Privacy policy

Last updated: November 7, 2026

Overview

Dino Steps is an iOS app made by Kacper Kalicki Tryhard Solutions, Poland (“we”, “us”). This policy explains what data the app handles, where it goes and why.

In short: your tasks and progress stay on your device. When you ask Dino to break a task into steps, the task text goes through our server to OpenAI to create the steps. The app also uses Google Firebase for that server, for usage statistics and crash reports, and RevenueCat for purchases. You don't create an account, and the app never asks for your email address or phone number.

Data that stays on your device

• your tasks and their steps
• the name you give in onboarding
• your dino's level, experience points and rewards
• settings such as sounds, haptics, focus mode and reminders

Home Screen widgets read this data from storage that only Dino Steps and its widgets share on the same device. Your data is included in your device's iCloud or computer backup if backups are on. It's deleted when you delete the app.

AI task breakdown (our server and OpenAI)

When you ask Dino to break a task into steps, the app sends the text of that task over an encrypted connection to our server, which runs on Google Firebase Cloud Functions. The server passes the text to OpenAI, which writes the steps and sends them back. Please don't put sensitive personal information in a task.

• Our server doesn't store the task text.
• So the same task isn't sent to OpenAI twice, the server keeps the generated steps for up to 30 days. They're filed under a one-way hash of the task text. This cache is shared by all users and isn't linked to you.
• OpenAI processes the text under its API terms. OpenAI says it doesn't use data sent through its API to train its models, and that it may keep it for up to 30 days to watch for abuse. See the OpenAI Privacy Policy.

Anonymous sign-in and daily limits

To count how many breakdowns you've used and to know whether you have Premium, the app signs in to Firebase Authentication anonymously. This creates a random ID without any personal details. Our server keeps, under that ID, your plan (free or Premium) and how many breakdowns you used each day.

To stop abuse, the server also keeps a one-way hash of your IP address for up to one day. Firebase App Check, which uses Apple's App Attest, confirms that requests come from the real app.

Usage statistics (Google Firebase Analytics)

Dino Steps uses Google Firebase Analytics to see how the app is used and what to improve. It records events such as:

• screens opened, onboarding steps and settings changed
• tasks created, started, completed or deleted, with the number of steps, the difficulty and how long it took
• the length of a task's text and of your name, never the text itself
• level-ups, rewards, focus mode, and paywall and purchase steps
• whether you have Premium

Firebase also collects technical data: device model, iOS version, app version, language, an identifier for this installation, and an approximate region worked out from your IP address.

Crash reports (Firebase Crashlytics)

If the app crashes, Firebase Crashlytics sends us a crash report. It contains the technical details of the crash, the device model, iOS and app version, and a Crashlytics installation identifier. It contains none of your tasks.

Purchases (Apple and RevenueCat)

Apple processes subscriptions, and we never see your payment details. Dino Steps uses RevenueCat to check which purchases are active. RevenueCat receives your App Store transaction details, the anonymous ID described above and basic device information.

We don't use any of this for advertising. Dino Steps never asks for permission to track you, so it can't use your device's advertising identifier.

Service providers

• Google Firebase (Authentication, Cloud Functions, Firestore, App Check, Analytics, Crashlytics): Firebase privacy information, Google Privacy Policy
• OpenAI: OpenAI Privacy Policy
• RevenueCat: RevenueCat Privacy Policy
• Apple (App Store purchases, App Attest): Apple Privacy Policy

These providers may process data in the United States. Those transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. We don't sell or rent your data, and we don't share it with advertisers or data brokers.

Legal bases (EEA and UK)

• Breaking down tasks you ask for, daily limits and purchases: performing our contract with you (Art. 6(1)(b) GDPR).
• Abuse protection, usage statistics and crash reports: our legitimate interest in keeping the app secure, working and improving (Art. 6(1)(f) GDPR). You can object at any time.

How long data is kept

• Data on your device: until you delete it or delete the app.
• Task text: not stored on our server. Generated steps: up to 30 days. IP hash: up to one day.
• Plan and daily usage counts: for as long as you use the app. Ask us and we'll delete them.
• Usage events: kept by Google for up to 14 months. Crash reports: up to 90 days.
• Purchase records: kept by RevenueCat and Apple for as long as your purchases need them and the law requires.

Your rights

You can ask us to access, correct, delete or restrict your personal data, to transfer it, or object to how we use it. Because the app has no accounts, include anything that helps us find your data, such as your App Store receipt. You can also complain to a data protection authority. In Poland that's the President of the Personal Data Protection Office (UODO).

Children

Dino Steps is not meant for children under 13, and we don't knowingly collect data from children.

Changes

We update this page when the app's data practices change, and note important changes in the App Store release notes. The date at the top shows the current version.

Contact

Kacper Kalicki Tryhard Solutions, Poland
[email protected]