What the race reads
With your permission, Cosmo Steps reads recorded step counts and walking/running, cycling, swimming, wheelchair, and downhill snow-sport distances from Apple Health. It never writes to Health. Only activity recorded after you join the race, or after your latest account recovery, counts—even if you allow full Health history. Today and yesterday start at your local midnight.
Supported Apple Health device sources and trusted fitness apps are eligible. See Settings → Activity & sync → Trusted fitness apps for the current list. These apps must share recorded step counts or supported distances with Apple Health; workout time, calories, heart rate and wheelchair push counts do not add Cosmo Steps. Entries marked as manual and unrecognized sources are excluded. Source identifiers are checked on your device and are not sent to the race server.
The app sends daily activity totals and dates. For workouts averaging over 50 km/h, it also sends sport, start/end times, distance, active duration and a hashed workout reference for private review. Alerts go to our operator by email. Routes are never uploaded. A flag does not automatically change scores. The server supplies the activity window and converts the quantities into Cosmo Steps. Every 0.75 metres becomes 1 Cosmo Step; walking/running distance and step counts are compared rather than added together.
Your account and country
The server stores your race account identifier, credential hashes, daily activity, country credits, invite relationships, verified fuel transactions and badge awards to operate the race and preserve your progress. Your connection’s IP address is used to look up a country in a locally stored GeoLite Country database. Cosmo Steps does not request GPS location. Individual IP lookups are not sent to MaxMind or another geolocation service.
VPNs, proxies and roaming can affect the detected country; it is not proof of physical location. IP addresses are not written to app-server request logs. Keyed request-limit hashes expire after 24 hours and are removed on the next request. Past credits stay with their original country; only new credits go to the country detected when they are credited.
Fuel purchases
Apple handles fuel payments through the App Store. We keep verified purchase records linked to your race account to add fuel, prevent duplicate credits and handle refunds. We do not receive your payment card details. Fuel and invite rewards are separate from recorded Health activity and are never written to Apple Health.
What others see
The public race shows country totals, rankings, explorer counts, mission progress and country finish records. It does not publish your individual daily Health history, Apple identity or recovery key.
Game Center sharing is optional. When enabled, Apple receives your combined activity, purchased fuel and earned invite total, plus earned Game Center achievement identifiers. Friends’ display names and scores are loaded from Game Center for the app’s friends rankings; your visibility there follows Apple’s Game Center settings. The race server does not collect your Game Center friends list. Your in-app badge collection records the country and time of each award. You can stop Game Center sharing in the Cosmo Steps tab. Already shared scores and achievements may remain with Apple.
Your controls
Health access is optional and read-only. Choose the activity types to share in Apple Health → profile → Apps → Cosmo Steps. Turning access off stops new reads of those types; it does not erase activity already synced to the race server. Previously contributed Cosmo Steps remain in country totals, including after account deletion.
Health activity is never sold or used for advertising.
Sign in with Apple
Linking Apple is optional for the race and required for a new iOS friend to qualify for an invite reward. The server verifies Apple’s signed identity and stores its account identifier and an encrypted refresh token for revocation. No name or email is requested. Restoring an Apple-linked account rotates the contributing session and preserves earlier country allocations. Account deletion revokes Apple authorization before removing identity and personal race data.
Recovery and deletion
Link your Apple Account or keep a private recovery key to restore your race account. The server stores only the recovery key’s hash. Keep the key private: anyone with it can access your account. A recovery key is different from an invite code. Recovery disconnects the previous contributing session, preserves earlier contributions, and starts a new Health activity window.
Delete your account in Settings → Account & privacy → Account & recovery → Delete my account. This removes the account, its daily activity history, recovery and Apple identity records, and personal links to contributions and badges. Previously credited Cosmo Steps remain in country totals without the account link; country progress and podium places stay unchanged. Rewards already earned by friends remain theirs without identifying the deleted account.
A purchase-ID hash and credited country/amount remain for replay prevention and later refunds. A hashed deletion receipt expires after 24 hours. Deletion does not refund purchases or erase Apple Health records, Apple purchase history, or previously shared Game Center scores and achievements. Uninstalling the app does not delete your server account. Server backups may retain earlier copies outside the live account-deletion process.
