built by the same developer: the Wayfare pedometer app (Android), the Trailforge game (Android) and the GridCraft game hub (Android and a Telegram Mini App). The data controller (under GDPR) is the individual developer Kanstantsin Tabakmakher. Data questions: stepforgepro@gmail.com.
2. What data we collect
- Account data. Wayfare and Trailforge create an anonymous account from a random identifier generated on your device — no name, email, or sign-up required (it is not your Android advertising ID); GridCraft requires you to sign in with Google or Telegram. If you link or use a sign-in: Google — on the website we store your email address; in the Android apps we store your email address, the link to your Google profile picture and your language setting (we do not store your Google name); Telegram — we store only your numeric Telegram ID. A nickname you choose is shown to others where an app or the forum shows player names; until you choose one, a numbered placeholder name is shown.
- Steps and activity data. Step count, distance and active calories — from your device's step sensor and via Health Connect (Android) — plus brisk-walking minutes and hourly breakdowns computed from them, and activity sessions you start (type, start and end time, duration, distance, speed). This is the core data of the pedometer. Earlier versions of Wayfare also read floors climbed; the current version does not.
- Settings you enter. Your daily step goal and personal motivational text, optionally your weight and height (to make calorie estimates more accurate), and challenges you create.
- Location (GPS). Only when you start a mode that needs it (for example cycling or a timed walk with live speed), and only while the app is open on screen. Coordinates are processed on your device to compute speed and distance; they are not uploaded to us — only the resulting distance and speed values are. Background location is not collected.
- Technical data. The IP address and browser or device identifier (user agent) of your sign-ins, short-lived request-rate counters used for abuse protection, and the app and Android version.
- Crash reports. When an app crashes it may send us a technical report: exception class, error message, stack trace, app and OS version. Reports are designed not to contain steps, health or location data, but error messages are free text and we cannot fully guarantee that they never contain any.
- Support requests. If you write to support from an app: the subject, your text, an optional screenshot you attach, and the app and OS version.
- Forum content. What you post (see §14). Purchases and ads: see §12 (GridCraft) and §13 (Trailforge). Wayfare shows no ads and has no purchases.
3. Health Connect — specifically
Wayfare reads these Health Connect data types: steps, distance and active calories. This data is used solely for the app's core function — showing you your activity. We do not use Health Connect data for advertising and do not share it with any third party. You can revoke access at any time in Health Connect settings; the app keeps working from the device sensor.
Trailforge. If you connect Health Connect in Trailforge, the game reads your step count from it while the app is open on the screen (when it starts, when you return to it, and about every two minutes); it has no background reading. It requests only the permission to read steps: no distance, calories, heart rate, sleep or location, and no write access. Manually entered records are ignored. Only the daily total of steps (one number per day) is sent to our server to calculate your game rewards; individual records, times, source apps and device information are not sent. We do not share this data with third parties and do not use it for advertising. You can revoke access at any time in Health Connect settings; the game then keeps working with other step sources. The step totals stored on our servers are deleted when you delete your account (§6).
4. Why we process data, and the legal basis
| Data | Purpose | Basis (GDPR) |
|---|---|---|
| Steps/activity | Show your stats, goal, streaks, history; sync across your devices | Consent (Art. 6(1)(a)) / service provision |
| Account (random device ID) | Tie your data to you without sign-up | Service provision |
| Google/Telegram identifiers | Sign in to the same account on another device | Consent |
| Location (live speed modes) | Speed and distance of a session | Consent |
| Sign-in IP and user agent, rate counters, crash reports | Security, stability, bug fixing | Legitimate interest (Art. 6(1)(f)) |
| Support requests | Answer you and fix the problem | Service provision / legitimate interest |
| Forum posts and nickname | Run the public forum | Service provision |
| Purchase records (Trailforge, GridCraft) | Credit what you bought, prevent double crediting, handle disputes and accounting | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Ad-reward events (Trailforge, GridCraft) | Credit a reward once per ad and prevent abuse | Contract; legitimate interest |
| Forum text sent for translation (§15) | Make forum threads readable in your language | Legitimate interest (Art. 6(1)(f)) |
5. Who we share data with
We do not sell your data and do not share your steps or health data with third parties for advertising. Your step data is stored on our own servers to sync across your devices.
