Privacy Policy

What we collect

• Account details: your name, email address and password. We store your password only as a bcrypt hash (a scrambled form), never as the password itself.
• If you sign in with Google or Apple, we get your name and email address from them. Apple may give us a private relay email address instead. If you sign in with Apple, we also keep an encrypted token from Apple so we can disconnect StepWise from your Apple ID when you delete your account.
• Profile details you choose to give us, such as your visa type and visa expiry date, student ID, course, university and campus, health insurance (OSHC) provider, city and state, home country, languages, skills, goals, arrival details and accommodation address.
• Documents you upload to the Document Vault, and CVs you create.
• What you write in the app: your CV details (which can include your phone number, suburb and your referees' names and contact details), household chores and expenses, Companion check-ins and notes, practice answers, study deadlines, reports of AI replies and messages you send us through the contact form.
• Your AI choice: whether you turned on AI features, when, and which version of the AI notice you agreed to.
• For notifications: a notification token for your phone, and whether it is an iPhone or Android phone.
• For Premium: your subscription's state as Apple reports it through RevenueCat: the plan, whether it is active, when it renews or ends, and whether it will renew. Apple handles your payment; we never see your card details or your Apple ID.
• Technical data: our servers use your IP address to limit repeated requests, and keep technical logs to run and fix the service. These logs can include your email address when we send you an email, and your user number when you turn AI features on or off.

How we use it

• To run your account and show your information to you.
• To create your plans, checklists and CVs.
• To run Companion.
• To send the reminders you choose (for example visa expiry, tasks and chores), and security and billing messages.
• To check whether you have Premium.
• To review AI replies you report, so we can fix problems.
• To keep the service safe, for example by limiting repeated requests.

We do not sell your personal information, and we do not use it for advertising.

AI processing (Gemini)

Some features use Gemini, an AI service made by Google, through Google Cloud Vertex AI. This is the only AI service StepWise uses. AI features are off until you agree to turn them on. While they are off, nothing is sent to the AI.

When you use an AI feature, what that feature needs is sent to this third-party AI service so it can write a response:

• Explaining a step in one of your saved plans: the step as saved in the plan, and your visa type, course, university, city and state. You do not type anything for this.
• CV builder: the industry you choose, and the experience, education and certifications you type. Your name, contact details and work rights are not sent to the AI.
• Companion and the practice features: see below.

What is never sent to the AI: documents in your Document Vault, passport details, your address and your phone number. Anything you type into an AI feature is sent, so please do not include details you do not want processed, such as passport numbers, bank details or health information.

Under Google's Vertex AI terms, our data isn't used to train its models without our permission.

Your AI choice: we store whether you turned AI features on, when, and the version of the notice you agreed to, and our server logs a line (your user number, on or off, and the version) each time you change it. You can turn AI features off at any time in Settings, under AI features. Turning them off stops new AI requests; it does not delete AI replies already saved in the app, such as Companion's replies and reviews and your CVs. You can delete those items yourself, or delete your account.

Reporting an AI reply: if you report a reply, we store the reply as you saw it (up to 4,000 characters), the reason you chose, and your note if you add one (up to 500 characters). We read reports ourselves to fix problems. Reports are included in Export My Data and are deleted with your account.

AI answers can be wrong. They are general information only, not legal, migration, medical or financial advice. Check important things with an official source or a registered migration agent.

Companion

Companion is a Premium daily check-in coach for job search, study and settling in. Companion is not medical, legal, migration or financial advice. If you are in danger, call 000.

What we store: the goal, check-in time and tone you choose; your daily check-in answers; notes you write and things you tell Companion; Companion's replies and suggestions; your plan for the day and how it went; your weekly and monthly reviews; and suggested actions you accept or dismiss.

What is sent to the AI: your check-in answers, your notes, things you tell Companion, and your goal and its steps. Companion uses them to write your daily question, its replies, suggested next steps, and your weekly and monthly reviews.

What is not sent to the AI: your plan for the day, and your profile details, such as your name, email address, visa details and work rights.

If something you send suggests you may be in distress, Companion does not send it to the AI for a reply. It shows a fixed support message instead, with a link to the Emergency Help screen. The note itself is still saved and you can still see it, but it is never sent to the AI: it is left out when Companion writes your daily question, suggested next steps, and weekly and monthly reviews.

When this happens, we record the date, the kind of sign we saw and where in the app it happened. This record does not contain your words, and it is deleted after 30 days.

If something you write or choose in Companion suggests you're having a hard day, Companion may add a fixed instruction asking the AI to keep your daily question, or a weekly or monthly review covering that day, gentle. That instruction does not include anything you wrote.

Companion does not answer questions about visas or migration. It suggests you talk to your university's International Student Support team or a registered migration agent.

Practice features

• Interview practice: you answer practice interview questions. The question and your answer are sent to the AI for feedback.
• Workplace English practice: you answer everyday work situations. The situation and your answer are sent to the AI for feedback.

No profile details are sent with your practice answers.

If an answer suggests you may be in distress, it is not sent to the AI. The session pauses and Companion shows a support message.

Your answers and feedback are deleted automatically 30 days after the session started. You can delete a session sooner in Past practice.

Study deadlines

You can add study deadlines with a title, a course and a due date. StepWise plans your study sessions with simple fixed rules.

Deadline titles and courses are never sent to the AI, and deadline reminders do not show them.

You can delete a deadline at any time. Deadlines you mark as done are deleted automatically 60 days later.

