Privacy policy

Effective from 30 October 2026

This is a translation of the Slovenian original. If the two versions differ, the Slovenian version applies.

Sidestep is an iPhone app that opens Instagram and YouTube without Reels, Shorts and the endless feed, and, if you want, TikTok messages too. It’s built to know as little about you as possible. This page explains what personal data we process in the app and on the sidestep.page website, why, on what legal basis, who else sees it, how long we keep it and what rights you have.

In short

Sidestep never sees or stores your Instagram, YouTube or TikTok passwords.
It doesn’t read your messages and doesn’t collect what you watch.
An account is optional. Without one, all data stays on your phone only.
We have no ads, trackers or analytics, and we don’t sell data.

1. Who the controller is

The controller of personal data is Žiga Fidler, Jakopičeva 5a, 1230 Domžale, Slovenia. For any privacy question and to exercise your rights, write to zasebnost@sidestep.page. We are not required to appoint a data protection officer and have not appointed one.

2. Data that stays on your phone

Sidestep stores this data only on your device. We have no access to it unless you create an account (see section 4):

settings: chosen apps, theme, daily limits, Instagram and YouTube settings;
stats: minutes per day on each app, how many posts you saw, work sessions and your streak;
the goals you enter for Work;
the friend’s code (strict mode), in iOS secure storage (Keychain). The code never leaves your phone, even if you have an account.

You delete all of this under Settings › Data › Delete all data or by removing the app.

3. Signing in to Instagram, YouTube and TikTok

You sign in to these services yourself, on their official pages inside the app, just like in Safari. The sign-in cookies are kept by iOS on your phone. Sidestep has no access to your passwords. On these services’ pages, Sidestep runs a script that hides Reels, Shorts and suggestions and counts your time. This script sends nothing to us. While you use these services, Meta, Google and TikTok collect data about you under their own privacy policies. We’re not responsible for that processing.

4. Sidestep account

An account is optional. You create one with Apple (Sign in with Apple), with Google or with an email address. We then store on the server:

your email address, or the anonymous address Apple provides if you hide yours;
an account identifier and how you sign in (Apple, Google or email);
a copy of the data from section 2, except the friend’s code, and the time of the last sync.

Why: so your settings and stats stay when you change or reset your phone. Legal basis: performance of our contract with you, i.e. the terms of use (Art. 6(1)(b) GDPR).

If you sign in with email, we send you a one-time code. If you sign in with Apple or Google, that provider handles the sign-in under its own privacy policy and sends us only the data above.

5. Permissions on your phone

Photos (add only): when you save a photo from a chat, Sidestep adds it to Photos. It has no access to the other photos in your library.
Notifications: the reminder and weekly summary are created by your phone. We don’t send notifications and know nothing about them.
Screen Time, coming soon: once available, and if you allow it, Sidestep uses Apple’s framework to lock the original apps. Apple doesn’t send this data to us, and we can’t see it.
Crash reports: if the app crashes and you’ve allowed sharing with app developers in your iPhone’s settings, Apple sends us an anonymous crash report.

You can revoke any permission at any time in your iPhone’s settings.

6. When you write to us

If you write to hello@sidestep.page or zasebnost@sidestep.page, we process your email address and the content of your message so we can reply. Legal basis: our legitimate interest in answering questions (Art. 6(1)(f) GDPR). We keep messages for up to 2 years from the last contact, unless we need them longer to establish or defend legal claims.

7. The sidestep.page website

Hosting: the site is hosted by Cloudflare. When you visit, Cloudflare processes your IP address and technical browser data for security and to run the site.
Fonts are loaded from sidestep.page, not from other servers.
The site uses no cookies, analytics or ads.

Legal basis: our legitimate interest in a secure, working site (Art. 6(1)(f) GDPR).

8. Who else processes data

We don’t sell data or give it to advertisers. We use these providers, which process data for us and on our instructions:

Supabase Inc.: the server for accounts, syncing and sending sign-in codes;
Cloudflare Inc.: website hosting and forwarding email sent to our addresses;
Google LLC: the mailbox where we receive email.

When you sign in with your Apple or Google account, Apple and Google act as independent controllers. We may also disclose data when required by law or a court order.

9. Transfers outside the EU

Some of the providers in section 8 are based in the US, so data may be transferred outside the European Economic Area. Transfers rely on the European Commission’s adequacy decision (the EU–US Data Privacy Framework) where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses.

10. How long we keep data

Data on your phone: until you delete it or remove the app.
Account: until you delete it. When you do, the account and all data on the server are deleted immediately. They disappear from the provider’s backups within 30 days at the latest.
Email: up to 2 years from the last contact.

You delete your account and all data on the server in the app under Settings › Account › Delete account. If you no longer have the app, write to zasebnost@sidestep.page and we’ll delete your account within 30 days. More on the Help page.

11. Security

All communication between the app and the server is encrypted (HTTPS). On the server, each account can see and change only its own data. The friend’s code is kept in iOS encrypted storage. No one can guarantee perfect security, but if a breach puts your data at risk, we’ll inform you as the law requires.

12. Children

Sidestep is not intended for children under 13, because Instagram, YouTube and TikTok also require users to be at least 13. If you’re under 15, you may create a Sidestep account only with the consent of a parent or guardian. Without an account, data stays on your phone only. If we learn that we hold a child’s data without the required consent, we’ll delete it.

13. Your rights

Under the GDPR, you have the right:

to access your data and get a copy of it;
to have inaccurate data corrected;
to erasure (“right to be forgotten”);
to restriction of processing;
to data portability, i.e. to receive your data in a machine-readable format;
to object to processing based on legitimate interest.

To exercise your rights, write to zasebnost@sidestep.page. We reply within one month at the latest. We may ask you to confirm that the account is yours. You also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana (ip-rs.si), or with the supervisory authority in the country where you live.

We don’t use automated decision-making or profiling.

14. Changes

If we change this policy, the new version will be posted on this page with a new date. We’ll tell you about bigger changes in the app before they take effect.