Privacy policy

Last updated: 10 October 2026

StepMetrics is a product of Deepapps (“we”, “us”). This policy describes information handled through our website, hosted dashboard, analytics service, API and connected tools. For questions or privacy requests, use our contact form and include “Privacy” in the subject.

Our website and our customers’ websites

We use information about our own visitors and account holders to operate StepMetrics. We also process analytics that customers send from their websites, apps and servers. Those customers choose what to measure, who can access it and which optional collection features to enable. If you visited a customer’s website, its own privacy notice also applies; contact that operator first about its use of your information. Self-hosted installations are operated by whoever hosts them.

Information we collect

• Account information: email address, a hashed password, workspace membership, account settings, authentication and security records, and subscription status.
• Support information: the name, email address, subject and message you submit through our contact form, and information you provide when requesting help.
• Analytics and request information: IP address, user agent, selected request headers, page paths and query strings, referrers, campaign parameters and ad click identifiers, timestamps, events and their properties. We derive information such as approximate location, device and browser type, sessions and bot signals. Raw IP addresses and user agents are retained with request telemetry; daily visitor identifiers do not make that telemetry anonymous.
• Browser activity: page views, engagement and reading measurements, performance measurements, outbound link clicks and downloads. Customers may send custom events, purchase values and other event properties. Search-term capture is optional and requires the site operator to enable it.
• Device information: when fingerprinting is enabled, screen characteristics, time zone, languages, platform, processor and memory information, touch support, graphics information, detected fonts and a hash of a rendered test image. A device fingerprint helps identify likely returning devices and is not a guaranteed match to a person.
• Optional service data: uptime checks and incidents, and agent telemetry such as run and step names, model names, token usage, costs, timing, status and properties supplied by a customer’s integration.

Customers should avoid including passwords, payment details or other sensitive information in URLs, event properties or telemetry. Request telemetry does not persist the Cookie or Authorization headers.

Cookies, device fingerprints and browser storage

Our marketing website loads StepMetrics analytics only after you choose “Accept analytics” in the cookie notice. Rejecting keeps the tracker off, including fingerprinting. You can change cookie settings at any time. Our cookie policy explains the choices and storage lifetimes. When enabled, the tracker sets a first-party stepmetrics_id cookie containing a random browser identifier. It lasts up to 400 days after the most recent visit, subject to shorter browser limits, and its identifier is sent with analytics events to recognize returning browsers. Device fingerprinting works independently of the cookie and is enabled under the same analytics consent on our marketing website.

Site operators can disable the tracking cookie with data-cookieless and disable fingerprint collection with data-no-fingerprint. These controls are separate: disabling the cookie does not disable fingerprinting or request telemetry. See the installation guide for details. Operators are responsible for providing notices and obtaining consent where required before loading their tracker.

To stop this browser sending StepMetrics analytics on our marketing website, choose “Reject analytics” in cookie settings. We remember your choice in local storage for 180 days. Clearing that storage or using another browser requires setting the preference again. Rejecting removes the analytics cookie and stops future tracker events; it does not delete previously collected data or prevent requests needed to serve the website.

The dashboard also uses cookies for sign-in and recognizing a known sign-in device, and browser storage for preferences such as theme, selected workspace and date range. Blocking authentication cookies may prevent you from signing in. Our contact form uses Cloudflare Turnstile to check for automated submissions.

Why we use information

We use information to provide accounts and analytics, process subscriptions, send verification, password-reset and configured alert emails, respond to support requests, measure use of our own website, and investigate abuse, outages and errors. Customers use the analytics we process for them to understand their own services.

Where data protection law requires a legal basis, providing a requested service and administering an account relate to performing our contract with you; security and service maintenance relate to our legitimate interests in operating a reliable service; and required records relate to legal obligations. Where processing requires consent, that consent must be obtained and can be withdrawn. Customers determine the legal basis for analytics collected through their own sites and apps.

Who receives information

Workspace members and tools authorized by a customer can access data within their permissions. Connecting an AI agent through MCP or the API lets that agent and its provider receive the data retrieved using the supplied key. Customers can revoke keys and should consider their agent provider’s privacy practices before connecting it.

When the optional AI recommendations feature is used, analytics summaries and breakdowns are sent to Anthropic to generate recommendations, along with the site’s domain and reporting period. Breakdowns include page paths, traffic sources, countries and device categories.

Service providers handle information needed to deliver hosting, network protection, email and payments. These include Cloudflare for website hosting and contact-form protection, Amazon Web Services SES for service emails, and Polar as merchant of record for checkout and billing. Polar handles payment information and sends us purchase and subscription information to manage access. Information submitted directly to a provider is also subject to that provider’s privacy notice.

Information may also be disclosed when necessary to comply with applicable law or to investigate fraud, abuse or security incidents. Providers and authorized tools may process information in countries other than your own. Contact us for information about processing locations and any applicable transfer arrangements.

How long information is kept

Raw analytics events and request telemetry follow the workspace’s configured retention window, which defaults to 400 days and can vary by plan or configuration. Individual uptime checks follow that window; incident summaries are kept separately. The analytics retention window does not automatically delete account, billing, support or all operational records.

Account and service records are kept as needed to operate the account, resolve support matters, protect the service and meet applicable recordkeeping obligations. Contact us to request deletion or ask which records remain. Ending a subscription does not immediately delete the workspace’s analytics; its retention window continues to apply.

Your choices and requests

Depending on the law that applies to you, you may have rights to access, correct, delete or receive a copy of your personal information, restrict or object to processing, or withdraw consent. You may also complain to your local data protection authority. Use our contact form to make a request. Include the relevant account email or website and enough detail to locate the information; do not send your password or API keys. We may need to verify your identity or refer a request about a customer’s analytics to that customer.

Changes to this policy

We will update this page when our practices change and revise the date above. Where required, we will provide additional notice of material changes.