STEP BY STEP PICTURES
Privacy policy
Last updated: 1 October 2026 · English
Your drafts stay on your device. Creating a reader link uploads a copy so others can open it.
Who operates the app
Step by Step: Picture Guides is operated by Rihards Hendzelis, operating as Step by Step Pictures, Latvia. He is the controller responsible for the personal information processed to run this app. For privacy, support or deletion requests, email hello.stepbystep.dev@gmail.com.
This policy covers stepbysteppictures.fyi and the Step by Step Android app, which opens the same service.
Drafts on your device
You do not need an account to create or read guides. The app saves your drafts and selected pictures in storage on your device. It also stores language and other preferences, your acceptance of the sharing rules, and a randomly generated editing key. Drafts are not automatically uploaded or synchronized between devices.
The app accesses pictures you choose; it does not scan your photo library, read your contacts or record your screen. Original pictures may contain embedded metadata, which the app does not deliberately strip. The app is intended for adults and is not directed at children.
What happens when you share
Choosing Create link or Update link uploads the guide title, device description, instructions, picture files, pointer positions and notes, guide identifiers and update information. Your device sends its editing key to authorize the request; the server stores a hash of that key as an ownership identifier. Uploads may remain temporarily if sharing fails.
Anyone with the reader link can view and forward the published guide without an account. These links are not private access controls and have no automatic expiry. Saving a later local draft does not change the published copy; choose Update link to publish changes.
Only share information you are entitled to share. Remove passwords, payment-card details and unnecessary personal information from pictures. Do not use this service to store confidential medical records. People shown or named in a guide can contact us about their information even if they do not use the app.
Hosting, cookies and traffic information
The service runs on OpenAI Sites, with Cloudflare infrastructure for the application, database and pictures. Loading it sends network information such as your IP address, browser information, requested addresses and request times to the hosting infrastructure. These requests support delivery, security and troubleshooting. Sites also automatically records traffic statistics, including page views and unique visitors. We do not add a separate website analytics SDK. The Android test build can use Google advertising services as explained below.
Browser storage keeps your drafts and preferences until you remove them or the browser removes them. The hosting service can set security and authentication cookies. We observed Cloudflare’s __cf_bm security cookie; Cloudflare documents that it expires after 30 minutes of continuous inactivity. Other security cookies may be used when a security challenge is required. Optional ChatGPT sign-in also uses the provider’s authentication controls.
You can manage cookies and stored site data in your browser. Blocking necessary storage may stop saving or sign-in from working. Clearing storage can permanently remove drafts and the key needed to edit or delete an online guide. It does not delete the online copy. We have not established a fixed retention period for all provider-side traffic logs and backups; contact us for help with an access or deletion request.
Advertising in the Android test build
Android test builds include Google Mobile Ads and the Google User Messaging Platform (UMP). They request Google demo ads only, not revenue-generating ads. A preloaded ad may appear after a creator successfully creates or updates a reader link, with at least ten minutes between ads, including across app restarts. There are no ad placements in reader guides, ordinary browser use or draft saving. The guide is saved before the ad step; an unavailable ad is skipped and the sharing link remains available.
Before requesting ads, the Android creator launch checks the remote ad setting and updates Google’s consent information. Where required, Google presents consent choices. The Ad privacy link at the bottom of the creator screen lets you revisit available choices. Opening it pauses ads for that app session. Declining consent does not prevent creating, saving, sharing or reading guides; Google may permit limited ads under the choices that apply.
Ad requests can send Google your IP address (which can indicate an approximate location), app and ad interactions, diagnostics, and device or app identifiers. This supports advertising delivery, measurement and fraud prevention, even when demo ads are used. This build does not request the Google Play services advertising ID permission. Other advertising-service permissions and identifiers may still be used; removing that permission does not make ad requests anonymous. We do not request precise location or deliberately send guide titles, instructions, pictures or editing keys to Google’s ad services.
The app stores consent choices and local records of handled publish-request identifiers and ad timing to prevent duplicate requests and enforce the cooldown. Older test builds may also retain handled guide identifiers. Google handles information under its advertising terms and privacy policy and may process it outside your country. We do not set or control all of Google’s retention periods. See the Google advertising information linked below and use Ad privacy or contact us for help. Revenue-generating ads require a further release review.
Reports and owner access
When you report a guide or its creator, we store the guide reference, whether the report concerns the guide or creator, selected reason, timestamps and review status. We do not request a reporter name, email address or free-text explanation. The hosting service still receives the network request.
