Privacy Policy

1. Data we process and why

General training: your selected language (ko/ja/en) is saved in browser local storage so the same language appears on your next visit.

Google sign-in and PRO trial: we process your email address, display name, profile photo URL, provider identifier, and Firebase user ID. When you start the 14-day trial, we store your Firebase user ID, application and start timestamps, source (web/android), and terms version in Cloud Firestore to enforce one trial per account and manage access.

Usage analytics: Firebase Analytics processes an app-instance identifier, device, browser, operating-system and app-version information, approximate region, session information, and events such as page views, login, language changes, training starts and completions, PRO trial starts, and opening the extension form. We do not include email addresses, names, Firebase user IDs, or health information in analytics events. Advertising-ID collection and ad personalization are disabled.

Access data: Cloudflare may process IP addresses, request URLs, timestamps, user agents, and error or security events to deliver, secure, and troubleshoot the service.

PRO extension requests are submitted through an external Google Form. Google and the READY STEP operator process the information entered there; the actual form will disclose its fields, purposes, and retention period.

2. Retention and deletion

After a verified deletion request, we delete the Firebase Authentication account, the Cloud Firestore PRO trial record, and linked data controlled by READY STEP. Firebase states that authentication IP logs may remain for a few weeks and other authentication data is removed from live and backup systems within 180 days after the customer initiates deletion. User-level Firebase Analytics event data is retained for no more than 14 months under the Analytics property setting; aggregated or de-identified statistics may remain afterward. Because Analytics data is not linked to the sign-in identifier, it may not be possible to identify and delete a particular analytics record at the same time as an account. Cloudflare access records are retained for the minimum period required for security and troubleshooting. Records required by law are isolated for the required period and then securely deleted.

3. Service providers and international transfers

Google LLC provides Firebase Authentication for account authentication and Firebase Analytics for usage measurement. Account, access, and analytics information may be processed in the United States and other countries where Google or its processors operate facilities.

Cloudflare, Inc. provides site delivery, CDN, security, and request-log processing. Access data is transferred when you visit and may be processed where Cloudflare or its subprocessors operate facilities. Each provider protects data under its contract and privacy terms.

4. Sharing and sale

READY STEP does not sell personal data. We do not disclose it to third parties unless you consent or the law permits or requires it. The providers above act on our behalf to perform the listed services.

5. Your rights

You may request access, correction, deletion, restriction, or withdrawal of consent from ‘Request account and data deletion’ in the app or by following https://readystep.app/en/account-deletion and emailing privacy@readystep.app. After verifying the requester, we will process the request without undue delay and confirm the result by email. You can also revoke READY STEP access in your Google Account security settings.

6. Cookies and local storage

Browser local storage and authentication storage remember language and maintain sign-in sessions. Firebase Analytics may use cookies or similar browser identifiers to measure visits and product usage. Advertising storage and ad-personalization signals are disabled. You may limit analytics collection through browser cookie and site-data controls or a Google Analytics opt-out tool, although blocking all storage may also limit sign-in and language persistence.

7. Security

We use reasonable measures including HTTPS, authentication-provider security controls, least-privilege access, access controls, and operational log review. If a qualifying data incident occurs, we will notify users and authorities as required by law.

8. Children

READY STEP does not currently offer a verified parental-consent process for children under 14 and therefore does not accept account registration from children under 14 until such a process is available.

9. Contact and changes

Privacy contact: privacy@readystep.app Operator: READY STEP operator (legal name, address, and contact details must be added before launch)

We will announce material changes on the site before they take effect.