Step Planet is operated by Heicy Technology Limited, a company registered in Hong Kong (the "Company", "we", "us"). We are the data user responsible for the personal data described in this policy. The app is used by parents and by children aged 3 to 15, so this policy is written to be read by a parent and explained to a child.

1. Who holds the account

An adult opens the account. Children join a family through an invitation from that adult and do not register on their own. The adult account holder controls which features are switched on, including any location or screen time features, and can turn them off at any time.

2. What we collect

• Parent account information — email address, a display name, and an encrypted password. If you sign in with Apple, we receive only the identifier and the email address Apple passes to us.
• Child profile — a name or nickname chosen by the family, an avatar chosen from our built-in set, and an age or year of birth used to set age-appropriate defaults. A child's real name is never required.
• Habit and reward records — the habits set by the parent, completion marks, points earned and spent, wish list items, and any notes written in the app.
• Device and diagnostic information — device model, operating system version, app version, language setting, and crash reports.
• Location data (optional) — see section 5.
• Screen time and app usage data (optional) — see section 6.
• Correspondence — messages you send to our support address.

We do not ask for identity document numbers, school records, precise home addresses, contacts, photos from your library, or payment card details.

3. Why we use it

• To operate the app: showing habits, recording completions, calculating points, and syncing between family members' devices.
• To keep accounts secure and to prevent abuse.
• To produce the summaries and growth charts shown to your own family, generated from that family's own records only.
• To fix problems, using aggregated crash and performance data.
• To answer your enquiries.

We rely on your consent, and on the necessity of processing to provide the service you have asked for. Where consent is the basis, you may withdraw it at any time in the app's settings.

4. What we never do

• We do not sell or rent personal data to anyone.
• We do not use children's data to train models for third parties.

5. Location

Location sharing is off by default. It works only when a parent switches it on for a specific child and the child's device grants the operating system permission. When it is on, the child's device sends its location so that the parent can see it on a map and receive arrival alerts for places the parent has set, such as school or home.

The child sees an indicator in the app whenever location sharing is active. Location history is kept for 30 days and then deleted automatically. Either the parent or the child can turn location sharing off; turning it off stops collection immediately.

6. Screen time and app limits

Where the operating system provides parental control interfaces, these are used only with the permissions the device asks the parent to grant. Any category and usage information stays on the device or within the family's own account, is shown only to the parent and the child concerned, and is not transmitted to any third party.

7. Service providers

We use a small number of providers to host data, deliver notifications, and send email. They act on our instructions, may use the data only to provide their service to us, and are bound by confidentiality obligations. We do not permit them to use the data for their own purposes.

8. Where data is stored

Data is stored on servers located outside Hong Kong, and it may therefore be transferred and processed outside Hong Kong. We apply the same protections described in this policy wherever it is processed.

9. How long we keep it

• Habit and reward records: for as long as the account is active.
• Location history: 30 days.
• Crash and diagnostic data: 12 months.
• Support correspondence: 24 months.

When an account is deleted, the family's records are erased from our live systems within 30 days and from backups within 90 days.

10. Security

Data is encrypted in transit and at rest. Access by our staff is limited to those who need it to run the service and is logged. No system is perfectly secure, but if a breach affects your data we will notify you and the relevant authority without undue delay.

11. Your rights

Under the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong you may ask us whether we hold your personal data, request a copy of it, and request correction of anything inaccurate. A parent may exercise these rights on behalf of a child in the family. You may also ask us to delete an account and its records.

Write to info@stepplanet.com. We respond within 40 days, as the Ordinance requires. We may need to verify your identity before acting on a request.

12. Children

The app is designed for children under a parent's supervision. Children cannot open an account, make purchases, message people outside the family, or share anything publicly. There is no open chat, no user-generated content visible to strangers, and no external link that a child can follow out of the app without a parent's confirmation.

13. Changes to this policy

If we change this policy, we will post the new version here with a new effective date. If a change materially affects how children's data is handled, we will notify account holders by email and ask for consent again where the law requires it.

