Last Updated: August 31, 2026
ASHLAR USA (“we,” “our,” or “us”) develops and operates MiniSteps (“MiniSteps” or the “App”).
MiniSteps is a family routine, task, reward, and calendar application designed to help parents and children organize daily activities, manage routines, and track progress.
MiniSteps is designed so that a parent or adult account holder creates and manages the family account and child profiles. Children do not create traditional MiniSteps accounts or provide personal contact information.
This Privacy Policy explains what information MiniSteps collects, how that information is used and protected, the third-party services used by the App, and the choices available to parents and users.
This Privacy Policy applies to the MiniSteps mobile application available through the Apple App Store and, if released in the future, the Google Play Store.
Parents or adult account holders may provide or create the following information:
We encourage parents to use a child’s first name or nickname and not enter unnecessary sensitive personal information into MiniSteps.
Children do not create traditional MiniSteps accounts and are not asked to provide:
Parents create and manage the information contained in a child’s profile.
A child may use a paired MiniSteps device to:
When a child marks a task as completed, MiniSteps stores that completion status and related reward progress in the family’s MiniSteps account.
MiniSteps uses Firebase Anonymous Authentication on paired child devices.
This allows the App to assign a unique Firebase authentication identifier to a child device without requiring the child to provide a name, email address, password, or other contact information.
The anonymous authentication identifier is used for purposes such as:
MiniSteps may also store technical pairing information, including:
Temporary pairing codes may also be used to connect a child device or another authorized adult to a household.
These identifiers and pairing data are used to provide and secure MiniSteps functionality and are not used for advertising or cross-app tracking.
MiniSteps and its infrastructure providers may process limited technical information necessary to authenticate users, secure the App, prevent abuse, and provide reliable service.
This may include:
MiniSteps does not use this information to create advertising profiles about children or parents.
MiniSteps does not collect precise or approximate geographic location data.
MiniSteps does not use Apple’s Location Services to determine a user’s physical location.
MiniSteps does not display behavioral or targeted advertising.
MiniSteps does not:
MiniSteps does not use IDFA for targeted advertising or cross-app advertising tracking.
MiniSteps does not track users across apps or websites owned by other companies for advertising purposes.
MiniSteps does not use information collected from child profiles or child devices to build advertising profiles or to target advertisements.
MiniSteps may request device permissions necessary to provide optional functionality.
| Permission | Purpose | Required? |
|---|---|---|
| Notifications | Send local reminders relating to MiniSteps use | Optional |
| Apple Calendar Access | Allow a parent to select and import events from calendars available through Apple EventKit | Optional |
| Google Account Authorization | Allow a parent to authenticate with Google and, when authorized, access Google Calendar information | Optional |
Users may change or revoke device permissions through iOS Settings or through the applicable account provider.
MiniSteps currently uses Apple’s local notification system to provide reminders.
Local notifications are scheduled on the device using Apple system APIs.
MiniSteps does not currently use Firebase Cloud Messaging to send MiniSteps reminders to child devices.
Users may disable notifications at any time through their device settings.
MiniSteps supports parent or adult account authentication using third-party identity providers.
Parents may choose to authenticate using Sign in with Apple.
MiniSteps may request:
Apple may limit or relay the email address provided depending on the user’s Apple privacy settings.
MiniSteps uses the resulting authentication credential to authenticate the parent through Firebase Authentication.
Parents may choose to authenticate using Google Sign-In.
MiniSteps may receive information necessary to authenticate the parent, which may include:
MiniSteps uses this information to authenticate the parent through Firebase Authentication.
The current version of MiniSteps may also request read-only Google Calendar authorization as part of the Google authorization process.
Calendar access is intended for parents and adult account holders.
Children are not asked to connect external calendar accounts.
A parent may authorize MiniSteps to access calendars available through Apple’s EventKit framework.
If permission is granted, MiniSteps may access information from calendars selected or available on the device, including:
MiniSteps uses this information to allow the parent to import selected calendar events as MiniSteps tasks or activities.
Imported calendar information may be stored in Cloud Firestore as part of the child’s task or calendar information.
MiniSteps does not use Apple Calendar information for advertising.
MiniSteps may request read-only access to a parent’s Google Calendar using Google’s OAuth authorization system.
When authorization is granted, MiniSteps may access information necessary to display available calendars and import calendar events, including:
MiniSteps uses Google Calendar information only to provide calendar-related functionality requested by the parent.