Notifications

• Email: we send emails through Amazon Simple Email Service (SES). You choose reminder emails in Notifications & Alerts. Security and billing emails are always sent.
• Phone notifications: if you allow them, we send them through Google Firebase Cloud Messaging, and on iPhone also through Apple's push notification service.
• Daily tip: if you turn it on, the app schedules the notification itself, from the Guidebook tips already on this phone. Nothing about it is sent to us, Google or Apple. Your choice and the time you pick stay on this phone.
• Visa expiry reminders show your visa expiry date, and chore notifications show the chore's name. Notifications can appear on your lock screen.
• Companion notifications use fixed wording, such as "Time for your check-in". They never include your notes or your goal. They cover your daily check-in, your weekly and monthly reviews and an evening reminder about your plan for the day.
• We keep a record of each notification we send: its type, when it was sent, whether it arrived and whether you opened it. The record does not include the message.

You can turn notifications off in Notifications & Alerts, or in your phone's settings.

Sharing and third parties

These companies process your information for us, to run StepWise:

• Railway: hosts our servers and database.
• Amazon Web Services (AWS): stores Document Vault files and CVs, and sends our emails.
• Google: Gemini AI (through Vertex AI), Sign in with Google, and phone notifications (Firebase Cloud Messaging).
• Apple: Sign in with Apple, iPhone notifications, and App Store purchases. Apple handles your payment under its own privacy policy.
• RevenueCat: checks App Store purchases for us. RevenueCat receives your StepWise user number (not your name or email address) and your purchase and subscription details from Apple. We have turned off its collection of device advertising identifiers.
• Vercel: hosts our website, thestepwise.com.

Households: if you join a household, its other members can see your name and the chores, expenses and payments in that household.

If a household member deletes their account, the household continues, their own entries are removed, and shared expense balances with them are lost.

CV share links: if you turn on a share link for a CV, anyone with the link can download that CV. A link stops working after 30 days, and you can turn it off at any time. Share links ask search engines not to list them.

We may also share information when the law requires us to.

Our website

Our website, thestepwise.com, counts visits with Vercel Web Analytics. It uses no cookies and stores nothing in your browser. It records the page address without anything after it (no search terms or links with codes in them), and it does not count visits to the password reset page. Vercel, our website host, keeps standard server logs, such as IP addresses.

Where your data is processed

Your information is stored and processed outside Australia, on servers in the United States. This means it is disclosed to overseas providers.

• Our servers and database are hosted by Railway in the United States.
• AI requests (Gemini) are processed by Google Cloud in the United States.
• Document Vault files, CVs and emails are stored and handled by AWS in the United States.
• Sign in with Apple, RevenueCat and Google are also overseas providers. Apple, RevenueCat, Google and Vercel may process your information in other countries, including the United States.

Our providers have their own privacy and security commitments.

How long we keep it

• Your account, profile, documents, CVs, plans, household records, notification history and reports of AI replies: until you delete them, or delete your account.
• Your AI choice: until you change it, or delete your account.
• Your subscription's state: until you delete your account.
• Companion data: until you delete it, or delete your account. Distress records are deleted after 30 days.
• Practice answers and feedback: 30 days from the start of the session.
• Study deadlines: until you delete them. Deadlines marked done are deleted 60 days later.
• CV share links: 30 days, or until you turn them off.
• Password reset links: they work once, for 30 minutes.
• Phone notification tokens: until you log out on that phone, the token stops working, or you delete your account.
• Offline copies: when you save a document on your phone, the app keeps an encrypted copy on that phone so you can open it without internet. It is not included in your phone's backups. It is removed when you delete the document, log out, or delete your account.
• Messages you send through the contact form arrive as emails in our support inbox and are kept as long as needed for security and support. Deleting your account does not delete them; email us if you want them deleted.
• Technical logs: kept as long as needed for security and support.
• Information already sent to Google for AI processing is kept by Google under its own terms, not by StepWise.

Your choices and deleting data

• See and correct your information: you can view and edit your profile in the app at any time.
• Get a copy: Export My Data (in your profile, under Security & Data) gives you your account details, your App Store subscription's state, whether your account is connected to Sign in with Apple, your profile, a list of your documents, your AI choice and your reports of AI replies. For a full copy of everything we hold about you, or to correct something you cannot edit, email us at support@thestepwise.com.
• Delete single items: you can delete your documents, CVs, saved plans, Companion notes, practice sessions and study deadlines.
• Turn AI features off: in Settings, under AI features.
• Delete your account: in your profile, open Security & Data, then Delete Account. This deletes your account and the information linked to it from our servers, removes your files from storage, asks RevenueCat to delete its record of you, and, if you signed in with Apple, asks Apple to disconnect StepWise from your Apple ID. Deleting your account does not cancel an App Store subscription: cancel it first on your iPhone in Settings > your name > Subscriptions, or Apple will keep charging you. Apple keeps its own purchase records.
• Complaints: if you have a privacy concern, email us at support@thestepwise.com. We will reply within 30 days. If you are not happy with our reply, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Security

• The app talks to our servers over an encrypted connection (HTTPS).
• Your sign-in is kept in your phone's secure storage. When you log out, that sign-in also stops working on our servers.
• Document Vault files are encrypted on our server before they are stored, and AWS encrypts them again when it stores them. We hold the keys, so this is not end-to-end encryption: our systems can open your files to show them to you.
• Offline copies on your phone are encrypted by StepWise, with a key kept in your phone's secure storage, and are left out of your phone's backups.

No system is completely secure. If a data breach is likely to cause you serious harm, we will tell you and the OAIC.

Children

StepWise is for adults aged 18 and over; our Terms of Use require you to be at least 18. We do not knowingly collect information from anyone under 18. If you think a child has given us information, contact us and we will delete it.

Contact us

StepWise is run by MD HASIBULLAH HASIB (ABN 27 628 507 458). For questions about this policy or your information, email us at support@thestepwise.com.

Changes to this policy

When we change this policy, we update the last-updated date and the version number shown at the top of this page. If a change matters, we will also tell you by email or in the app before it applies.