Privacy policy

Last updated: 30 October 2026

We collect what we need to sell you Stepsound and keep it working, and nothing for advertising. The controller is Denis NGUYEN, sole trader (EI), 311 allée des Escalettes, 13300 Salon-de-Provence, France. Contact: support@stepsound.app.

What we collect and why

• Your account: your email, your language, your plan and the status of your subscription. We need them to run your subscription and to send you sign-in codes and service emails (contract).
• Payment: Stripe handles your card. We receive a Stripe customer number, the plan, the dates of your subscription and a card fingerprint (not your card number), which we use to allow one free trial per card (contract and our legitimate interest in preventing abuse).
• Your PC: when you sign in to the app, we keep an identifier derived from your Windows installation (it does not reveal your name or files), the Stepsound version and the last time your PC checked your subscription. We use them to apply the one-PC-at-a-time rule (contract).
• Sign-in: sign-in codes expire after 10 minutes and we store them hashed. Website sessions last 30 days.
• Error reports, only if you allow them: the app asks at installation (unticked by default) and you can change it in its settings. A report contains the Stepsound version, the Windows version, a description of your sound output, the time and the last lines of Stepsound's logs. The app removes your PC name and Windows account name before sending. We do not keep IP addresses with reports (consent).

We do not use advertising or analytics cookies, we do not track you across sites and we do not sell your data.

Cookies and storage

The website sets one cookie, ss_session, only when you sign in to your account. It keeps you signed in and is strictly necessary, so it needs no consent. The site also remembers in your browser if you closed the language suggestion.

How long we keep it

• Account and PC data: as long as you have an account, then 3 years after your last subscription ends.
• Invoices and payment records: 10 years, as French accounting law requires (kept by Stripe and by us).
• Error reports: 90 days.
• Sign-in codes: 2 days at most. Website sessions: 30 days.

Who processes it for us

• Vercel Inc. (website hosting, United States)
• Supabase Inc. (database, servers in Paris, France)
• Stripe Payments Europe Ltd. (payments, Ireland)
• Resend (emails, United States)

When data leaves the European Union, these providers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Your rights

You can ask to access, correct, delete or export your data, to restrict its use or to object to it, and withdraw your consent to error reports at any time in the app's settings. Write to support@stepsound.app from the email of your account. We answer within one month. You can also complain to the CNIL (cnil.fr) or to the data protection authority of your country.

Changes

If we change this policy in a way that affects you, we tell you by email before it applies.