Privacy Policy

Effective June 20, 2026

1. Information we collect

a. Information you provide

• Account: email address, password (stored hashed), display name, role (student / parent), language preference.
• Registration form: student name, birthday, gender, parent name (when registering as a parent), phone number, WeChat ID, emergency contact, and optional health notes or special needs.
• Chat content: text messages, photos, and audio recordings you send in class chat groups.
• Payment: we use Stripe for card and ACH payments. Stripe collects and processes your payment details directly — we never see or store your full card number. We retain the transaction amount, status, and last 4 digits.

b. Information collected automatically

• Device data: device model, OS version, app version, and an anonymous device identifier used solely to deliver push notifications.
• Push notification token: issued by Apple (APNs) or Google (FCM) so we can send class reminders and chat alerts.
• Attendance: when you scan a class QR code, we record the class, time, and your user ID for attendance tracking.
• Camera & photo library: only when you choose to scan a QR code or attach a photo to a chat message. Photos are sent to our chat storage only when you send them.
• Microphone: only when you tap to record an audio message in chat.

c. Information we do not collect

• Precise location (GPS) — we do not request or use location services.
• Contacts, calendar, or other apps' data.
• Background microphone, camera, or screen recording.

2. How we use information

• Create and operate your account; authenticate you.
• Process enrollments, attendance, and payments.
• Deliver class chat messages and push notifications.
• Provide customer support and respond to your inquiries.
• Detect fraud, abuse, and security incidents.
• Comply with our legal obligations.

3. Who we share with

We do not sell or rent your personal information. We share it only with:

• Supabase — our backend host (database, authentication, file storage). U.S. infrastructure.
• Stripe — payment processing.
• Apple (APNs) and Google (FCM) — push notification delivery.
• Expo — push notification token routing (we use the Expo Notifications service to relay messages to APNs / FCM).
• Studio staff — instructors and administrators of StepZ Dance Academy view enrollments, attendance, registration details, and chat content for the purpose of running classes.
• Legal authorities — when required by law, subpoena, or to protect rights, property, or safety.

4. Children's privacy

The Service includes classes for students under 13. When registering a child, the parent or legal guardian must complete the registration form. By doing so, the parent consents to our collection of the child's name, birthday, gender, and (optional) health notes for the sole purpose of operating dance classes.

Children do not create their own accounts. Children's information is never used for advertising or shared outside the purposes above. Parents may review, modify, or delete their child's information at any time by contacting us at [email protected].

We comply with the U.S. Children's Online Privacy Protection Act (COPPA).

5. Data retention

We keep your information while your account is active and for a reasonable period afterward to handle disputes, comply with tax and accounting requirements, and operate the studio.

• Account & registration data: until you request deletion.
• Payment records: 7 years (U.S. tax requirements).
• Chat messages: until deleted by you or by an administrator.
• Attendance records: 3 years.

6. Your rights

You may at any time:

• Access the information we hold about you.
• Correct inaccurate or incomplete data through your profile settings.
• Delete your account and associated personal data at any time, from Settings in the StepZ app. Payment records we are required to keep for tax and accounting purposes are retained with your name and contact details removed.
• Export your data in a machine-readable format.
• Opt out of non-essential push notifications via your device settings.

California residents have additional rights under CCPA / CPRA. EU and UK residents have rights under GDPR. To exercise any right, email [email protected]. We will respond within 30 days.

7. Security

All traffic between the app and our servers is encrypted with TLS. Passwords are hashed (we cannot recover your password — only reset it). Row-level security policies on our database restrict each user to their own records. No system is 100% secure; please notify us promptly at [email protected] of any suspected breach affecting your account.

8. International users

The Service is operated from the United States. If you access it from outside the U.S., your information is transferred to and processed in the United States, which may have data protection laws different from your jurisdiction.

9. Changes to this policy

We may update this policy from time to time. Material changes will be announced in the app or by email at least 14 days before they take effect. The “Effective” date above always reflects the latest version.

10. Contact

Questions or concerns? Email [email protected].

