Privacy policy

The short version

• We collect what the app needs to teach you and save your progress, and little else.
• We don’t ask for your legal name, birth date, phone number, contacts or location. The app asks for an age range and the country whose money system you’re learning and, if you want, a name to call you.
• We don’t show ads, don’t use advertising trackers and don’t sell your personal information.
• Companies that help us run BazaarSteps, such as Cloudflare for hosting, handle your information only for us.
• You can see, correct, download or delete your information, and delete your account in the app.
• If BazaarSteps is sold, we email you at least 30 days before your information moves.

Who we are

BazaarSteps is made and run by Eagle Spirit Technologies Inc., a Canadian company (“we”, “us”). We are responsible for the personal information described here.

The person in charge of protecting personal information is our founder and president. You can reach them at contact@bazaarsteps.com.

What we collect

In the app:

• How you sign in. With an email code, we keep your email address. With Apple or Google, we keep the account ID they give us, not the email address or name on that account.
• Your answers when you start: your age range (such as 14–15 or 25–44, not your birth date), the country whose money system you’re learning (such as Canada or the US) and, if you answer them, how long you’ve lived there, your experience (such as whether you have a bank account or a credit card, with no amounts or account numbers), your goal and your daily goal. You pick these from lists; there is nothing to type.
• A display name, only if you add one, so the app can greet you. Other learners never see it. If you’re 18 or older, you can choose to show it on a certificate you share.
• Your learning: the lessons, checks and exams you do, your answers, scores, points, streaks, the days you were active and daily lesson keys, plus your settings, review list and glossary.
• Certificates you earn: the certificate number, the path and level, the steps you passed and the date. We store no name, score or age with them.
• Weekly leagues, once they’re available: your points for the week, your tier and your rank. Other learners in your league see them next to a nickname we generate each week, never your name. You can choose to hide yourself from leagues.
• Usage records: what you do in the app, such as starting a lesson or answering a question, as short codes and numbers, never anything you type. If you’re 18 or older, they also carry a random ID made for this installation of the app, which isn’t your device’s advertising ID. Learners under 18, or whose age range we don’t know yet, have none.
• Problem reports: when you flag a question, we get the question, the reason you picked, your app language and app version.
• Your app language, time zone and app version, so lessons come in your language and your day starts at your midnight.
• Crash, error and performance reports: what went wrong or was slow, your device model, system version and app version, and your BazaarSteps account ID. Not your email address, and not your IP address.
• Subscriptions, once Pro is available: whether you subscribe, to which plan, when it renews or ends, and any refund. Apple handles the payment; we don’t see your card or billing details.

When you write to us, we keep your email address and your message. Send feedback in the app opens your own email app with your app version, system version and app language filled in; nothing reaches us unless you send it.

Like any internet service, our servers see your IP address when the app or this site connects. Cloudflare uses it to deliver pages and stop attacks. We don’t store it with your account; our rate limits keep only a scrambled (hashed) form for a short time.

We don’t ask for your legal name, birth date, phone number, contacts, photos, precise location or your device’s advertising ID. The app has no advertising or social-media code in it.

How we use it

• To sign you in, keep you signed in and protect your account.
• To teach you: choose your learning path, check your answers, give points and keys, and keep your progress in step on every device you use.
• To fix problems, using crash reports and the problems you flag.
• To improve lessons and to count things, such as how many people finish a lesson or how many learners use each language. We share totals with investors and partners; totals don’t identify anyone.
• To email you: sign-in codes, messages about your account or this policy and, if you joined the waitlist, news about the beta and the launch.
• To keep BazaarSteps safe, stop abuse and meet our legal duties.

We don’t use your information for ads, don’t build advertising profiles, don’t sell or rent it, and don’t use it to train AI models.

We use your information with your consent, which you give when you create an account or join the waitlist. You can take it back at any time by deleting your account or leaving the waitlist.

Who helps us

These companies process information for us, only to provide their service to us:

• Cloudflare (US): runs our servers, database, file storage and this website, and the Turnstile bot check on the waitlist form. It stores our data in eastern North America.
• Sentry (US): stores crash, error and performance reports in Germany. The only thing in them that identifies you is your account ID, and IP addresses aren’t stored.
• Email: Amazon Web Services (US) sends our emails through Amazon SES, from Canada. For a few weeks after this move, our previous provider, Resend (US), stays ready as a fallback and would send from Ireland if we needed it. Then we remove it.
• RevenueCat (US), once Pro is available: keeps track of subscriptions using your account ID and the purchase records Apple sends (plan, dates, renewals and refunds).

Apple and Google confirm who you are when you sign in with them, and Apple distributes the app and handles payments. They are independent companies with their own privacy policies.

We may also disclose information when the law requires it, such as a court order, or to protect someone’s safety.

We don’t sell personal information and don’t share it for targeted advertising. No analytics or advertising company receives it.

Where your information is

Our service providers store and process information outside your province or country: in the US and Canada, and in Germany (crash reports). Until we close our account there, Resend may also keep records of the emails it sent for us, in Ireland. The laws in these places may let authorities access it. We choose providers that protect information and limit what each one receives.

How long we keep it

• Your account and learning, including the days you were active: until you delete your account.
• Accounts that are never set up: if you sign in but never answer the first questions, we delete the account once it has gone unused for 30 days. A waitlist entry follows the waitlist’s own rules.
• Usage records (such as a lesson started or finished): up to 25 months.
• Crash, error and performance reports: up to 90 days.
• Sign-in codes: 10 minutes. Ended sign-in sessions: 30 days, for security checks.
• Our servers’ logs: a few days.
• Backups: up to 1 year. Deleted information disappears from them as they age out; we don’t restore it into the app.
• The waitlist: see “The waitlist” below.