Augmented reality
AR is optional and uses the camera only while its viewer is active. Camera frames and surface tracking are processed on your iPhone, never saved or uploaded by Cosmo Steps. NASA models and imagery are bundled with the app; AR needs no artwork downloads. AR does not contribute Cosmo Steps or change country scores. You can revoke Camera access in iPhone Settings.
Invitations
Invitations work across Android and iOS. Creating or accepting one stores the code, expiry, account relationships and qualification state on the shared race server. Sharing includes the invitation code and instructions, without your Apple Health history or private recovery key. The code includes your friend’s name, which is visible to anyone you share it with. Use a nickname rather than a full legal name. Expired invitations disappear from the app, but their named codes can remain in server history; hiding an invitation is not the same as deleting it.
To prevent repeat rewards, qualification retains keyed hashes of the verified sign-in identity and app-installation key for 180 days, including after account deletion. These markers contain no raw Google or Apple account ID, account link or activity records. Expired markers are removed during server requests.
Storage and security
Your account credentials stay in the iOS Keychain. Preferences, saved country progress, badge receipts and pending invitation links are stored locally so the app can resume your journey. Account recovery and deletion clear the previous account’s display caches and turn off Game Center sharing.
Race data is stored on our server and sent over encrypted connections. We keep app-installation verification records to help prevent misuse. Backups may retain earlier copies after you delete your account. See Infrastructure and retention below.
Widgets and Apple Watch
The app shares a display snapshot with its widget extension on this iPhone: country, rank, ongoing mission progress and remaining Cosmo Steps, today’s activity total, combined contribution and update times. It also shares the race server address, country code, eligible activity start time and the most recently synced daily activity quantities. These let the iPhone widget read permitted Apple Health activity and fetch public country standings when iOS refreshes it. The widget does not upload Health activity or contribute to the race; contribution syncing is handled by the app.
A paired Apple Watch receives the display snapshot through Watch Connectivity. The Watch does not receive account credentials, invitation codes, individual Health samples or the widget’s activity-query context. The shared snapshot and widget refresh files are protected on the device, excluded from backups and cleared when you change or delete your account. A paired Watch receives that clearing update when connectivity permits. iOS controls widget refresh timing; totals can be visible wherever you place a widget or Watch complication.
Infrastructure and retention
This product includes GeoLite data created by MaxMind, available from https://www.maxmind.com.
Account-linked records remain until deletion; anonymous country aggregates and finish records remain in the race. Minimal purchase hashes and country/amount records remain for fraud prevention and refunds. Invitation anti-abuse markers expire after 180 days. Request-limit hashes and deletion receipts expire after 24 hours and are removed on subsequent requests.
The race database is hosted on an OVHcloud VPS, and Cloudflare protects the public API. These providers process connection and infrastructure data to deliver and secure the service. Provider-managed VPS backups have rolling seven-day retention. Restricted operational backups for release rollback currently have no automatic expiry and are not used for the live race. Deletion removes data from the active service. If a backup is restored, deletions must be reapplied before restored data is used. Contact support about retained backup copies. Brevo delivers automatic private workout-review alerts to our operator. These contain the race account ID, country, platform, sport, workout start, distance, duration, average speed and review case ID. Account deletion removes linked review records from the live database, but does not automatically delete delivered emails. Review cases currently have no automatic time-based deletion schedule. Email-provider and operator-mailbox retention are separate from database cleanup. Contact support to ask about access to or deletion of retained review information. Separately, if you choose to send a support email, your email app shares your sender address and any information you include.
Your privacy rights
Contact cs@lesyklele.com to request access, correction, export or deletion of personal race data, or to raise a privacy concern. We verify ownership before disclosing or deleting account data. You can withdraw optional Health, camera and Game Center permissions through Apple settings or the app. Depending on where you live, you may have rights to restrict or object to processing and complain to your local data-protection authority. Health activity is used with your permission to provide the movement race; minimal security records protect it from abuse. There is no advertising tracking or sale of Health data.
Audience and updates
Cosmo Steps is intended for people aged 13 and older. We do not knowingly invite children under 13 to provide race data. Contact support if a child below that age created an account. This notice is updated when data practices change.
Last updated: .