Privacy Policy

Only what the app needs to work. Nothing here is collected speculatively.

Account and identity

• Your mobile number, which is how most people sign in.
• Your email address, if you sign in with Google or Apple.
• Your name, and a profile picture if you add one.

Profile details you choose to give

• Date of birth, gender, height and weight. These are used only to estimate calories burned and to set an appropriate step goal. All of them are optional, and the app works without them.
• Your time zone and country, which decide when your day rolls over for streaks.

Health and fitness

• Your daily step count, read from Apple Health on iOS or Health Connect on Android, only after you grant permission.
• Figures derived from those steps: distance, calories and active minutes.
• Water intake, if you use the hydration tracker.

Points, rewards and orders

• Your point balance and a record of every point earned and spent.
• Rewards you redeem, and the status of those orders.
• A delivery address — only if you order a physical reward. Digital rewards never ask for one.

Device and technical

• A push notification token, so we can send the alerts you turn on.
• Device model, operating system version and app version, used for support and to reproduce bugs.
• An advertising identifier, used by our ad partner (see section 5).
• Install referrer data, which tells us which campaign an install came from.

How you use the app

• App opens and screens viewed, in aggregate.
• Crash and error reports.
• Which ads were shown and what they paid.
• Anything you write to us through the in-app feedback form.

We do not collect your GPS or precise location, your contacts, your photos (beyond a profile picture you pick), your microphone, or your card details.

This gets its own section, because it is the most sensitive thing we hold and the thing people most want a straight answer about.

• We read only your step count from Apple Health / Health Connect. Not your heart rate, sleep, weight history, workouts, or anything else those platforms hold.
• We never write anything back into Apple Health or Health Connect.
• Your step data is used to calculate the points you have earned, show your progress, and run challenges and streaks. That is all.
• Your step data is never used to target advertising, is never shared with our advertising partner, and is never sold to anyone.
• You can withdraw the permission at any time in your device settings. The app keeps working; it simply stops counting steps and stops earning points.

Each purpose, and what it needs:

• Running your account — your phone number or email, and your name.
• Awarding points — your step count and your level.
• Fulfilling redemptions — your order, and a delivery address for physical items.
• Preventing fraud — device and usage signals that show whether steps were walked or faked. This protects the reward pool for everyone who walks honestly.
• Notifications you opt into — a push token.
• Keeping the app working — crash reports and performance data.
• Advertising — an advertising identifier, and nothing from your health data.

We process this on the basis of your consent, which you give when you create an account and when you grant each permission, and to perform our agreement with you when you redeem a reward. You can withdraw consent at any time (see section 7).

• We do not sell your personal data. Not to advertisers, not to data brokers, not to anyone.
• We do not use your health or fitness data for advertising or ad targeting.
• We do not share your data with third parties for their own marketing.
• We do not see or store your card, UPI or bank details — those go directly to our payment processor and never reach our servers.

We use a small number of established providers. Each receives only what it needs, and each is bound by its own privacy terms:

• Google Firebase — sign-in and push notifications. Receives your account identifier and device token. Firebase privacy
• Google AdMob — the ads in the app. Receives your advertising identifier and ad interaction data. It receives no health or step data. How Google uses ad data
• Razorpay — payments, where a reward has a cash portion. Receives the payment details you enter directly into its checkout. We receive only a confirmation that payment succeeded. Razorpay privacy
• Apple and Google — if you use Sign in with Apple or Google Sign-In, they confirm your identity to us and tell us your email address.

We may also disclose data where the law requires it, or to investigate fraud or abuse of the rewards system.

WalkACK shows ads, and some bonuses and challenge rewards are unlocked by choosing to watch one. Ads are served by Google AdMob using your device advertising identifier.

• On iOS, we ask permission before any personalised advertising. If you decline, you still see ads — they are simply not personalised.
• On Android, you can reset or delete your advertising ID, or opt out of personalised ads, in your device settings.
• Ads are never targeted using your step count, health data or physical attributes.

Under India's Digital Personal Data Protection Act, 2023, and comparable laws elsewhere, you have the right to:

• Access a summary of the personal data we hold about you.
• Correct anything inaccurate, incomplete or out of date. Most of it you can edit yourself in the app.
• Delete your account and personal data — see Delete your account.
• Withdraw consent at any time, including revoking health permissions in your device settings.
• Nominate someone to exercise these rights on your behalf if you are unable to.
• Complain to us, and escalate to the Data Protection Board of India if we do not resolve it.

To exercise any of these, email support@ackplus.com from your registered address. We respond within 30 days.

• While your account is open — your profile, point history and daily step totals, so your streaks, level and balance make sense over time.
• Raw step uploads — kept only briefly. Once folded into your daily total they serve no further purpose.
• Order and invoice records — kept as long as tax and accounting law requires, even after account deletion. We are not permitted to delete these on request.
• After you delete your account — your data is removed from the live service immediately and purged from backups within 90 days, except the records above.

All traffic between the app and our servers is encrypted with HTTPS. Passwords are stored only as irreversible hashes — we cannot read them, and neither can anyone who obtains the database. Access to production data is limited to staff who need it. No system is perfectly secure and we will not pretend otherwise; if a breach affects your data we will notify you and the Data Protection Board as the law requires.

WalkACK is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, email support@ackplus.com and we will delete it.

Your data is stored on servers in India. Some of our providers — Google and our payment processor among them — operate globally and may process data outside India under their own safeguards and applicable law.

We update this policy when what we do changes. The date at the top always reflects the current version. If a change materially affects your rights we will tell you in the app before it takes effect, rather than quietly editing this page.

For any question about this policy, or to exercise a right under section 7, contact us at support@ackplus.com.

Grievance Officer: PLACEHOLDER — officer name
Email: support@ackplus.com
Address: PLACEHOLDER — registered company name, PLACEHOLDER — registered office address

If you are not satisfied with our response, you may complain to the Data Protection Board of India.