Other StepForge apps — only if you connect them yourself. A StepForge app such as Trailforge can read your steps only after you explicitly connect it, limited to the scope you approved. This is not third-party sharing: the data stays with the same operator (see §1) and on the same servers. You can see the connected apps and revoke access at any time in the app: Profile → Connected apps.
Service providers that receive data in the ordinary course of the service:
- Google — sign-in (if you use it); Google Play (purchases) and Google Play Games (Trailforge leaderboards), and AdMob advertising in the games that show ads (§12, §13).
- Telegram — sign-in, Telegram Stars payments and the notification messages of the GridCraft bot (GridCraft Telegram version).
- Adsgram — rewarded ads in the Telegram version of GridCraft.
- Anthropic (USA) — automatic translation of public forum text (§15).
These providers process the data under their own terms and privacy policies. Some information is public by design: your nickname and in-game results where an app shows leaderboards, tournaments or a market, and what you post on the forum.
6. Retention and deletion
- Account and activity data are kept while your account exists.
- Deletion: in the apps you can delete only your activity data or the whole account (Profile or Settings), and on the website you can delete the whole account in your personal account page. Deleting the account removes your account, activity data, forum threads and posts and your game profiles from our database.
- What can remain: receipts of paid subscriptions (the purchase identifier, the tier and the dates) are kept for accounting and dispute handling, but they are disconnected from your account when you delete it; if the deletion ever fails, write to us and we will complete it manually. Ad-reward events are kept without a link to your account. Data held by Google, Telegram and the other providers in §5 is governed by their policies.
- Crash reports are deleted after 90 days; request-rate counters after about a day; records of your sign-ins (IP address and user agent) are deleted about 90 days after the sign-in (a sign-in session lasts 30 days, and its record is kept for 60 more).
- Database backups are kept on the server for up to 30 days; deleted data leaves them as the backups are replaced.
- A forum post you delete is hidden from the forum; it is removed from our database when you delete your account.
7. Your rights (GDPR)
Access, rectification, erasure, restriction, objection, portability, and withdrawal of consent at any time. Exercise via the app/website settings or stepforgepro@gmail.com. The Wayfare app can export your steps and sessions as a CSV file; for any other data, write to us. You may lodge a complaint with a supervisory authority (in Poland, UODO).
8. Children
The service is not intended for anyone under 16; we do not knowingly collect their data.
9. International transfers
Google, Telegram, Adsgram and Anthropic may process data outside the EEA (including in the United States) under Standard Contractual Clauses or other mechanisms those providers rely on.
10. Security
Data transfer is protected by HTTPS. In the Android apps, access tokens are kept in the app's private, sandboxed storage, inaccessible to other apps, and are excluded from backups, device-to-device transfers and crash reports.
11. Cookies and browser storage on stepforge.pro
| Cookie | Purpose | Retention |
|---|---|---|
Session (PHPSESSID) | Keeps you signed in between requests; the same session also stores CSRF form protection. Created when you open pages of the site, whether or not you are signed in | Until you close the browser |
SFLANG | Remembers your chosen site interface language | 1 year |
SFADMIN | Sign-in of site administrators and portal artists only | Session |
user_id (legacy) | Set only by the site's older account system; the current site does not use it to sign you in | 30 days |
i (referral link) | If you arrived via a referral link, records who referred you so the referral is credited (legacy site section only) | 30 days |
No advertising or third-party tracking cookies are set on this site. Your browser's localStorage holds: whether you dismissed the cookie notice (dlCookieConsent), your language on older pages (preferredLanguage) and the open state of a panel in the artist portal (dlArtSpecOpen) — these are never sent to our servers. Some pages contact other servers, which then see your IP address: signing in with Google goes through accounts.google.com and your account page shows a Google profile picture from Google's server if you signed up through the Android app with Google. You can manage cookies in your browser settings; disabling the session cookie will make signing in impossible.
12. GridCraft
Unlike Wayfare, GridCraft shows ads and offers paid features. In addition to the general rules of this policy, the following applies to GridCraft:
Sign-in. The Android app requires sign-in with Google or Telegram (see §2). In the Telegram version we receive only your numeric Telegram ID. If you link a Wayfare account, GridCraft's Step Pass and the casino step storage use your daily step counts from it.