The operator reviews reports and can stop public access to a guide and its pictures or suspend sharing from a creator’s editing identity. A suspension stores a hashed ownership identifier and timestamp and stops that identity’s existing public guides and further uploads or sharing. A report alone does not automatically remove anything. Hidden guides remain stored for review and possible restoration. Creators retain their private drafts and can request a review by email.
A scheduled Codex check reads report references, reasons, timestamps and status and alerts the operator about new reports. These records are processed in the operator’s OpenAI conversation; the check does not automatically open reported pictures or decide takedowns. This use of Codex is governed separately from the Sites hosting agreement by OpenAI’s terms, privacy policy and applicable account controls.
The owner-only review page uses Sign in with ChatGPT. After authorization, OpenAI can provide account profile information; the app checks the authenticated email to restrict moderation access. Ordinary readers and creators do not need to sign in.
Readers can block a creator without an account. A separate hashed creator identifier is included with shared guides and saved in the reader’s browser block list. It is not the creator’s editing key or name. Blocking hides guides using that identity on that browser only, sends no report and can be undone from a blocked guide. Clearing browser storage removes this preference. A creator who resets their editing identity is not automatically matched to the old identity.
Why we use information
We use the information to save and deliver requested guides, protect editing access, operate the service, answer support requests, handle privacy requests and investigate misuse.
Under the GDPR, we rely on performance of the service requested by the user where Article 6(1)(b) applies. For proportionate security, abuse prevention, support and handling third-party information incidentally included in guides, we rely on legitimate interests under Article 6(1)(f), subject to the rights and interests of affected people. Those interests are providing the requested picture-guide service safely and responding to problems. Legal obligations may require processing under Article 6(1)(c). Where consent is required, it must be obtained separately; this policy itself is not a request for blanket consent.
We do not sell personal information. We do not use automated decisions to determine whether a reported guide is removed. If you object to information about you being included in a guide, please contact us with the link.
Providers and international processing
OpenAI Ireland Ltd processes published-site hosted data on our behalf under the ChatGPT Sites Data Processing Addendum. OpenAI uses subprocessors, including hosting infrastructure. Data may be processed outside the European Economic Area; we do not promise EU-only storage. The Sites addendum provides for relevant transfers using European Commission adequacy decisions or standard contractual clauses.
When you email support, Google’s Gmail service processes your address and message. OpenAI also processes information used in optional sign-in and in the operator’s Codex report checks under its applicable service terms and privacy policy. Provider information and transfer safeguards are linked below. Contact us if you need further information or a copy of applicable safeguards.
Information may also be disclosed where necessary to comply with a legal obligation or to establish, exercise or defend legal claims. Published guides are disclosed to the people who open their links at the creator’s direction.
Retention and deletion
Local drafts stay on your device until you delete them or storage is cleared. Shared guides stay online until their creator deletes them or the operator removes them; there is no automatic expiry.
Use My guides → Delete on the device that created the guide to remove its draft and request deletion of its online copy. An internet connection and the editing key are needed. After a successful server deletion, the reader link stops working. Pictures still referenced by another guide are kept. Unused uploads are cleaned up through maintenance triggered by subsequent requests; uploads abandoned for more than 24 hours are eligible, but this is not a guarantee of deletion exactly 24 hours later.
Reports and support correspondence are retained for the time needed to investigate, respond, handle relevant follow-up or appeals, prevent repeated abuse or meet legal obligations. The need for retention depends on whether the issue is resolved, the seriousness of the incident and any continuing dispute. Reports and hidden guides currently have no automatic deletion timer; deleting a guide does not automatically erase a separate report record. You can request a review of retained information through our support email.
Report information copied into the operator’s Codex conversation can remain there until that conversation is deleted, subject to OpenAI’s retention practices and legal or security exceptions. Removing a database record does not automatically remove this separate copy. We handle applicable deletion requests across the systems we use. Provider logs and backups may follow separate retention and deletion schedules; immediate erasure from every backup is not promised.
If you lose editing access, email us with the guide link and the issue. We may need limited information to verify your authority before acting. Never send passwords or your editing key. We cannot retract copies that recipients have downloaded or forwarded.
Your choices and rights
You can use local drafts without creating a reader link. Sharing and reporting are optional. Providing a picture and guide content is necessary to create a reader link; you do not need to provide a name or email to use that feature.
Where applicable, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You can withdraw consent for processing that relies on consent without affecting earlier lawful processing. Email hello.stepbystep.dev@gmail.com to exercise your rights. You may complain to your local data protection authority; in Latvia this is the Data State Inspectorate (Datu valsts inspekcija).
Changes
We will update this notice and its date when the service or our practices change. Material changes will be explained in the app where appropriate. Material changes to advertising or its data handling will require an updated notice.