14. Contact

Heicy Technology Limited
RM 803, TUNG YIP COMM BLDG 248, DES VOEUX RD, CENTRAL, HK
Email: info@stepplanet.com
Telephone: +852 6886 6994

腳印星球由Heicy Technology Limited(於香港註冊成立的公司,下稱「本公司」)營運。本公司為本政策所述個人資料的資料使用者。應用的使用者包括家長,以及 3 至 15 歲的孩子,因此本政策以家長能讀懂、並能向孩子解釋的方式撰寫。

1. 帳戶由誰持有

帳戶由成年人開立。孩子透過該成年人的邀請加入家庭,不能自行註冊。成年帳戶持有人控制哪些功能啟用,包括所有位置及螢幕時間相關功能,並可隨時關閉。

2. 我們收集甚麼

• 家長帳戶資料——電郵地址、顯示名稱及加密後的密碼。如以 Apple 帳戶登入,我們只會收到 Apple 傳送的識別碼及電郵地址。
• 兒童檔案——由家庭自行選定的名稱或暱稱、由我們提供的頭像,以及用於設定適齡預設值的年齡或出生年份。任何情況下都不要求提供孩子的真實全名。
• 習慣及獎勵記錄——家長設定的習慣、完成記錄、獲得及使用的積分、心願清單項目,以及在應用內填寫的備註。
• 裝置及診斷資料——裝置型號、系統版本、應用版本、語言設定及當機報告。
• 位置資料(可選)——見第 5 節。
• 螢幕使用時間及應用使用資料(可選)——見第 6 節。
• 通訊往來——你寄至我們支援信箱的訊息。

我們不會索取身分證明文件號碼、學校成績記錄、住址門牌、通訊錄、相簿照片或信用卡資料。

3. 用途

• 營運應用:顯示習慣、記錄完成情況、計算積分,以及在家庭成員的裝置之間同步。
• 保障帳戶安全及防止濫用。
• 生成只供你自己家庭查看的摘要及成長圖表,資料僅來自該家庭本身的記錄。
• 以匯總後的當機及效能資料修正問題。
• 回覆你的查詢。

我們的處理基礎為你的同意,以及為提供你所要求的服務所必需。凡以同意為基礎者,你可隨時在應用設定中撤回。

4. 我們不會做的事

• 不會向任何人出售或出租個人資料。
• 不會將兒童資料用於為第三方訓練模型。

5. 位置

位置分享預設關閉。只有當家長為特定孩子開啟、且該孩子的裝置在系統層面授權後,功能才會運作。啟用期間,孩子的裝置會傳送位置,讓家長在地圖上查看,並就家長設定的地點(例如學校或住所)收到到達提示。

位置分享啟用時,應用內會向孩子顯示提示標記。位置歷史保留 30 天後自動刪除。家長或孩子任何一方都可以關閉;一經關閉即時停止收集。

6. 螢幕時間與應用限制

凡作業系統提供家長監護介面者,我們僅在裝置向家長索取並獲授權的範圍內使用。相關的類別及使用時間資訊留存於裝置或該家庭自己的帳戶內,只向該家長及相關孩子顯示,不會傳送予任何第三方。

7. 服務供應商

我們使用少量供應商提供資料寄存、推送通知及電郵發送服務。他們按我們的指示行事,只可為向我們提供服務而使用資料,並受保密責任約束。我們不允許他們將資料用於其自身目的。

8. 資料存放地點

資料存放於香港境外的伺服器,因此可能會被轉移至香港境外處理。無論在何處處理,我們均採用本政策所述的相同保護措施。

9. 保留期限

• 習慣及獎勵記錄:帳戶有效期間。
• 位置歷史:30 天。
• 當機及診斷資料:12 個月。
• 支援通訊記錄:24 個月。

帳戶刪除後,該家庭的記錄會於 30 天內從我們的線上系統清除,並於 90 天內從備份中清除。

10. 保安

資料在傳輸及儲存時均經加密。本公司員工的存取權限僅限於營運服務所需者,並會留下記錄。沒有系統可以做到絕對安全,但若發生影響你資料的外洩事件,我們會在無不當延誤的情況下通知你及相關監管機構。

11. 你的權利

根據香港《個人資料(私隱)條例》(第 486 章),你可查詢我們是否持有你的個人資料、索取副本,並要求更正任何不準確之處。家長可代表家庭內的孩子行使上述權利。你亦可要求我們刪除帳戶及其記錄。

請電郵至 info@stepplanet.com。我們會按條例要求於 40 天內回覆。在處理要求前,我們可能需要核實你的身分。

12. 兒童

本應用設計為在家長監督下由兒童使用。孩子不能開立帳戶、不能付款、不能與家庭以外的人通訊,亦不能公開分享任何內容。應用內沒有開放式聊天、沒有陌生人可見的用戶生成內容,亦沒有孩子可在未經家長確認下跳出應用的外部連結。

13. 政策修訂

如本政策有修訂,我們會在此頁發布新版本並註明新的生效日期。若修訂對兒童資料的處理有重大影響,我們會以電郵通知帳戶持有人,並在法律要求時重新徵求同意。

14. 聯絡我們

Heicy Technology Limited
RM 803, TUNG YIP COMM BLDG 248, DES VOEUX RD, CENTRAL, HK
電郵:info@stepplanet.com
電話:+852 6886 6994