Advertising. We use Google AdMob, and — in the Telegram version — Adsgram, to show rewarded video ads that give in-game AT currency. These services may collect the device's advertising identifier and technical device information under Google's and Adsgram's own policies; ads may be personalised, and you can reset your advertising ID or turn off ads personalisation in your Android settings. To credit a reward once, Google's reward callback sends our server a transaction identifier, the reward and your internal user number; Adsgram's callback carries your Telegram ID. The web version of GridCraft loads scripts from telegram.org and from Adsgram (sad.adsgram.ai).
Purchases. AT packs and subscriptions can be bought through Google Play (payment data is handled by Google; Google Play subscriptions renew until you cancel them in Google Play) or through Telegram Stars (payment data is handled by Telegram; a Stars pass is a one-time 30-day purchase). We do not receive or store card numbers or other payment details; we keep the purchase identifiers and receipts needed to credit your purchase.
Google Play Games. The Android app signs you in to Google Play Games when it starts and may share achievements and leaderboard scores with Google under Google's rules.
Telegram messages. We store the Telegram chat identifier needed to message you through the game's bot and send notifications about finished matches and tournament events. To stop them, block the bot in Telegram.
Public data. Your nickname (or the numbered placeholder name), rank, win and loss record and — if you are a subscriber — your subscriber badge are visible to other players and on leaderboards; your equipped cosmetics are visible in shared matches; titles of custom rooms you create are visible to other players. The casino-style mini-games use virtual currency, have no cash-out, and require you to confirm that you are 18 or older (a self-declaration that we record); AT you bought can be converted into the casino's Coins and staked in some machines.
We do not sell GridCraft users' data and do not share it with third parties other than the services listed above, which are necessary to show ads and process purchases. Data deletion works the same way as for other StepForge apps — through in-app settings or by writing to stepforgepro@gmail.com.
13. Trailforge
Unlike Wayfare, Trailforge shows rewarded ads and offers in-app purchases.
Steps. The game does not read the step sensor. If you choose Health Connect as the step source, it reads your steps from Health Connect as described in §3; if you connect it to your StepForge account, it can also read your daily steps, distance and calories from our servers (see §5).
Advertising. We use Google AdMob rewarded video ads, shown only when you choose to watch one for AT currency. AdMob may use the device's advertising identifier and technical device information under Google's own policies, and ads may be personalised; you can reset your advertising ID or turn off ads personalisation in your Android settings. To credit a reward once, Google's reward callback sends our server a transaction identifier, the reward, the ad unit and your internal user number; with each reward we also record the device manufacturer and model for abuse checks.
Purchases. AT packs and subscriptions are bought through Google Play, which handles payment data. To verify a purchase we receive from Google the product, the purchase token, the order number and Google's confirmation, and keep them in your purchase record. We do not receive card numbers.
Google Play Games. If you use Google Play Games, the game shares your character level, number of crafted items, collected pets, tournament wins and raid damage with Google Play Games as leaderboard scores and achievements, shown under Google's rules.
Public data. Your nickname and results are visible to other players in tournaments, raid results and the marketplace.
Notifications in the game are local to your device. Deleting your account (Settings) also asks the game server to delete your game profile; if that request fails, write to stepforgepro@gmail.com.
14. Forum and user content
Forum threads, replies and images you post, together with your nickname (or the numbered placeholder name), are public. Images may contain metadata such as location — remove it before uploading. Posts you report or that others report are reviewed by moderators; a report stores the reporter and the reason. Please do not post personal data in public posts. Comments under news posts, when available, follow the same rules.
15. Automatic translation by a third-party AI service
So that forum threads can be read in other languages, the text of forum thread titles and posts may be sent to the API of Anthropic (an AI provider in the United States) for automatic translation. Only the text is sent — not your name, nickname, account or any identifier; the translation is stored on our server next to the original. Because forum text is written by users it may contain personal data you chose to post; do not post anything you do not want processed this way.
16. Changes
On material changes we update the effective date and, where appropriate, notify you in the app.