Your choices and rights

You can ask to:

• see the information we have about you, and get a copy in a common format you can download;
• correct it (you can also change your display name in the app);
• delete your account and its information (you can also do it yourself in the app; see below);
• take back your consent, or stop emails (every waitlist email has a link to leave).

Write to contact@bazaarsteps.com from the email address you use with BazaarSteps, or tell us how you sign in. We may ask you to confirm it’s your account. We answer within 30 days, and it’s free.

If you live in California or another US state with a privacy law, you have these rights too, and we don’t treat you differently for using them. You can also have someone you trust ask for you. We don’t sell or share personal information for advertising, and we don’t use sensitive information to make guesses about you.

If you’re not happy with our answer, you can complain to a privacy regulator: in Canada, the Office of the Privacy Commissioner of Canada or your province’s commissioner, such as the Commission d’accès à l’information du Québec; in the US, your state attorney general or, in California, the California Privacy Protection Agency.

Deleting your account

Delete your account in the app: Settings → Account → Delete account. Or write to us from the email address you use with BazaarSteps, or tell us how you sign in, and we delete it within 30 days.

When you delete your account, we delete at once:

• your account: your sign-in methods, answers, display name, learning history, points, streaks, certificates, league results, problem reports and subscription record;
• any waitlist entry with the email address you sign in with.

Soon after, usually at once and otherwise with our daily cleanup, we delete:

• your synced progress (settings, review list and glossary) and your usage records;
• your place in this week’s league;
• once Pro is available, your customer record at RevenueCat (Apple keeps its own record of purchases).

If you signed in with Apple, the app asks you to confirm with Apple once more, and we use that to end BazaarSteps’ access to your Apple account. If Apple can’t confirm, your account is still deleted; you can then remove BazaarSteps in your Apple account settings, under Sign in with Apple.

What stays for a while:

• a record that an account was deleted, with only its internal ID, which no longer links to anyone. We keep it for 400 days, longer than any backup, so that if we ever restore a backup, we can delete the account again;
• crash, error and performance reports at Sentry, which carry only that internal ID. We can’t delete them one by one; they age out within 90 days;
• copies in backups, which age out within 1 year. We don’t restore deleted information into the app;
• emails you sent us, which we keep to answer you. Ask us and we delete them too.

Deleting your account doesn’t cancel a subscription bought through the App Store; cancel it in your Apple account settings.

Children and teens

BazaarSteps is for people 14 and older, wherever they live. The app asks for an age range first and doesn’t let anyone younger continue. If someone answers that they’re under 14, we don’t keep that answer: the account their sign-in created is deleted right away and they’re signed out. If the app can’t reach us at that moment, the account is deleted later under the 30-day rule in How long we keep it. We don’t knowingly collect information from children under 14. If we learn that we have, we delete it.

If you’re under the age of majority where you live (18 or 19 in Canada, 18 in most US states), a parent or guardian must agree to the Terms of use and this policy for you.

For teens, we keep things private by design: no public profile, no chat, no ads and no tracking. Other learners never see your display name, weekly leagues show generated nicknames, and learners under 18 can’t put their name on a certificate they share. Their usage records carry no installation ID.

Parents and guardians can ask to see or delete their teen’s information at contact@bazaarsteps.com.

This website

This website sets no cookies, runs no analytics and shows no ads. Cloudflare serves it and keeps short logs of requests to keep it secure.

The waitlist

When you join the waitlist, we keep your email address, the language you pick, where you live (Canada, the US or somewhere else) and, only if you choose, who you are (a teen, a newcomer, an adult learner, a parent or a teacher). We also keep the dates you signed up and confirmed, and which version of this policy you saw. There is no box to type anything else.

We use it to email you, in your language, when the beta opens and when the app launches, and to count sign-ups by language and country. We don’t give your email address to anyone for marketing.

The form uses Cloudflare Turnstile, a check that stops bots by looking at signals from your browser.

To join, you must be 14 or older.

If you don’t confirm your email within 7 days, we delete it. Otherwise we keep it until you leave the list, or until 6 months after the app launches where you live, whichever comes first. Leave anytime with the link in our emails, or write to us.

How we protect it

Connections are encrypted, and our data is encrypted where it’s stored. There are no passwords to steal: you sign in with a one-time code, Apple or Google. Only the people who run BazaarSteps can reach our systems, with two-factor sign-in, and we review our security before each release stage.

No system is perfectly secure. If a breach puts you at risk, we tell you and the privacy regulators, as the law requires.

If BazaarSteps changes owners

If our company or the app is sold or merged, your information can move to the new owner. If that happens:

• we email you at least 30 days before your information moves, and tell you who the new owner is;
• until then, you can delete your account or leave the waitlist, and we act on those requests before the transfer;
• we transfer it only to an owner who is bound by the policy in force when we collected it, unless you agree to something new.

Before a deal, we share information with a possible buyer only as far as the law allows (such as Canada’s rules for business transactions), and under a confidentiality agreement.

Changes to this policy

When we change this policy, we update the date at the top. If a change affects how we use information we already have, we tell you in the app or by email before it takes effect, and ask for your consent when the law requires it.

This policy is also in French, Spanish and Persian. If a translation differs from the English, the English version applies, as far as the law allows.

Contact us

Eagle Spirit Technologies Inc., contact@bazaarsteps.com. More ways to get help: Help and contact.