Privacy Policy

Who We Are

WalkAura ("we", "us") is a mobile role-playing game in which in-game progression is driven by your real-world steps. This policy explains what data the game collects, why, on which legal bases, and what control you have over it. It applies to the WalkAura Android app and the walkaura.app website.

Privacy contact: support@walkaura.app

Data We Collect

Physical activity (step counts and time intervals). With your permission, WalkAura uses Android's Recording API on mobile, provided through Google Play services, to obtain step-count intervals recorded on your device. The Recording API is accountless and temporarily stores recorded step information on the device. WalkAura reads the resulting step counts and time intervals and sends them to WalkAura's game servers for gameplay and anti-cheat processing. Recording continues on your device even while the app is closed or not in use; upload to our servers happens when the app is open. The only Android permission used for this is Physical activity (ACTIVITY_RECOGNITION). We do not collect GPS or other location data, routes, heart rate, or any other health or fitness measurement — only step counts and their time intervals.

Account data. A username, and — if you sign in with Google — your Google account identifier and email address. Password accounts store only a salted, adaptively hashed password; we never store your password itself.

Gameplay data. Your character's progression: levels, items, quests, activities, achievements, in-game currency and similar game state, with timestamps.

Security and diagnostic data. Server logs (connection metadata, IP-based rate-limiting counters, error reports, and records of rejected or implausible step submissions) used to keep the service working and fair.

Records of agreements and consent. We record the version and time of your acceptance of the Terms of Service. Separately, the step-data disclosure shown to you and your consent to step tracking are recorded on your device together with the disclosure version, and the resulting Android permission state governs whether any collection happens. Records of account deletion requests and completions are retained as described below. This Privacy Policy itself is provided as information and is not bundled with acceptance of the Terms.

Website. The website no longer accepts launch-waitlist sign-ups. If you joined the earlier launch waitlist, we keep that email address only until we send the launch announcement or you withdraw. The web deletion form stores the request details you submit for as long as needed to process and evidence the deletion. Fonts are served from our own site; no font requests go to third parties.

Closed beta. The beta is distributed through Google Play closed testing. To join, you become a member of the WalkAura tester group on Google Groups and opt in on Google Play; Google provides these services under its own privacy policy. As the group owner, we can see the name and email address of your Google account while you are a member. We use them only to manage access to the beta, and we do not add them to any mailing list.

We do not collect advertising identifiers, we show no ads, and we do not sell or share your data with third parties for advertising.

How We Use Data & Legal Bases

Step-powered gameplay. Processing step-count records is necessary to provide WalkAura's step-powered gameplay and is based on Article 6(1)(b) GDPR. To the extent that timestamped physical-activity records constitute data concerning health, we additionally process them on the basis of your explicit consent under Article 9(2)(a) GDPR. We request this consent separately, in the app, immediately before requesting the Android permission or beginning collection. You may withdraw it at any time through Android's permission settings (revoke Physical activity). Withdrawal does not affect processing that lawfully occurred before withdrawal. After withdrawal, WalkAura stops obtaining and transmitting new step records and step-powered progression no longer advances; you can keep playing with the progress you already earned.

Account and gameplay data are processed to perform our contract with you — running your saved game and authenticating you (Article 6(1)(b) GDPR).

Security and anti-cheat. We process limited security and anti-cheat data under Article 6(1)(f) GDPR. Our legitimate interests are preventing fraud, protecting player accounts, maintaining fair competition, diagnosing failures, and securing the service. You may object to this processing on grounds relating to your particular situation, although we may continue where compelling legitimate grounds apply.

Earlier waitlist emails are processed on the basis of your consent (Article 6(1)(a) GDPR) for the sole purpose of sending one launch announcement; you can withdraw at any time.

Beta tester group membership is processed to give you the beta access you asked for (Article 6(1)(b) GDPR).

Consent and deletion records are kept to comply with legal obligations (Article 6(1)(c) GDPR).

We do not use personal data for advertising, marketing profiling, credit assessment, insurance, employment, or medical purposes. We do use automated anti-cheat rules to evaluate whether submitted step records appear technically plausible — see below.

Automated Anti-Cheat

WalkAura compares step submissions using factors such as the submitted count, time interval, submission sequence, duplication, consistency with earlier submissions, and technical validation results. We do not disclose exact thresholds because doing so would undermine fraud prevention.

An automated check may reject a step submission or withhold related progress, and may flag an account for review. Permanent termination of an account is not based solely on an automated flag; a person reviews the relevant evidence. You may contest a rejected submission, correction, suspension or termination by contacting support@walkaura.app within one month.

