Privacy Policy

Using StepSam without an account

You can analyze text, files, and photos without creating an account. If you save an action while signed out, it is stored in your browser on that device.

Analysis

Content you submit for analysis is sent securely to OpenAI so StepSam can generate a response. Uploaded source files are used for that analysis and StepSam does not keep those uploaded source files as part of your account.

Signed-in accounts

If you choose to sign in, StepSam uses Supabase for authentication and to store the structured actions you choose to save, including the action title, summary, extracted actions, dates, completion status, and timestamps. This allows My Actions to sync across devices.

Authentication email

StepSam uses email-based sign-in. Authentication email infrastructure may process your email address to deliver sign-in messages.

Optional profile, email preferences, and feature interests

You may save an optional name and tell us which future features interest you. StepSam stores these choices with your account and records changes to your email permissions, including the wording and time. Feature votes do not subscribe you to emails.

If you opt into StepSam tips and updates or Plus announcements, we share your email and optional name with our email delivery provider to manage that subscription. Selected feature interests are shared only when you opt into Plus announcements. Document contents and saved actions are not shared for marketing. You can change your choices in Account or use the unsubscribe link in an email. A provider-wide unsubscribe may also stop other marketing emails from us. Sign-in emails are separate.

Usage limits and abuse prevention

StepSam keeps daily usage counts, request times, and protected fingerprints of account or network identifiers and submitted material to enforce allowances and prevent repeated requests. These records do not contain your original document text, email address, or raw IP address. Guest trials are shared by people using the same network. Requests that reach the AI service may count toward your allowance even if an analysis cannot finish.

Feedback

If you submit our optional survey, we store your answers and submission time in Supabase to understand what works and improve StepSam. You do not need an account. If you give permission for follow-up, we also store the email address you provide; this does not subscribe you to marketing. Please do not include sensitive documents or personal information in your answers. A short-lived, protected network fingerprint helps limit spam; we do not store your raw IP address with your response. Contact support@stepsam.com to ask about deletion of feedback you can identify.

Analytics

StepSam uses product analytics to understand basic usage and reliability, such as whether analysis starts or completes and whether features are used. Vercel provides basic website analytics. To evaluate our small campaign test, StepSam also stores visits, analysis starts, completions and failures, and successful action saves in Supabase. A first-party cookie lasting up to 24 hours connects these events and optional survey responses using a random session identifier, allowlisted source and medium labels, a recognized campaign label, guest or verified signed-in status at each event, and explicit owner/QA test labels. For recognized ad links, we store only whether an OpenAI ad-click signal was present, never its identifier. These event records do not include document contents, filenames, saved-action text, email addresses, account identifiers, raw IP addresses, or full URLs. This campaign measurement is disabled when your browser sends Do Not Track or Global Privacy Control. A protected daily network fingerprint limits event spam.

Optional Google Calendar connection

If you connect Google Calendar, StepSam requests access to your Google account identity and events on calendars you own. It uses this access to identify your chosen Google account, create events you confirm in your primary calendar, and retrieve matching StepSam-created events to prevent duplicates. It sends the event title, chosen date, time and reminder, plus a generic StepSam description and link. It does not attach your source document or analysis. To prevent duplicates, it checks only the matching StepSam event, not your calendar schedule.

StepSam does not request Gmail, Google Drive, or Google Photos API access. Google account details, access tokens, and Calendar API responses are not sent to OpenAI. AI analysis processes text, files, or photos you submit directly to StepSam.

Session-only connections require reconnection after reload. Where persistent connections are enabled, sign in to StepSam and explicitly connect Google to retain access across refreshes. Google may still require reconnection after revocation or expiry. StepSam does not synchronize later edits or completion.

Google API Limited Use

StepSam’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. StepSam does not use Google API user data to develop, improve, or train generalized AI or machine-learning models.

Data protection

StepSam uses HTTPS connections for analysis, authentication, database access, and Google API requests. Signed-in users’ saved actions are stored in Supabase, which provides encryption at rest and in transit. Authentication and row-level access policies restrict users to their own saved actions.

Google access tokens and connected-account details are held temporarily in page memory. They are not stored in StepSam’s database or browser storage. Actions saved while signed out remain in your browser’s local storage, without additional application-level encryption.

Removing actions and disconnecting Google

You can remove saved actions from My Actions. Removing an action from StepSam does not delete an event already created in Google Calendar. You can edit or delete those events directly in Google Calendar.

Disconnecting Google Calendar clears StepSam’s local connection and requests revocation of its access token. You can also revoke StepSam’s access through your Google Account settings.

Optional push reminders

If you enable push reminders, StepSam stores your device’s push subscription endpoint and encryption keys linked to your account, plus the reminder times you choose for saved actions. Supabase stores these records and schedules delivery; your browser’s push provider (such as Google, Apple or Mozilla) delivers the encrypted notification. Notifications include the saved action title and a link to that action. The title may appear on your lock screen. Source documents and the full analysis are not included. Delivery attempts are recorded for reliability and removed after 30 days. Disable push reminders in Account to delete this device’s subscription; signing out also attempts to disable it. Completing or removing an action cancels its pending reminders. Push reminders and Google Calendar reminders are separate, and enabling both can produce two notifications.

Optional email reminders

When you choose Email for an action reminder, StepSam uses Brevo to send a one-time reminder to your verified account email. Messages include the saved action title in the subject and body, and a link to that action. Brevo processes this title to deliver the email. Source documents and the full analysis are not included. Supabase stores your reminder choices and delivery attempts; delivery records are removed after 30 days. You can remove a reminder from its action or stop all currently scheduled email reminders using the link in a reminder email. New email reminders require another explicit choice. These reminders do not subscribe you to marketing. Completing or deleting an action cancels pending reminders; changing its planned date clears the reminder. Choosing both email and push sends through both channels.

Important limits

StepSam is in early access. Do not rely on it as the only place to keep important records. For sensitive or high-stakes matters, keep the original source document and verify important details with the appropriate official source or professional.

Changes

This policy may change as StepSam adds features or service providers. Material changes will be reflected on this page.