隐私政策

生效日期：2026 年 6 月 20 日

一、我们收集的信息

a. 您提供的信息

• 账户：电子邮箱、密码（以哈希形式存储）、显示名称、角色（学员/家长）、 语言偏好。
• 报名表：学生姓名、生日、性别、家长姓名（家长身份注册时）、电话、微信号、 紧急联系人、可选的健康状况或特殊需求。
• 聊天内容：您在班级群组中发送的文字、图片和语音。
• 支付信息：我们使用 Stripe 处理银行卡和 ACH 支付。Stripe 直接收集和处理 您的支付细节——我们从不接触或存储您的完整卡号。我们仅保留交易金额、状态和卡号后四位。

b. 自动收集的信息

• 设备数据：设备型号、操作系统版本、应用版本，以及仅用于推送通知的匿名 设备标识。
• 推送令牌：由 Apple (APNs) 或 Google (FCM) 颁发，用于发送上课提醒和聊天 通知。
• 考勤：当您扫描课程二维码时，我们记录课程、时间和您的用户 ID 以追踪考勤。
• 相机和相册：仅当您主动扫描二维码或在聊天中附加图片时使用。图片仅在您 发送时上传到我们的聊天存储。
• 麦克风：仅当您在聊天中点击录制语音消息时使用。

c. 我们不收集的信息

• 精确位置（GPS）——我们不请求也不使用定位服务。
• 通讯录、日历或其他应用程序的数据。
• 后台麦克风、相机或屏幕录制。

二、我们如何使用信息

• 创建和运营您的账户，验证您的身份。
• 处理报名、考勤和付款。
• 发送班级聊天消息和推送通知。
• 提供客户支持，回应您的咨询。
• 检测欺诈、滥用和安全事件。
• 履行我们的法律义务。

三、信息共享对象

我们不会出售或租赁您的个人信息，仅与以下对象共享：

• Supabase——我们的后端托管服务（数据库、身份验证、文件存储），美国基础设施。
• Stripe——支付处理。
• Apple (APNs) 和 Google (FCM)——推送通知的分发。
• Expo——推送通知令牌的路由（我们使用 Expo Notifications 服务中继消息至 APNs / FCM）。
• 舞蹈学校工作人员——StepZ Dance Academy 的教师和管理员出于运营课程的目的 查看报名、考勤、报名细节和聊天内容。
• 法律部门——在法律、传票要求时，或为保护权利、财产或安全时。

四、儿童隐私

本服务包含面向 13 岁以下学员的课程。为未成年人报名时，必须由家长或法定监护人填写报名表。家长以此方式同意我们仅出于运营舞蹈课程 的目的收集儿童的姓名、生日、性别和（可选的）健康备注。

儿童不创建自己的账户。儿童信息绝不用于广告，也不会用于上述目的之外的共享。家长可随时 通过 [email protected] 查阅、修改或删除其孩子的信息。

我们遵守美国《儿童在线隐私保护法》(COPPA)。

五、数据保留期限

• 账户和报名数据：在您请求删除前一直保留。
• 付款记录：7 年（美国税务要求）。
• 聊天消息：直至您或管理员删除。
• 考勤记录：3 年。

六、您的权利

您可随时：

• 查阅我们持有的关于您的信息。
• 通过个人资料修正不准确或不完整的数据。
• 随时删除账户及相关个人数据 —— 在 StepZ App 的「设置」页操作。 出于税务与会计要求必须保留的付款记录，会在抹去您的姓名与联系方式后留存。
• 以机器可读格式导出您的数据。
• 通过设备设置关闭非必要的推送通知。

加州居民依据 CCPA / CPRA 享有额外权利；欧盟和英国居民依据 GDPR 享有权利。如需行使任何权利， 请发送邮件至 [email protected]，我们将在 30 天内回复。

七、安全

应用程序与服务器之间的所有流量均使用 TLS 加密。密码经过哈希处理（我们无法找回您的密码， 只能重置）。数据库的行级安全策略将每位用户限制为只能访问自己的记录。但没有任何系统能保证 100% 安全，如怀疑您的账户遭到泄露，请立即发送邮件至 [email protected]。

八、国际用户

本服务在美国运营。如您从美国境外访问，您的信息将被传输至美国并在美国处理，美国的数据保护 法律可能与您所在司法辖区有所不同。

九、政策变更

我们可能不时更新本政策。重大变更将在生效前至少 14 天通过应用或邮件通知。上方“生效 日期”始终反映最新版本。

十、联系我们

有任何疑问或顾虑？请发送邮件至 [email protected]。