Step by Step lets creators build guides as step-by-step procedures and share them by link with the people who follow them, here called guests. This policy explains which personal data we handle when you use the site in either role, why, who helps us, and what you can ask of us.
Who we are
Step by Step is a personal demo project, run by its creator, Francesco Palandra, as a private individual, not by a company. Its creator is the controller of the personal data this policy describes (“we”, “us”). For anything in it, write to frklintech@gmail.com.
If you build guides
When you create an account and build guides, we keep:
- Your account: your email address and, if you sign in with Google, the name and profile picture Google shares with us. A password, if you choose one, is stored only as a one-way hash.
- Your workspace: your organization's name and logo, the contact guests can call (a name and a phone number), its language and time zone.
- What you build: procedures, collections and their translations, the pictures and videos you upload, and your share links with their labels and dates.
- Your messages: what you write when you contact us.
We use them to provide the service you signed up for: to keep you signed in, save and publish your work, show it to the people you share it with, send the emails your account needs (confirming your address, resetting your password) and answer you. The legal basis is our contract with you (Article 6(1)(b) GDPR). We don't send newsletters or marketing emails.
Your guides can contain personal data about other people, such as a guest's name in a link's label or a contact's phone number. For that data you are the controller, and we process it on your behalf as our terms set out.
If you follow a guide
You don't need an account, and we don't ask who you are. The guide was written by the creator who shared the link, for example your host: they are responsible for what it says and for the contact details in it.
- Your progress stays on your phone. Where you are in a procedure and the answers you give it (a room number, for example) are kept in your browser's storage so you can pick up where you left off. They are not sent to us.
- Your language. If you choose one, a cookie remembers it so guides open in it next time.
- Leaving the guide. Calling the contact, or opening an address in a maps app, hands over to your phone or that app. We don't see the call or the route.
What our servers and analytics see
This applies to everyone who visits the site.
- Requests. To deliver a page, picture or video, our hosting and storage providers receive your IP address, your browser's type and the address requested. These logs are kept for a short time, to keep the service running and protect it from abuse. The legal basis is our legitimate interest in a secure, working service (Article 6(1)(f) GDPR).
- Statistics and errors. Vercel Web Analytics and PostHog count page views, which features are used and the errors that occur, so we can see what works and fix what doesn't. Unless you say yes in the cookie banner, neither sets cookies or stores anything on your device: PostHog tells visits apart with a code it computes from your IP address and browser details, which changes every day, and it doesn't keep your IP address. Before anything is sent, a guide link's address is cut down to “a guide link”: we learn that a guide was opened, never which one. Clicks are counted without the text they were on. The legal basis is our legitimate interest in understanding and improving the service; you can object at any time by writing to us.
- Recordings, only if you agree. On the site and in the editor, a banner asks whether PostHog may set a cookie and record your visit. If you accept, PostHog recognises your browser between visits and records how you use the pages (what you click, where you scroll, how the pointer moves, which pages you open) so we can see where people get stuck. Recordings hide what you type, the text of every page except our public ones (the home page and these legal pages), and every picture and video. Guides, the editor's preview and sign-in links are never recorded, and guests are never asked. The legal basis is your consent (Article 6(1)(a) GDPR). Withdraw it at any time with Cookie settings, at the foot of this page and of the home page: PostHog then stops recording and goes back to counting visits without cookies. If your browser sends Do Not Track, we take it as a no.
Cookies and storage on your device
Most of what the site stores is needed for it to work, and needs no consent. PostHog's cookie is the exception: it is set only if you say yes in the cookie banner. Nothing here is used for advertising or to follow you across other sites.
sb-…- Cookies that keep a creator signed in, and complete a sign-in with Google.Until you sign out; at most 400 days.
ph_…- PostHog's cookie and browser storage, set only after a yes in the cookie banner: they recognise your browser between visits, for statistics and recordings.1 year, or until you say no in Cookie settings.
__ph_opt_in_out_…- Browser storage: your answer to the cookie banner, so it isn't asked again.Until you clear your browser's data.
sbs-lang- A cookie that remembers the language a guest chose for guides.1 year.
sbs:execution:…, sbs:events- Browser storage: a guest's progress and answers in a procedure, so it can resume. Never sent to us.Until you clear your browser's data.
sbs:draft:…, sbs:layout:…, sbs:compact, sbs:phone-hint- Browser storage: the editor's unsaved work, how its canvas is laid out, and whether the phone editor's one-time hint has been shown, on the creator's own device.Until you clear your browser's data.
sbs:splash- Session storage: shows the opening animation once per visit.Until the tab is closed.
Who else handles your data
These companies run parts of Step by Step for us and handle personal data to do it:
- Supabase
- Database, sign-in and file storage: accounts, workspaces, procedures, uploaded pictures and videos. Also sends the sign-up and password emails.Data stored in Ireland (EU).
- Vercel
- Hosts the site and delivers its pages; Vercel Web Analytics counts page views.Data stored in Ireland (EU), with copies of the site's public files worldwide.
- PostHog
- Usage statistics and error reports and, for visitors who accept them, cookies and recordings of their visits.Data stored in Germany (EU).
- komoot (Photon)
- Address suggestions while a creator types an address in the editor: receives what is typed.Data stored in Germany (EU).
Google, when you choose to sign in with Google, confirms who you are and shares your name, email address and profile picture with us. For that, Google is responsible under its own privacy policy.
We don't sell personal data or share it for advertising. We disclose it to authorities only when the law requires us to.
Outside the European Union
We keep your data in the EU where we can: our database and files are in Ireland, statistics in Germany. Vercel, Supabase, PostHog and Google are US companies and may access some data from outside the EU, for example to give support or keep their systems secure. Those transfers rely on the EU–US Data Privacy Framework where the company is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.
How long we keep it
- Your account and workspace: as long as your account exists. If you ask us to delete your account, we delete it and everything in its workspace within 30 days; copies in backups expire soon after.
- Things you delete: a procedure, collection or link you delete leaves our database straight away. Pictures and videos you uploaded are kept until your account is deleted.
- Request logs: a few days.
- Statistics and error reports: at most two years.
- Recordings: at most 90 days.
- Messages to us: as long as we need them to help you, at most two years.
Your rights
You can ask us to:
- show you the personal data we hold about you, and give you a copy;
- correct it;
- delete it;
- limit how we use it, or stop using it where we rely on our legitimate interests;
- give you the data you provided in a common, machine-readable format, to take it elsewhere.
You can withdraw your consent to cookies and recordings yourself, at any time, with Cookie settings. Withdrawing it doesn't make what was recorded before unlawful.
Write to frklintech@gmail.com. We answer within one month. Creators can also change and delete most of what they keep in Step by Step themselves, in the app. If a guide shared with you contains data about you, ask the creator who shared it; we will help them answer.
If you think we handle your data unlawfully, you can complain to a data protection authority in the EU country where you live, work, or where it happened. In Italy, that is the Garante per la protezione dei dati personali.
Security
Every connection to Step by Step is encrypted. Database rules keep each workspace readable and changeable only by its members. A share link's address contains a long random code, and anyone who has the link can open the guide, with the pictures and videos in it. That is why creators can give links an end date, and revoke them.
Children
Step by Step is for adults building guides: creators must be at least 18. Guides can be opened by anyone a creator shares them with; we don't ask guests' age, and collect nothing that tells us who they are.
Changes to this policy
When what we do with personal data changes, we update this page and the date at the top. If a change matters to creators, we tell them by email or in the app before it applies.