Privacy Policy

1What this covers

This Privacy Policy applies to the ResidentStep app for iPhone and Android (“ResidentStep” or “the app”) and to this website. ResidentStep is operated by D&B Evergreen Adventures LLC (“we”, “our” or “us”), a company registered in the State of Washington, USA.

ResidentStep is built to know as little about you as it can. It has no account: you set it up on your phone and use every feature there. Where this policy says something stays on your phone, it never reaches us.

2What stays on your phone

ResidentStep saves what you enter in the app’s private storage on your phone:

• your green card details: card type, the date you became a resident, the expiry date, your citizenship track and your state
• your trips: dates, countries and notes
• your documents: their dates and numbers, and the photos and files you add
• your N-400 history: addresses, trips, tax years, jobs and schools, marriage and children, and arrests, citations and tickets
• life events, reminders, your emergency contacts and, only if you turn on country notices, your nationality
• with Premium, the same for each family profile you add
• your settings (language, appearance, theme, reminders, app lock, usage analytics), and which version of the Terms and this policy you accepted, and when

Encrypted on the phone. The sensitive parts of your records and every photo or file are encrypted with a key that ResidentStep makes on your phone and keeps in its secure storage (the iPhone Keychain or the Android Keystore), on this phone only. An optional app lock asks for Face ID, a fingerprint or your passcode.

Your phone’s own backups. If iCloud Backup or Android backup is on, it may include the app’s storage, under Apple’s or Google’s terms. Your records are in it only encrypted, and the key isn’t, so a phone backup restored to another phone can’t open them: ResidentStep starts over there. To move to a new phone, use ResidentStep’s backup (section 3) or export your data.

What you check before you travel (the red-flag check), what “Affects me” and country notices work out for the rule updates, and every date the app calculates are worked out on your phone and never leave it. Your data goes to StepCivics, our civics test app, only if you tap Send to practice with your N-400 history, and then only from app to app on your phone.

California. Information about your immigration status is sensitive personal information under California law. We use it only to give you the app’s features, on your phone, and never sell or share it.

3Optional backup

Backup is off unless you turn it on in Settings → Backup. When it’s on:

• Sign-in. You sign in with Apple or Google, through Google Firebase Authentication, which keeps an account ID it creates for you, your email address (with Sign in with Apple you can choose Hide My Email, and we receive a private relay address instead) and, with Google, the name on your Google account. We never see your Apple or Google password.
• What it stores. Your records are encrypted on your phone before they’re uploaded. The backup in Google Cloud Firestore, in the United States, holds only that encrypted data (ciphertext), never your trips, dates or documents in readable form, and only your signed-in account can read it.
• How often. It reads your backup when you sign in, and saves at most once a day.
• App checks. From the time you sign in, Firebase App Check (Apple App Attest on iPhone, Google Play Integrity on Android) confirms that requests to the backup come from the real app.
• Deleting it. Settings → Backup → Delete deletes the backup and then the sign-in account, right away. You can also email us (section 9).
• Inactive backups. If your backup isn’t used for 2 years, meaning ResidentStep isn’t opened with an internet connection while you’re signed in, on any phone, we delete the backup and its sign-in account. We email the address on the account 30 days before, from notices@residentstep.app. Opening ResidentStep in that time keeps it.

4Analytics and crash reports

4.1 Usage analytics (your choice)

Share usage analytics starts off on a phone set to a region in the European Economic Area, the UK or Switzerland, and on everywhere else. You can turn it on or off at any time in Settings → Privacy & security, and the app keeps your choice. While it’s on, the app tells Google Firebase Analytics only which screens are opened, by names from a fixed list. A screen whose name alone would say something about your situation is left out. Firebase also records a few events by itself: the first time the app opens, when a session starts and how long the app is in use, and app and system updates. With them it records the app version, device model, operating system, an approximate location worked out from your IP address and a random ID for this installation of the app.

Analytics never include your dates, trips, countries, documents, document numbers, your N-400 history, numbers or text you typed, your name or email, and we don’t link them to a person or a backup account. They don’t use an advertising ID.

4.2 Crash reports

If the app crashes or hits an error, it sends a report to Google Firebase Crashlytics with technical details (such as the screen and step it happened on), the app version, device model and operating system, and a random install ID that Firebase creates for this app install, used only to group crash reports. Before a report leaves your phone, every digit, month name, email address, web address and two- or three-letter code in its message is masked, so it can’t carry a date, a document number or a country. Crash reports never include your records or a backup account ID.

5Ads

The free version shows one Google AdMob banner, at the bottom of the main Home, Trips and Citizenship screens. There are no ads on Documents, Rights, the border card, trip details, setup or Settings, and no full-screen ads. We ask Google for non-personalized ads only, and we block ads for lawyers and immigration services, alcohol and gambling.

• Ad requests carry nothing you entered in ResidentStep. Google’s ad software still collects some information to show ads, count views and taps and prevent fraud, such as your IP address and device and advertising identifiers, under Google’s own privacy policy
• ResidentStep never shows Apple’s “Allow tracking” prompt
• In the European Economic Area, the UK and Switzerland, Google’s consent form asks for your choice first. In U.S. states with privacy laws, Google’s privacy message lets you opt out of the sale or sharing of your information for ads. You can change either in Settings
• The ad software starts only after you finish setup and accept the Terms and this policy, and never with Premium, which removes ads

6Who receives data

We share information only with the organizations that run parts of ResidentStep, and only what each one needs:

Google Firebase, Cloudflare (including Cloudflare Email Service, which sends our emails) and Expo work for us under data-processing terms and may use your information only to provide their service. Google’s AdMob and Gmail, Apple’s and Google’s sign-in, and the App Store and Google Play handle their part under their own terms and privacy policies. We don’t sell or rent personal information, and we don’t share it for targeted advertising. We may share information when the law requires it.

