Privacy policy

JujuWalk turns the steps you walk into Juju, a reward you can exchange in the app. This policy explains what we collect to make that work, what we do with it, who we share it with, and the choices you have. We wrote it to be read, not skimmed: it is short because we collect little.

1. Who we are

JujuWalk is operated by Didilabs Limited, Unit B, 11/F, 23 Thomson Road, Wan Chai, Hong Kong. We are the data controller for the personal data described here. You can reach us about privacy at [email protected].

2. What we collect and why

Your steps

The app reads your step count from your phone's built-in pedometer (Core Motion on iPhone, the step counter sensor on Android). If you choose to link Apple Health or Health Connect in Profile, the app also reads your step count from there and, for each hour, keeps whichever source counted more; it never adds the two together.

• Steps are kept on your phone as hourly totals.
• Our servers receive your daily total and the hourly totals for the day, because the server decides what a day pays and checks that the numbers are humanly possible.
• Raw health records, workouts, heart rate, routes or any other health data never leave your phone. We do not read them.
• Health data is never shared with anyone, including advertising partners.

Your account

When you first open the app we create an anonymous account with a random identifier. Nothing you have to type. If you later sign in with Apple, Google or an email link, we store the identifier that provider gives us and the email address that comes with it: the one you type for email sign-in, or the one Apple or Google passes to us (with Sign in with Apple you can choose a relay address that hides your real one). This is so that your Juju and history follow you to a new phone.

Your Juju and rewards

We keep a ledger of every Juju you earn and spend: the amount, the reason (a collect, a bonus, an expedition milestone, a reward you claimed) and the time. This is the record that makes the balance you see trustworthy, and we treat it like a bank keeps its books. When you claim a reward from a partner, we record which reward and pass the partner the minimum it needs to honour it: a single-use code for digital rewards, and for physical rewards the delivery address you enter at that moment.

Your device and app

Platform (iPhone or Android), app version, language and time zone, so that a day starts and ends at your midnight, and so we can tell which release a problem belongs to.

Your country

Our network edge resolves your country from your connection when you first open the app. We use it to pick your weekly league and the rewards available where you are, and to draw the sky on the Trail with a coarse, country-level position. We do not collect your precise location and the app never asks for location permission.

The league

If the weekly league is on, other people in your country's league see your display name, your country flag, your avatar and the number of steps you collected this week. The display name is generated for you (something like “Brisk Heron 47”) and you can change it or opt out of the league in Profile. Nothing else about you is visible to other users.

Expeditions you create

When you make your own expedition, the two place names you type are sent to our routing provider to find a walking route between them. They are not tied to where you are.

Support

Messages you send to support, and any images you attach, are stored with your account so the conversation stays in one place.

Usage analytics

We count how people move through the app: how many saw a reward button, tapped it, watched a video, collected. On our own servers we keep these only as daily totals per country. We also use Google Firebase Analytics and Remote Config to test variations of the app (for example a different bonus multiplier) and to measure which works better. Firebase receives a random app-instance identifier, the same funnel events, and for each video an event with what the ad earned (amount, currency, placement, ad unit and ad source); it never receives your name, email or steps. Firebase keeps these as individual events tied to the app-instance identifier for the retention period Google applies to our project (two months for user-level data), then as aggregates.

Analytics run on our legitimate interest in understanding and improving the app; the identifier is random, is not linked to your account, and is reset when you reinstall. If you object to this processing, write to [email protected].

Crash reports

When the app crashes or runs into an error it can recover from, a report goes to Google Firebase Crashlytics so we can fix it. A report contains the device model and operating system version, the app version and language, the server the app was talking to, the error and the technical trace of where it happened, the app's own diagnostic lines from that session (which name screens, request paths and outcomes, never your steps or the content of what was sent), and your random account identifier, so we can tell whether one person or many hit the same problem. Google keeps crash reports for 90 days. Crash reporting runs on our legitimate interest in keeping the app working; to object, write to [email protected].

Advertising

Some rewards in JujuWalk are paid after you watch a short video. Those videos come from an advertising network (Google AdMob). To show and count a video the network receives a placement identifier, a one-time nonce we use to verify the reward, your random account identifier, and the standard device information the ad SDK collects, which may include your device's advertising identifier where you have allowed it. It never receives your steps, your goal, your streak or any health data, and we do not build advertising profiles from your activity.

When a video completes, the network tells our servers so that the reward can be verified: we store that confirmation with your account identifier, the placement, the nonce, the network's transaction identifier and whether its signature checked out, and we keep it for 90 days. We also receive, per video, what the ad earned (amount and currency), which we record in Firebase as described under usage analytics and use to understand how the app pays for itself.

Whether ads may be personalised is your choice. In the European Economic Area and the United Kingdom the app asks for your consent through Google's consent form before the first ad, and you can change your answer at any time under You → Ad privacy options. On iPhone, the first time you start a video the app explains and then shows Apple's tracking prompt; if you decline, the advertising identifier is not shared with the network.

3. What we do not collect

• Precise location, contacts, photos other than the ones you attach to a support message, microphone, camera.
• Raw health data of any kind.
• Payment details. JujuWalk has no purchases.

4. Legal bases

Under the GDPR and UK GDPR we rely on: performance of our contract with you (running the app, keeping your ledger, delivering rewards); our legitimate interests (preventing fraud and abuse, keeping the service secure, understanding how the app is used in aggregate); and your consent (linking a health platform, personalised advertising where the law requires consent, the league display name). Where we rely on consent you can withdraw it at any time in the app: You → Ad privacy options for advertising, the settings for the rest. Usage analytics run on legitimate interest; to object, write to [email protected].

5. Who we share data with

We do not sell personal data. We share it with providers who process it for us under contract, and with reward partners when you claim a reward:

We may also disclose data when the law requires it or to protect the rights and safety of our users and ourselves.

6. International transfers

We and the providers above may process your data in countries other than your own. Where data leaves the European Economic Area or the United Kingdom we rely on the European Commission's standard contractual clauses or an adequacy decision, so that it stays protected to the same standard.

7. How long we keep it

• Your ledger, your daily step totals and your account record are kept for as long as your account exists, and in anonymised form afterwards (see section 8).
• Records of ad views are kept for 90 days, records of refused rewards for 180 days, expired sign-in links for 30 days.
• Support conversations and attachments are kept while your account exists.
• Our own analytics are kept only as daily totals; Firebase keeps individual events for Google's retention period (two months for user-level data).
• Crash reports are kept by Google for 90 days.
• Ad reward confirmations are kept for 90 days.

8. Deleting your data

Profile › Privacy › Delete my data does two things. It erases everything on your phone: your Juju, your history and your streak. And it closes your account on our servers: your sign-in identifiers, email, display name, avatar and country are removed, and the account is replaced by an anonymous marker. The ledger keeps the anonymous record that an account earned and spent certain amounts on certain days, because that is what keeps the reward system honest for everyone. That record can no longer be connected to you.

9. Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it (which we do as described above), object to processing based on our legitimate interests, and ask for your data in a portable form. Write to [email protected]. If you are unhappy with how we handle your data you can complain to your local data protection authority.

10. Children

JujuWalk is not directed at children and does not knowingly collect data from them. You must be at least 16 to use it in the European Economic Area and the United Kingdom, and at least 13 elsewhere. If we learn that we hold data from a younger child we delete it; write to [email protected].

11. Security

Data travels encrypted between your phone and our servers. Sign-in tokens are stored in your phone's secure storage. Access to our servers is limited to the people who run the service.

12. Changes

When this policy changes in a way that matters, the app tells you before the change applies. The date at the top always shows the current version.