Google Calendar information may be converted into MiniSteps tasks and stored in Cloud Firestore when a parent chooses to import those events.
MiniSteps does not:
MiniSteps’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including applicable Limited Use requirements.
Parents may revoke MiniSteps’ Google authorization through their Google Account permissions.
Revoking authorization prevents MiniSteps from obtaining new Google Calendar information. Calendar events previously imported into MiniSteps may remain in the MiniSteps account until they are removed by the parent or the associated account data is deleted.
We use information collected through MiniSteps to:
We do not use children’s information for targeted advertising, behavioral advertising, or cross-app tracking.
MiniSteps is designed for use by families and may be used by children under the supervision of a parent or legal guardian.
A parent or adult account holder creates and manages the family’s MiniSteps account.
Parents determine:
Children are not required to create a traditional account or provide personal contact information.
The primary information generated through a child’s use of MiniSteps consists of:
MiniSteps does not knowingly request unnecessary personal information directly from children.
The Children’s Online Privacy Protection Act (“COPPA”) establishes requirements concerning the online collection of personal information from children under 13.
MiniSteps is designed so that parents or legal guardians establish and manage the family account and provide information associated with child profiles.
Children are not asked to provide personal contact information.
MiniSteps does, however, use limited persistent technical identifiers on paired child devices through Firebase Anonymous Authentication and Firebase security services. These identifiers are used to support MiniSteps’ internal operations, including authentication, security, device pairing, and access control.
They are not used for:
Where applicable law requires parental notice, authorization, or consent for a particular collection or use of children’s information, MiniSteps will provide the required notice and obtain any required authorization before enabling that collection or use.
Parents and legal guardians may have the right to:
Parents may submit privacy-related requests by contacting:
ministeps@ashlarusa.com
MiniSteps allows authorized devices and adults to be associated with the same household.
MiniSteps may generate temporary pairing codes for this purpose.
Pairing-related records may include:
Pairing codes are intended to be temporary and are used only to establish authorized access to the appropriate MiniSteps household.
MiniSteps restricts paired child devices to information associated with the household and child profile for which the device has been authorized.
MiniSteps uses a limited number of third-party services necessary to authenticate users, store data, secure the App, and provide optional calendar functionality.
MiniSteps uses Google Firebase.
Services currently used include:
| Firebase Service | Purpose | Information Involved |
|---|---|---|
| Firebase Authentication | Authenticate parents and anonymously authenticate paired child devices | Email address, authentication credentials, account identifiers, anonymous user identifiers, IP address, and related technical information |
| Cloud Firestore | Store MiniSteps family information | Household data, child profile names or nicknames, routines, tasks, completion information, reward information, imported calendar information, pairing information, and access-control information |
| Firebase App Check | Protect Firebase resources from unauthorized applications and abuse | App-attestation information, technical identifiers, and security information |
| Firebase Infrastructure | Provide backend storage, synchronization, authentication, and security functionality | Technical information necessary to provide Firebase services |
MiniSteps does not use Google Analytics for Firebase.
Firebase services may process technical information necessary to authenticate users, secure requests, prevent abuse, and operate Firebase infrastructure.
MiniSteps does not use Firebase services for behavioral advertising.
MiniSteps may use Apple services including:
Apple processes information associated with these services according to Apple’s own privacy policies and platform rules.
MiniSteps may use:
These services are used only for parent authentication and parent-authorized calendar functionality.
Google may independently process information associated with a user’s Google Account under Google’s own privacy policies.
MiniSteps’ use of information received from Google APIs is limited to providing functionality requested by the user.
Google Calendar information accessed by MiniSteps is used to:
MiniSteps does not use Google API data for advertising.
MiniSteps does not sell Google API data.
MiniSteps does not use Google API information to create advertising profiles.
MiniSteps does not transfer Google Calendar information to unrelated third parties except where necessary to provide MiniSteps functionality, comply with law, protect users or MiniSteps, or where the user has expressly authorized the transfer.
MiniSteps’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
MiniSteps primarily uses Google Firebase Cloud Firestore to store family and App information.
Data stored in Firestore may include:
Some device-pairing information is also stored locally on the paired device to allow MiniSteps to remember which household and child profile that device is associated with.
We use reasonable administrative and technical safeguards designed to protect MiniSteps information.
Current security measures include:
No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
We retain information only for as long as reasonably necessary to provide MiniSteps, maintain account functionality, secure the service, comply with applicable law, and resolve disputes.
