Privacy Policy

Back to home
Last updated: Last updated: September 30, 2026

This policy explains what information the GemStep website, the GemStep Android app and related services (the “Services”) collect, why, how long we keep it, who we share it with, and how you can have it deleted.

1. Who we are

GemStep is operated by Hil Group (“we”, “us”), which is responsible for your information. You can reach us at support@gem-step.com.

GemStep rewards daily walking with GEMS tokens on the Arbitrum One blockchain. It is non-custodial: we never hold your wallet, your keys or your tokens.

2. The short version

  • From your health data we read only your daily step count. Nothing else: no location, heart rate, sleep, weight or medical records.
  • We use your steps only to check your daily goal, pay your reward and show your progress.
  • We do not sell your information, use it for advertising, or share health data with advertisers or data brokers.
  • When you claim a reward, the claim (your wallet address, the number of steps and the reward) is written to a public blockchain, where anyone can see it and no one can delete it.
  • You can ask us to delete everything we hold off-chain by emailing support@gem-step.com (see section 9).

3. What we collect

3.1 Your wallet address

Your public wallet address identifies your account. We do not collect your name. When you connect a wallet or sign GemStep’s sign-in message, we confirm you control the wallet; signing costs nothing and sends no transaction.

If you create a wallet by signing in with Google, Apple, Facebook, email, phone or a passkey, that sign-in is handled by our wallet provider, thirdweb, under thirdweb’s privacy policy. GemStep receives only the resulting wallet address.

3.2 Step data from Health Connect (Android app)

With your permission, the GemStep app reads the Steps data type from Health Connect, and requests no other health permission. Each time the app syncs, it sends us:

  • your step total for the day (UTC), and
  • how many of those steps were entered by hand, so we can leave them out of your reward.

You can withdraw the permission at any time in Health Connect settings; the app then stops reading your steps.

3.3 Step data from Google Fit (website)

If you connect Google Fit on the website, we ask Google for read-only access to your activity (fitness.activity.read) plus your Google account ID (openid). We read only your daily step total. We store your Google account ID only in hashed form, to stop the same steps being claimed through more than one wallet. You can remove GemStep’s access at any time at myaccount.google.com/permissions.

3.4 Your phone link

When you link your phone to your wallet, the app creates a random device ID. We store that ID, your wallet address, the platform (Android) and a hashed device token, so the app can sync your steps without asking you to sign every time.

3.5 App and device checks

To stop fake step uploads, the Android app uses Google Play Integrity. Google tells us whether the request came from the genuine GemStep app on a genuine device. We keep that result, tied to your device ID.

3.6 Your activity history

For each day, we keep your step count, that day’s goal and how many steps you claimed. This powers your streak, badges, weekly chart and membership progress.

3.7 Technical information

  • Our hosting provider receives your IP address and basic request details, as with any website, and we use short-lived counters to limit abusive traffic.
  • Our server logs record requests and errors, which can include your wallet address and step counts, so we can fix problems and investigate abuse.
  • On the website, signing in sets one cookie (gemstep_session) to keep you signed in. We do not use advertising or tracking cookies.
  • The app stores your phone link, device ID and reminder settings on your phone. Daily reminders are scheduled on your phone; we don’t send them from our servers.

3.8 If you contact us

If you email us, we keep your email address and message to reply and to keep a record of support requests.

4. How we use it

We use your information only to:

  • check today’s steps against your goal and pay your GEMS reward;
  • stop the same steps being claimed twice, or through more than one wallet;
  • detect fake step uploads and other abuse;
  • show your progress: streak, badges, weekly chart and membership;
  • keep the Services running, secure and reliable, and answer support requests;
  • meet our legal obligations.

We do not use your information for advertising, sell it, or use your step data to decide anything about you beyond your rewards and progress in GemStep.

Health Connect and Google API data

The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements. GemStep’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Step data is used only to provide GemStep’s rewards and progress features, is not transferred except as described in section 6, and is never used for advertising.

5. The blockchain

When you claim a reward, GemStep’s relayer sends the claim to the Arbitrum One blockchain. The record includes:

  • your wallet address;
  • the number of steps claimed and the step source (e.g. Health Connect);
  • the GEMS reward and the time of the claim.

Blockchain records are public and permanent. Anyone can read them, and neither we nor anyone else can change or delete them, including in response to a deletion request. Staking and any other token transactions you make are public in the same way.

6. Who we share it with

We share information only with the providers that run GemStep for us, and only for that purpose:

  • Vercel: hosts the website and servers, and receives your requests and IP address.
  • Upstash: our database, which holds the off-chain data described above.
  • Alchemy and Arbitrum network nodes: read and submit blockchain data, so they see wallet addresses.
  • thirdweb: wallet connection and sign-in.
  • Google: Play Integrity checks and, if you connect it, Google Fit.

We may also disclose information if the law requires it, or to protect the Services and their users from fraud or abuse. If GemStep is ever sold or merged, this policy continues to apply to the information transferred.

7. How long we keep it

  • Daily step uploads from your phone, and the records that stop double claims: 48 hours.
  • Your activity history (daily steps, goal and claimed steps): about 13 months (400 days) after the last update.
  • Your phone link: 180 days after your phone last synced.
  • Google Fit connection (access tokens and hashed Google ID): 30 days after you last connected.
  • Play Integrity results: 30 days.
  • Website sign-in: 7 days.
  • Server logs: for the limited period our hosting provider keeps them.
  • Support emails: as long as needed to handle your request.
  • Blockchain records: permanently (see section 5).

8. Security

Information is sent over encrypted connections (HTTPS). Device and sign-in tokens are stored only as hashes, your Google account ID is stored hashed, and access to our systems is restricted. No system is perfectly secure, but we work to protect your information and will act promptly if something goes wrong.

9. Deleting your data

To have your off-chain data deleted, email support@gem-step.com with your wallet address. To confirm the wallet is yours, we may ask you to sign a message with it. We will delete your activity history, phone link, Google Fit connection and related records within 30 days and confirm when it’s done. Blockchain records cannot be deleted (see section 5).

You can also, at any time:

  • withdraw GemStep’s Steps permission in Health Connect settings;
  • remove GemStep’s Google access at myaccount.google.com/permissions;
  • uninstall the app, which deletes the data it stores on your phone.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to complain to your data protection authority. To use any of these rights, email support@gem-step.com.

11. Age requirement

GemStep is only for people aged 18 or over (or the age of majority where you live, if higher). We do not knowingly collect information from anyone younger; if we learn we have, we will delete it.

12. International transfers

Our providers may process information in countries other than yours, including the United States. Where the law requires it, we rely on appropriate safeguards for these transfers.

13. Changes to this policy

If we change this policy, we will post the new version here with a new date. If a change significantly affects how we use your information, we will also tell you in the app or on the website.

14. Contact