Your steps. Your choice.

HiSteps privacy policy · ICSR Tech LLC

Effective September 20, 2026

HiSteps, previously developed under the name Moss, helps you track walking goals, join private crews and take part in optional weekly leagues. ICSR Tech LLC operates the app and its services at moss.icsr.cc. Contact support@icsr.cc about privacy or your data.

Your health permissions and step data

With your permission, HiSteps reads step counts from Apple Health (HealthKit) or Health Connect to display daily totals, goal days, XP and progress. It does not write health records or request heart rate, contacts or precise location. Health access is optional. Without visible step data, we do not invent activity or award steps.

Personal progress is stored on your device. Signing in alone does not upload your step history. These are separate choices:

Private cloud backup: when you confirm an upload, we store your daily step totals, dates and timezones, goals and plans, reading status and timestamps, and unlocked/acknowledged rewards in your account. Backups are manual. A saved interrupted upload may be retried unchanged; it can contain an earlier snapshot.
Weekly activities: when you explicitly confirm a crew task or enroll in a league, we store the chosen goal, timezone, week, participation and installation identifier. When you use competition sync, daily aggregate step totals, dates, reading quality and revisions are sent to our server to calculate results and handle corrections. Signing in, joining a crew or backing up does not enroll you in a weekly activity.
Exports: when you export progress, the file includes step history and rewards. You choose its destination and who receives it. An export does not remove data from HiSteps.

Competition source checks inspect available source and manual-entry metadata on your device. The server receives aggregate daily readings and their quality status, not an export of individual sensor records or a list of other apps. Your original Apple Health and Health Connect records remain under those services’ controls.

Crew members see the crew name, member nicknames and short member codes, membership and leadership information. Weekly participants share their chosen goal, completed goal-day count and task contribution. League participants see competition aliases, scores and standings. Your email and exact step totals are not shown to other members. A league alias is not anonymous to us: we associate participation with your account to operate the competition.

Invitation holders can preview a crew’s name, timezone, size and invitation expiry after signing in, before choosing to join. Treat invitation links as private. Their codes are kept in the link fragment and are not sent to our invitation webpage server. The app sends the code when you check or use it.

Accounts, community and support

For email login, we process your email, account ID, verification and session records. We store device installation IDs for account and competition consistency, goals, participation, memberships, nicknames, invitations and leadership transfers. Blocks and categorized reports support community protection. Reporting does not automatically remove another member. We process correspondence and attachments you choose to send support; please do not send passwords or login codes.

Operation and service providers

We use data to provide the features you choose, calculate progress fairly, secure accounts, handle abuse and answer requests. Our servers process IP addresses, request paths, timestamps and status codes for operation and security. HiSteps has no advertising or cross-app tracking SDK. We do not sell personal information or use health data for advertising.

Account login and application databases run on infrastructure managed by ICSR Tech LLC, including Contabo hosting. Cloudflare provides domain and network services where configured. Mail providers route verification and support messages. Apple and Google operate their own health, operating-system and store services. Service providers process information needed to operate these services. Information may be processed outside your country. App-to-server connections use HTTPS, and access to server data is restricted.

The current HiSteps version does not offer in-app purchases. We will update the relevant disclosures before introducing paid features.

Retention and deletion

Local progress stays until you clear it in Me → Clear local progress or remove the app’s data. Signing out keeps local progress. Clearing local progress does not delete a cloud backup or an account. Account progress, private backups and participation records are retained while needed to provide the account and its features; weekly rollover alone does not delete history.

You can request account deletion in Me → Your account → Delete account, or through our web deletion instructions. We verify ownership before processing. Completed deletion removes the login identity, private backup and associated personal progress from the live service. The app clears a local copy linked to that account when it learns deletion is complete. Copies on other offline devices and files you exported must be removed on those devices.

Leaving a crew or its task removes your individual task attribution and its uploaded task readings. Fixed team targets and capped contributions can remain without your account attribution so other members’ results are not rewritten. Crew names and other shared content may remain for remaining members. Reports can retain category, decision and time after account references are removed. Limited deletion receipts and information needed for security, support or legal obligations may also be retained.

Restricted rolling database backups are scheduled to expire within 30 days. A deleted record may remain in those backups until expiry. Support correspondence is retained as needed to resolve the request and meet applicable obligations.

Your choices

You can use personal progress without an account, refuse health access, choose each upload and weekly activity, leave activities, block crew members, export your local progress and request account deletion. Revoke health access in Apple Health or Health Connect; this stops future reads but does not erase previously saved or uploaded information. Deleting HiSteps does not delete the original health-service records.

For access, correction or deletion requests not available in the app, email support@icsr.cc. We may verify your identity before acting. Additional rights, such as objections, restrictions or complaints to a local authority, may apply where you live.

Children and changes

HiSteps is not directed to children under 13. Contact us if you believe a child has provided personal information. We may update this policy when features or practices change; the effective date identifies the current version.