Privacy Policy
Last updated: 4 October 2026
FloSteps is operated by Hasan Sleiman, Viale Alessandro Guidoni, Firenze, Italy. For any question about this policy or your personal data, contact us at info@flosteps.it.
For the purposes of GDPR, FloSteps acts as the “data controller” for the personal data described below.
| What we collect | Examples | Why |
|---|---|---|
| Account information | Email address, password (stored as a secure hash, never in plain text), full name | To create and secure your account |
| Points & activity history | Which sustainable actions you’ve completed, when, your points balance, CO2 saved | To run the core rewards system and show your progress |
| Location-derived data | Which city zone an action happened in (e.g. “Oltrarno”), total distance walked/cycled, whether you visited a suggested area | To calculate crowd-based bonuses and verify GPS-based actions |
| Reward redemptions | Which tier rewards you’ve unlocked and redeemed, which partner confirmed it | To prevent duplicate redemptions and support partner businesses |
| Language preference | Your chosen app language (English/Italian) | To remember your preference between visits |
| Location consent record | Whether you allowed or declined GPS features, and the date you chose | To honor your choice on every device and show that consent was given |
Your phone’s exact GPS coordinates are processed entirely on your own device while you’re using features like walking, cycling, or the City Explorer. We never transmit or store your raw location trail on our servers — only the results we actually need, like a total distance, a general city zone, or whether you reached a specific area. This is a deliberate design choice, not just a policy promise.
We keep your account and activity history for as long as your account remains active. If you delete your account yourself in the app (Profile → Delete my account), your profile, points and activity history are deleted immediately. If you ask us to delete your data by email instead, we do so within 30 days. In both cases we may keep certain records only where we are legally required to.
We work with a small number of service providers who process data on our behalf, under contract:
We do not sell your personal data to anyone, for any purpose.
Your core data is hosted in Ireland, within the EU. Some of our service providers (including Supabase, as a company) are based outside the EU and may be subject to non-EU law in limited circumstances; where this applies, it is covered by Standard Contractual Clauses as required under GDPR.
Under GDPR, you have the right to:
To exercise any of these rights, contact us at info@flosteps.it.
Passwords are never stored in plain text. Access to the database is restricted and encrypted in transit (HTTPS). We take reasonable technical and organizational measures to protect your data, though no system can guarantee absolute security.
We use your browser’s local storage to remember things like your language preference, your location-consent choice, your login session, and in-progress walk/activity tracking, directly on your device. This is used only to make the app function properly, not for advertising or third-party tracking.
FloSteps is not directed at children under 16. We do not knowingly collect personal data from children under this age.
We may update this policy from time to time. We’ll note the date of the latest revision at the top of this page.
Questions, requests, or concerns about your data: info@flosteps.it