5 Steps: Daily Knowledge Privacy Policy

Last updated: September 22, 2026

Who we are

5 Steps: Daily Knowledge is operated by Flapp Bilisim Anonim Sirketi. Contact 5steps@flapp.ist for privacy, account deletion or support requests.

This policy describes our iOS and Android apps and support service. Other websites linked from the app have their own privacy notices.

Your account

We use Firebase Authentication for Apple, Google and email/password sign-in, and Cloud Firestore for account profiles. We process your account identifier, name, email address, sign-in provider and account creation/login timestamps. Firebase handles passwords; we do not store passwords in your profile. Apple may provide a private relay email address.

The app does not request your date of birth, Google contacts, Drive files or precise device location. We use account information to operate your account, provide features, answer requests and prevent abuse.

Learning records and personalization

Your selected interests, difficulty preference and learning progress help the app choose and order existing published lessons. This selection runs using app rules. We do not generate AI content for individual users or send your profile, interests, progress or saved cards to an AI content generator.

Our server records the lessons you request and unlock, lesson versions, whether access comes from Plus or a rewarded ad, completion status and relevant timestamps. These records are associated with your app account and support access checks and resuming a walk.

Saved cards, reading history, selected interests, difficulty and lesson progress are also stored on your device under your app account. Saved card records can include card text, topic, category and a timestamp. These local records do not automatically synchronize across devices. Theme and font preferences are stored locally. Plus walks opened online can be stored for offline reading with a signed access record that has a limited validity period.

Signing out does not automatically erase local records. Device backups may retain app data according to your device settings.

Subscriptions

Apple processes Plus subscription payments on iOS, and Google Play processes them on Android. We receive and verify purchase information needed to provide access, including product and transaction or purchase-token identifiers, subscription expiry, renewal, cancellation or revocation information, and a subscription account identifier associated with your app account. We store a one-way hash of a Google Play purchase token for ownership and replay protection and keep the token while it is needed to verify subscription status. We do not receive your full payment-card details.

Monthly and annual Plus subscriptions renew automatically unless cancelled through the store where you subscribed. You can manage or cancel them in your Apple subscription settings or Google Play subscription settings. Deleting your Five Steps account does not cancel an Apple or Google Play subscription.

Optional rewarded advertising

Without Plus, you can choose to watch a rewarded ad to unlock a walk. Five Steps runs this path in permanent Google AdMob Limited Ads mode. Before the app requests an ad, it shows an advertising notice and lets you continue or cancel. The request is marked limited and non-personalized, publisher first-party identification is disabled, and the app does not send your name, email, app account identifier, learning interests, lesson topics or saved cards as ad targeting information.

Limited Ads still involve technical data processing. Google and its advertising partners may process IP addresses and approximate location, device or app information, ad impressions and interactions, crash reports and performance information to deliver ads, measure limited-ad impressions, secure the service and detect fraud. With the current Programmatic Limited Ads setting, Google uses fraud-prevention cookies and local storage on limited-ad traffic. The in-app notice links to Google's privacy information and advertising-partner information, and advertising privacy remains available from Account.

To verify a reward, Google returns an ad transaction identifier, ad-unit/reward details, timestamp and an opaque one-time code. Our server connects that code to the requested walk and your account. It does not contain your account identifier or lesson topic. Plus does not require watching ads.

See Google's Mobile Ads data disclosures for iOS and Android, and Google's Privacy Policy.

Shared content and service providers

Content generation, when enabled, produces drafts for a shared library using a topic, language and version. The workflow requires review before new AI drafts are published. Your personal information and app activity are not inputs to these generation jobs.

We use Firebase Authentication and Cloud Firestore, Fly.io for our application server, Apple for iOS purchases and Apple sign-in, Google Play for Android purchases, Google for Google sign-in and advertising, and OpenAI for shared content drafting when enabled. Providers process service and technical information under their applicable terms and privacy practices. Network services receive technical information such as IP addresses, app/operating-system details and request timing needed to deliver services and prevent abuse. Authentication providers may perform technical analytics independently of our local reading records.

See Firebase Privacy and Security, Google Sign-In's data disclosures, and Sign in with Apple and Privacy.

Processing locations

Our Firestore database and primary application server are configured in Frankfurt, Germany. Authentication, advertising, purchases, support and other provider services may process information in other countries, including the United States. Contact us for information about your data and applicable arrangements.

Retention and deletion

Account information and server records supporting learning access, ad rewards and subscriptions remain associated with your account until deleted. You can delete your account from the app's Account section after reauthentication, or contact support for assistance. The in-app process removes our account profile, account-linked walk/ad/subscription records and authentication account, then clears that installation's account-specific reading records, saved cards, progress and offline downloads. If a step fails, the app reports it so you can retry or contact support.

Deletion does not delete your Apple or Google account, cancel a subscription, remove records held independently by payment or advertising providers, or erase other devices and device backups. Shared published lessons remain in the library because they are not personal account records. Provider logs and backups follow their separate retention schedules. Information may remain where required for legal obligations, security or resolving a request.

Support and your choices

When you email us, we receive your email address, message and any attachments you choose to send. We use them to handle your request. Do not send passwords, verification codes or unnecessary sensitive information.

Depending on your location, you may have rights to access, correct, delete or obtain a copy of your information, restrict or object to processing, or complain to a relevant privacy authority. Send requests to 5steps@flapp.ist. We may need to verify that the request concerns your account.

We may update this policy as the app changes and will provide further notice where required.

Support

For login, subscription-access, rewarded-ad, app or privacy issues, email 5steps@flapp.ist. Include your app version, device model and a brief description. Apple or Google Play manages billing and subscription cancellation through the store account where you subscribed.