Privacy Policy

1What this covers

This Privacy Policy applies to the StayStep app for iPhone and Android (“StayStep” or “the app”) and to this website. StayStep is operated by D&B Evergreen Adventures LLC (“we”, “our” or “us”), a company registered in the State of Washington, USA.

StayStep is built to know as little about you as it can. It has no account: you set it up on your phone and use every feature there. Where this policy says something stays on your phone, it never reaches us.

2What stays on your phone

StayStep saves what you enter in the app’s private storage on your phone:

• your stages (F-1, OPT, STEM OPT, cap-gap, H-1B, H-4) and their dates, such as your program end date, EAD dates and I-94 end date, including the ones you mark as approximate
• your employers and gaps: employer names, start and end dates and, for STEM OPT, whether an employer uses E-Verify
• if you add them, your school and your DSO’s contact details
• your documents (I-94, EAD, visa stamp, passport, I-20, H-1B approval notice): their dates, and the photos you add
• your reminders, which rule alerts you want, and with Premium, the same records for each family profile you add
• your settings (language, appearance, theme, reminders, rule alerts, app lock, usage analytics), and which version of the Terms and this policy you accepted, and when

Encrypted on the phone. The sensitive parts of your records and every photo are encrypted with a key that StayStep makes on your phone and keeps in its secure storage (the iPhone Keychain or the Android Keystore), on this phone only. An optional app lock asks for Face ID, a fingerprint or your passcode.

Your phone’s own backups. If iCloud Backup or Android backup is on, it may include the app’s storage, under Apple’s or Google’s terms. Your records are in it only encrypted, and the key isn’t, so a phone backup restored to another phone can’t open them: StayStep starts over there. To move to a new phone, export your data.

Every clock and date the app shows, the “If your H-1B job ends” planner, the job-change planner and which rule cards affect you are worked out on your phone and never leave it. If you use a hand-off to CaseStep or ResidentStep, our other apps, it goes from app to app on your phone, only when you tap it.

California. Information about your immigration status is sensitive personal information under California law. We use it only to give you the app’s features, on your phone, and never sell or share it.

3No account, no copy

StayStep has no account: you never sign up or sign in. We keep no copy of your records on any server. They exist on your phone, and in any export or phone backup you make yourself.

If we ever offer an optional backup, it will come with a new version of this policy, and it will stay off until you accept that version and turn the backup on.

4Analytics and crash reports

4.1 Usage analytics (your choice)

Share usage analytics starts off on a phone set to a region in the European Economic Area, the UK or Switzerland, and on everywhere else. You can turn it on or off at any time in Settings → Privacy & security, and the app keeps your choice. While it’s on, the app tells Google Firebase Analytics only which screens are opened, by names from a fixed list, and a short, fixed list of events about using the app, such as opening the Premium sheet or how a purchase ended, each with values from a fixed list. A screen whose name alone would say something about your situation is left out. Firebase also records a few events by itself: the first time the app opens, when a session starts and how long the app is in use, and app and system updates. With them it records the app version, device model, operating system, an approximate location worked out from your IP address and a random ID for this installation of the app.

Analytics never include your dates, your stage or a change of stage, your employers or school, your documents or their numbers, which rule cards you open, numbers or text you typed, or your name or email, and we don’t link them to a person. They don’t use an advertising ID.

4.2 Crash reports

If the app crashes or hits an error, it sends a report to Google Firebase Crashlytics with technical details (such as the screen and step it happened on), the app version, device model and operating system, and a random install ID that Firebase creates for this app install, used only to group crash reports. Before a report leaves your phone, every digit, month name, email address, web address and two- or three-letter code in its message is masked, so it can’t carry a date, a document number or a country. Crash reports never include your records.

5Ads

The free version shows one Google AdMob banner, at the bottom of the main Clocks and Timeline screens. There are no ads on Documents, Rules, the “If your H-1B job ends” planner, sheets, setup or Settings, and no full-screen ads. We ask Google for non-personalized ads only, and we block ads for lawyers and immigration services, alcohol and gambling.

• Ad requests carry nothing you entered in StayStep. Google’s ad software still collects some information to show ads, count views and taps and prevent fraud, such as your IP address and device and advertising identifiers, under Google’s own privacy policy
• StayStep never shows Apple’s “Allow tracking” prompt
• In the European Economic Area, the UK and Switzerland, Google’s consent form asks for your choice first. In U.S. states with privacy laws, Google’s privacy message lets you opt out of the sale or sharing of your information for ads. You can change either in Settings
• The ad software starts only after you finish setup and accept the Terms and this policy, and never with Premium, which removes ads

6Who receives data

We share information only with the organizations that run parts of StayStep, and only what each one needs:

Google Firebase, Cloudflare and Expo work for us under data-processing terms and may use your information only to provide their service. Google’s AdMob and Gmail, Apple’s App Attest, and the App Store and Google Play handle their part under their own terms and privacy policies. We don’t sell or rent personal information, and we don’t share it for targeted advertising. We may share information when the law requires it.

7Keeping and deleting data

Deleting. Settings → Delete all data removes everything StayStep keeps on your phone; uninstalling the app does too. There’s no account to delete. Delete your data has the steps.

