Your account.
Your workspace.

What STEP stores

Your workspace account includes your name, username, role and, if you use password sign-in, a salted password hash. STEP also stores the projects, tasks, assignments and time records created in your workspace.

If you use Google, STEP stores your Google account identifier, verified email address and the date the connection was created. The identifier connects Google sign-in to your STEP account. Your email is shown in your own Google account settings. For a new account, STEP uses the part of your email before @ as your initial display name and generates a unique username.

How Google sign-in works

Your first Google sign-in normally creates a STEP account and an empty private workspace. You are its administrator. When you use a team invitation, STEP instead adds your account to the invited workspace as a member and opens it after sign-in. Your other workspaces stay private.

If you already have an account in a team, first sign in with your STEP username and password, then connect Google from your account menu to keep using that profile. STEP does not merge accounts by matching email addresses.

STEP requests only your Google account identifier and email address. It does not request your Google password, Gmail messages, Drive files or contacts. Google authorization codes and identity tokens are used to verify sign-in and are not stored in the STEP database. STEP does not request ongoing access to Google services.

Cookies and technical records

STEP uses a session cookie to keep you signed in for up to seven days. Google sign-in uses an additional short-lived security cookie and a one-time verification record that expires after ten minutes. These help prevent another browser from using your sign-in request.

The server also uses technical request logs and temporary rate-limit records to operate and protect the service. Google authorization codes are excluded from the callback access log.

Invitation links grant member access to one workspace for up to seven days, unless an administrator disables them earlier. STEP stores a hash of each invitation token. During Google sign-in, the invitation is temporarily remembered in your browser session storage and bound to the sign-in request so you return to the right team.

Use, access and sharing

Google account information is used only to connect your account, verify your identity and manage that connection. STEP does not sell this information or use it for advertising.

Your account and workspace records are held on the STEP server and in server backups. The service operator can access these records to administer the service. Workspace members can access shared tasks and time records according to their STEP permissions.

When you choose Google sign-in, your browser communicates with Google and the STEP server exchanges the authorization code with Google. Google handles that activity under its Privacy Policy.

Disconnecting and deletion

If your account has a STEP password, you can disconnect Google in Account menu → Google account after confirming that password. This removes the Google connection from the active database and signs you out on all devices. You can still sign in with your STEP password; your tasks and time records remain. Accounts that only use Google cannot disconnect their sole sign-in method.

Administrators can reset passwords only for eligible accounts they manage, not accounts independently registered through an invitation or shared across workspaces. Removing a teammate revokes access to that workspace while preserving their account and other workspaces. Backup copies may still contain earlier records until those backups are removed by the service operator.

Contact your workspace administrator for questions about your data, access, correction or deletion, including records retained in backups.