Public & Social Features

WalkAura has in-game leaderboards. Other players can see your username, avatar, character level, rank, and the ranked value of the board you appear on — including your total and weekly step counts on the step boards. We do not publicly display your email address, Google identifier, IP address, detailed step timestamps, or any location information. Leaderboard participation is currently part of the game for all accounts. Automated test accounts operated by the WalkAura team run on separate test environments and their results are not presented as ordinary player results.

Where Data Lives, Transfers & How Long

Our game database is hosted on servers in the European Union. The website uses Cloudflare for content delivery, security, request handling and storage of earlier waitlist sign-ups; Cloudflare may process request information and that waitlist data in countries outside the EEA, including the United States. Where required, such transfers are protected through an applicable adequacy decision, participation in the EU–US Data Privacy Framework, Standard Contractual Clauses, or supplementary safeguards; further information is available from us on request.

Retention periods per category:

• Account credentials and game state: account lifetime, plus the 7-day deletion grace period
• Step records (counts and intervals): as long as your account exists — they power your statistics, streaks and anti-cheat checks — and are deleted with it
• Ordinary connection, IP and error logs (including records of rejected submissions): rolling window of at most 30 days
• Earlier waitlist email: until the launch announcement is sent or you withdraw
• Beta tester group membership: until you leave the group or we close the beta group
• Terms-acceptance evidence: kept with the account and deleted with it
• Minimal deletion-completion evidence: up to three years after deletion, unless a dispute requires longer
• Disaster-recovery backups: no longer than 14 days, locally and offsite

Deleting Your Data

You can delete your account and all associated data at any time:

In the app: Settings → Delete account. Without the app: use the web deletion page. Deletion is scheduled with a 7-day grace period — signing in during that window shows a pending screen where you can cancel — after which all your account and gameplay data is permanently purged.

What survives a purge: minimal deletion-completion evidence (a hashed identifier and the internal account identifier with timestamps — no gameplay or personal profile data), kept for up to three years so we can prove the deletion happened and re-apply it after any backup restore; and entries inside backups until those rotate out (at most 14 days). A restore therefore cannot resurrect a deleted account.

You can also revoke the Physical activity permission at any time in Android system settings; the game keeps working, but steps stop counting.

How We Protect Data

We use technical and organisational measures appropriate to the risks of the processing. These include encrypted network transport using TLS for all app and website traffic, adaptive one-way password hashing, servers restricted to administrative access over authenticated channels, file-permission-protected secrets, security logging of rejected submissions and authentication abuse, regular dependency and server updates, and backups held in access-restricted storage with a fixed rotation. Access is limited to people who need it for operation, security, maintenance or legal compliance.

No internet service can guarantee absolute security. We review our safeguards and update them as the service and associated risks change.

Your Rights

Depending on where you live (including under the GDPR), you have the right to access, correct, export and erase your personal data, to withdraw consent, and to object to or restrict processing. Write to support@walkaura.app and we will respond within one month. You also have the right to complain to your local data-protection authority.

Children

WalkAura is not offered to persons under the age of 16 in the European Economic Area. In other countries, users must be at least 13 and meet any higher minimum age required by local law. We do not knowingly collect data from children below these ages. If you believe such a child has created an account, contact us and we will delete it.

Website Cookies & Local Storage

Website notice updated: 7 October 2026. Our website code sets no cookies and loads no advertising or analytics trackers. Fonts and game images are hosted on this site.

Your choice. The privacy frame asks whether we may remember that you dismissed it. Selecting Remember my choice saves a version number and timestamps in your browser's local storage under walkaura.privacy-notice. It contains no email address or user identifier, is not sent to our server, and is valid for 180 days. After that it is no longer used to dismiss the notice. Selecting Continue without saving closes the notice for the current page without saving anything; it will appear again on your next page visit.

You can reopen the frame using Cookie settings in the footer of any page. Choose Continue without saving to remove a previously saved choice, or clear this site's data in your browser. If storage is blocked, all website features remain available.

Hosting security. Cloudflare delivers and protects this website. It may set strictly necessary security cookies when a security feature or challenge is triggered. These are separate from our optional notice preference. See Cloudflare's cookie documentation for their purposes and lifetimes.

Third-Party Services

The app uses Google Play services for on-device step recording (Recording API) and optional Google Sign-In; their processing is governed by Google's Privacy Policy. The closed beta uses Google Groups and Google Play testing (see Closed beta above). Our website is delivered through Cloudflare (see transfers above).

Changes

We may update this Privacy Policy to reflect changes in the service, law, providers or data processing. We will update the effective date and notify users before material changes take effect. Where a change introduces a materially new purpose, a new category of sensitive data, or processing that requires consent, we will provide a new disclosure and obtain fresh consent before beginning that processing. Continued use is not treated as consent where applicable law requires an affirmative choice.