8Downloads, purchases and reminders

• Rule updates. At most once a day, the app downloads one file of rule updates from our data server on Cloudflare. Everyone gets the same file, and the request carries nothing about you or your records, only what every web request carries (your IP address and basic details such as the app version). Which updates affect you is worked out on your phone. The request carries a Firebase App Check token (Apple App Attest on iPhone, Google Play Integrity on Android) that confirms it comes from the real StayStep app on a real device. To get one, the app asks Apple or Google to check the app and the device, which sends nothing about you or your records. Without a token (for example, on a phone without Google Play), the app keeps the rule updates it already has. With the rule updates, the app also reads a small public file that says which app versions are still supported; that request carries no token.
• App updates come from Expo, with the details in section 6.
• Premium is a one-time purchase through the App Store or Google Play. Apple or Google takes the payment, so we never see your card or payment details, and nothing about your purchase is sent to us. Your phone keeps the confirmation that you own Premium.
• Reminders and rule alerts are made on your phone, as local notifications: a rule alert comes from the rule updates your phone downloaded. StayStep uses no push service, so we hold no notification token for your device, and notifications never show your dates, employers, names or document numbers.

What we don’t collect

• Your location (GPS or Wi-Fi), contacts or microphone. The app reads a photo only when you choose to add it, and it stays on your phone
• Your SEVIS ID, I-94 number, passport number, receipt numbers, A-number or any other record you enter: they stay on your phone, encrypted
• A password (there’s no account), or your payment details
• Anything that tracks you across other companies’ apps and websites

9Your choices and rights

• Turn Share usage analytics on or off in Settings → Privacy & security
• Export your data, or delete all of it, in Settings → Privacy & security
• Choose your reminders and rule alerts in Settings, or in your phone’s notification settings
• Change your ad choices in Settings (European Economic Area, UK and Switzerland, and U.S. states with privacy laws)

Depending on where you live, you may have the right to know, get a copy of, correct or delete the personal information we hold about you, and to object to some uses of it. Almost all of it is on your phone, where you can see, export and delete it. For anything else, email privacy@staystep.app. We’ll answer within 30 days and won’t treat you differently for asking.

10Security and the border

Your records and photos are encrypted on your phone, and everything the app sends travels over encrypted connections (HTTPS). No system is perfectly secure: if a breach affects your information, we’ll tell you in the app.

11Children

StayStep is not directed to children under 13, and we don’t knowingly collect their information. A parent with Premium can add a family profile for a child; it stays on the parent’s phone like every other record. If you believe a child under 13 has given us information, email privacy@staystep.app and we’ll delete it.

12This website

This website sets no cookies and has no accounts, analytics, ads or trackers, and it loads nothing from other companies: even its fonts come from this site. If you pick Light or Dark, your choice is saved in your browser and never sent to us; it’s the only thing the site keeps there. Cloudflare, which hosts the site, may keep standard request logs.

13Users outside the United States

StayStep is for people in the United States on student and work visas, and for people about to be. We’re based in the United States, where privacy laws may differ from those where you live.

In the European Economic Area, the UK and Switzerland, data protection law (the GDPR, the UK GDPR and Switzerland’s data protection act) asks us to say why we use your information:

• With your consent: usage analytics (section 4.1; it starts off there), and Google’s use of your device’s storage and identifiers for ads, which you answer in Google’s consent form. The ads are non-personalized either way. You can take your consent back at any time in Settings; that doesn’t change what was done before.
• To give you what you asked for: Premium and Restore purchases, and answers to your emails.
• Our legitimate interests: crash reports, to find and fix problems; app checks, to keep our data server safe from misuse; and keeping StayStep secure. You can object to these.
• The law: when we must keep or share information to meet a legal obligation.

You can ask to see, correct or delete the information we hold about you, to restrict or object to how we use it, and to get a copy of it in a common format; email privacy@staystep.app and we’ll answer within one month. You can complain to the data protection authority where you live or work: in the UK, the Information Commissioner’s Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

Transfers to the United States. Your information is processed in the United States, where we and the services in section 6 are. Google and Cloudflare receive it under the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. Data Privacy Framework, and the Standard Contractual Clauses in their data processing terms; Expo under the safeguards in its data processing terms.

14Legal versions and changes

This is version 1 of this policy. Each new version gets a new number, an effective date and a plain-language summary of what changed. A change that adds collection, sharing, a recipient or longer retention ships as a new version, and the app shows its summary and asks you to Accept before the change applies to you; until you do, the new behavior stays off. Your acceptance is saved on your phone only.

Not legal advice. StayStep is not a law firm and does not give legal advice. It is not a substitute for the advice of an attorney. For guidance, talk to your school’s designated school official (DSO), a licensed immigration attorney or an accredited representative, and check important information at uscis.gov and studyinthestates.dhs.gov.

15Contact us

Company

D&B Evergreen Adventures LLC

Registered in

Washington, USA

Address

629 S 168th Pl, SeaTac, WA 98148-1620, USA

Product

StayStep

Privacy

privacy@staystep.app

Legal

legal@staystep.app

Support

support@staystep.app