7Keeping and deleting data

Deleting. Settings → Delete all data removes everything ResidentStep keeps on your phone; uninstalling the app does too. Settings → Backup → Delete deletes your backup and its sign-in account. Delete your account or data has the steps.

8Downloads, purchases and reminders

• Rule updates. At most once a day, the app downloads one public file of rule updates from our data server on Cloudflare. Everyone gets the same file, and the request carries nothing about you or your records, only what every web request carries (your IP address and basic details such as the app version). Which updates affect you is worked out on your phone.
• App updates come from Expo, with the details in section 6.
• Premium is a one-time purchase through the App Store or Google Play. Apple or Google takes the payment, so we never see your card or payment details, and nothing about your purchase is sent to us. Your phone keeps the confirmation that you own Premium.
• Reminders are made on your phone, as local notifications. ResidentStep uses no push service, so we hold no notification token for your device, and reminders never show your dates, countries, names or document numbers.

What we don’t collect

• Your location (GPS or Wi-Fi), contacts or microphone. The app reads a photo or file only when you choose to add it, and it stays on your phone
• Your A-number, receipt numbers, passport number or any other record you enter: they stay on your phone, encrypted, and in your backup only encrypted
• Your Apple or Google password, or your payment details
• Anything that tracks you across other companies’ apps and websites

9Your choices and rights

• Turn backup on or off and delete it in Settings → Backup
• Turn Share usage analytics on or off in Settings → Privacy & security
• Export your data, or delete all of it, in Settings → Privacy & security
• Choose your reminders in Settings, or in your phone’s notification settings
• Change your ad choices in Settings (European Economic Area, UK and Switzerland, and U.S. states with privacy laws)

Depending on where you live, you may have the right to know, get a copy of, correct or delete the personal information we hold about you, and to object to some uses of it. Almost all of it is on your phone, where you can see, export and delete it. To delete a backup without the app, email privacy@residentstep.app from the address on the backup account. For anything else, email us too. We’ll answer within 30 days and won’t treat you differently for asking.

10Security and the border

Your records and files are encrypted on your phone, everything the app sends travels over encrypted connections (HTTPS), and your backup holds only encrypted data. No system is perfectly secure: if a breach affects your information, we’ll tell you directly, by email or in the app.

11Children

ResidentStep is not directed to children under 13, and we don’t knowingly collect their information. A parent with Premium can add a family profile for a child; it stays on the parent’s phone like every other record. If you believe a child under 13 has given us information, email privacy@residentstep.app and we’ll delete it.

12This website

This website sets no cookies and has no accounts, analytics, ads or trackers, and it loads nothing from other companies: even its fonts come from this site. If you pick Light or Dark, your choice is saved in your browser and never sent to us; it’s the only thing the site keeps there. Cloudflare, which hosts the site, may keep standard request logs.

13Users outside the United States

ResidentStep is for people who hold a U.S. green card. We’re based in the United States, and the optional backup is stored there, where privacy laws may differ from those where you live.

In the European Economic Area, the UK and Switzerland, data protection law (the GDPR, the UK GDPR and Switzerland’s data protection act) asks us to say why we use your information:

• With your consent: usage analytics (section 4.1; it starts off there), and Google’s use of your device’s storage and identifiers for ads, which you answer in Google’s consent form. The ads are non-personalized either way. You can take your consent back at any time in Settings; that doesn’t change what was done before.
• To give you what you asked for: the optional backup, Premium and Restore purchases, and answers to your emails.
• Our legitimate interests: crash reports, to find and fix problems; app checks, to keep the backup safe from misuse; deleting backups unused for 2 years and the email before it; and keeping ResidentStep secure. You can object to these.
• The law: when we must keep or share information to meet a legal obligation.

You can ask to see, correct or delete the information we hold about you, to restrict or object to how we use it, and to get a copy of it in a common format; email privacy@residentstep.app and we’ll answer within one month. You can complain to the data protection authority where you live or work: in the UK, the Information Commissioner’s Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

Transfers to the United States. Your information is processed in the United States, where we and the services in section 6 are. Google and Cloudflare receive it under the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. Data Privacy Framework, and the Standard Contractual Clauses in their data processing terms; Expo under the safeguards in its data processing terms.

14Legal versions and changes

This is version 1 of this policy. Each new version gets a new number, an effective date and a plain-language summary of what changed. A change that adds collection, sharing, a recipient or longer retention ships as a new version, and the app shows its summary and asks you to Accept before the change applies to you; until you do, the new behavior stays off. Your acceptance is saved on your phone only.

Not legal advice. ResidentStep is not a law firm and does not give legal advice. It is not a substitute for the advice of an attorney. For legal guidance, talk to a licensed immigration attorney or an accredited representative, and check important information at uscis.gov.

15Contact us

Company

D&B Evergreen Adventures LLC

Registered in

Washington, USA

Address

629 S 168th Pl, SeaTac, WA 98148-1620, USA

Product

ResidentStep

Privacy

privacy@residentstep.app

Legal

legal@residentstep.app

Support

support@residentstep.app