In general:
| Data Type | Retention |
|---|---|
| Parent account information | While the account remains active and as reasonably necessary following deletion |
| Child profile information | Until removed by the parent or the associated household/account is deleted |
| Tasks and routines | Until removed by an authorized parent or the associated data is deleted |
| Task-completion information | Until deleted or the associated profile/account data is deleted |
| Reward information | Until deleted or the associated child profile/account data is deleted |
| Imported calendar information | Until removed by the parent or the associated account data is deleted |
| Pairing information | For as long as necessary to maintain authorized pairing and security |
| Temporary pairing codes | For a short period necessary to complete pairing or until they expire or are removed |
| Authentication identifiers | For as long as necessary to maintain account or paired-device access |
| Security and App Check information | As necessary for authentication, abuse prevention, security, and Firebase service operation |
| Support communications | As reasonably necessary to respond to and document the request |
Some information may temporarily remain in system backups, logs, or infrastructure operated by our service providers before being deleted or overwritten.
We may retain limited information longer where required by law or reasonably necessary for security, fraud prevention, dispute resolution, or enforcement of our rights.
MiniSteps provides account-deletion functionality for signed-in parent accounts.
For security, the App may require the parent to have authenticated recently before an account can be deleted.
When an eligible parent account deletion is completed, MiniSteps is designed to delete the associated Firebase Authentication account and applicable Firestore records associated with that account and household.
Depending on household configuration, deletion may include information such as:
Deletion behavior may account for situations where multiple authorized adults share access to the same household so that one adult’s deletion request does not improperly delete information belonging to another authorized account where continued storage is permitted or required.
Users may also request deletion by contacting:
ministeps@ashlarusa.com
We will process verified requests as required by applicable law.
Parents may revoke MiniSteps’ Apple Calendar permission through iOS Settings.
After permission is revoked, MiniSteps will no longer be able to access calendar information through EventKit.
Events already imported into MiniSteps may remain as MiniSteps tasks until the parent removes them.
Parents may revoke MiniSteps’ Google account or Google Calendar authorization through their Google Account settings.
After authorization is revoked, MiniSteps will no longer be able to retrieve new Google Calendar data using the revoked authorization.
Previously imported MiniSteps tasks may remain until deleted from MiniSteps.
For the iOS version of MiniSteps:
The App Privacy disclosures provided through App Store Connect will reflect the functionality and data practices of the version of MiniSteps submitted for review.
MiniSteps may provide functionality intended for children.
Parents are responsible for establishing and managing child profiles and pairing child devices.
MiniSteps is designed to minimize information requested directly from children and does not include third-party advertising or third-party behavioral analytics.
Any distribution of MiniSteps within Apple’s Kids Category will be subject to Apple’s applicable Kids Category requirements.
Depending on applicable California law, California residents may have rights relating to their personal information, including rights to:
MiniSteps does not sell personal information.
MiniSteps does not share personal information for cross-context behavioral advertising.
Where applicable, individuals located in the European Economic Area or United Kingdom may have rights concerning their personal information, including rights to:
Users may also have the right to lodge a complaint with an applicable data-protection authority.
Users in other jurisdictions may have additional rights under applicable privacy laws.
To exercise a privacy right, contact:
ministeps@ashlarusa.com
We may need to verify the identity and authority of the person making the request before responding.
MiniSteps uses Google Firebase and other service providers that may process information in countries other than the user’s country of residence.
Firebase Authentication is operated through infrastructure in the United States, while services such as Cloud Firestore and Firebase App Check may use Google’s global infrastructure. :contentReference[oaicite:1]{index=1}
Where required by applicable law, appropriate safeguards will be used for international processing or transfers of personal information.
ASHLAR USA does not sell personal information collected through MiniSteps.
We do not sell children’s personal information.
We do not provide child-profile information to data brokers.
We do not use child-profile information for targeted or behavioral advertising.
We may update this Privacy Policy as MiniSteps changes.
If we make material changes, we may provide notice through one or more of the following:
The “Last Updated” date at the top of this Privacy Policy indicates when this policy was most recently revised.
If you have questions, concerns, parental requests, account-deletion requests, or other privacy inquiries, contact:
ASHLAR USA
Email:
ministeps@ashlarusa.com
Mailing Address:
2508-A Verona Pl.
Ellicott City, MD 21042
United States
Last updated: August 31, 2026