Walking to the Moon — Privacy Policy

이 방침의 한국어판: 개인정보처리방침 (한국어)

Walking to the Moon turns the steps you already take into progress toward the Moon. This policy explains exactly what the app reads, what stays on your iPhone, what is sent anywhere, and how to remove it.

The short version: your journey and Health data stay on your iPhone unless you separately turn Social on. In solo mode, the app can send two empty, account-free requests: one for anonymous worldwide Atlas reach counts and one for the public Shop price list. Firebase App Check and the network service may process attestation, IP, and diagnostic metadata, but neither request contains steps, Health data, local profile, or journey position. Optional purchases go through Apple, and the price paid, receipts, and transaction IDs never leave your iPhone.

Overview

Walking to the Moon turns steps into progress toward the Moon, Earth-equator equivalents, and a fictional World Trail. A person can start fresh or optionally bring an aggregate snapshot of the walking history Apple Health makes available through the journey’s activation boundary.

Total steps are the source of journey progress. The app converts steps into a standardized step-equivalent distance using steps × 0.75 m; personal height, stride, and recorded walking distance do not affect rank. Apple Health’s recorded Walking + Running Distance remains a private informational metric.

The solo journey is account-free. The local player profile, daily movement history, display-only Today cache, aggregate historical snapshot, recorded distance, and private recaps stay on the iPhone. Social features are optional. After consent, a person can create a Firebase guest profile without a provider login and may later link Apple or Google for recovery. If imported history exists, its aggregate step total and active-day count are shared under the same Social consent. Removing imported history in Settings removes that baseline from Social. Global visibility is a further opt-in.

Apple Health data

Walking to the Moon requests read-only access to:

The app never writes to Apple Health. It does not request workouts, heart rate, calories, Contacts, or real location.

The app captures an exact activation timestamp and uses two nonoverlapping intervals. Optional history is strictly before that boundary, and post-activation collection begins at the boundary. If a person chooses Bring available Apple Health history, the app previews the aggregate before saving it. Activity at or after the boundary is post-activation progress even if it occurs while the preview is open.

Walking to the Moon describes the result as available Apple Health history, not an entire-life history. Apple Health may expose only limited history, and Apple does not reliably reveal denied read access to apps. An empty result may mean no activity exists or that access is unavailable.

The history preview may show imported steps, recorded or resolved distance, estimation status, and the first and last observed activity dates. The dates identify observed activity only; they do not describe the beginning or end of an authorized window.

For private informational distance, recorded Walking + Running Distance is used when available for an interval. If steps exist without recorded distance, the app may resolve that interval as steps multiplied by 0.75 meters and marks it estimated. It does not add recorded and estimated distance for the same interval.

The Today screen separately queries the complete locally available Apple Health step total for the current calendar day. On the activation day, this can include steps taken before the activation boundary. A protected display cache stores only the local day, aggregate steps, and refresh time. That complete-day value never enters post-activation movement, all-time journey progress, Atlas crossings, recaps, Social Day, analytics, or uploads.

Android and Health Connect

Walking to the Moon on Android is the same app as on iPhone and follows everything in this policy. Only the parts that depend on the platform differ:

The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.

Core Motion live display

Walking to the Moon uses motion step counting only to keep today's number current while the app or its widget is on screen. Nothing is stored or shared. On Today, the foreground-only live delta begins at the latest Health refresh time, remains in memory, and is discarded when Today closes or a new Health snapshot arrives. It is not added to journey progress or used for Social. Steps detected only by Apple Watch appear after they reach Apple Health rather than through this live layer.

Motion & Fitness access is separate from Apple Health access and can be changed in iPhone Settings. If it is denied or unavailable, the stored journey still uses Apple Health; only the between-refresh live display is absent.

Data kept on the iPhone

The following information may be stored locally:

Walking to the Moon does not store historical Health samples, workouts, device or source-app identities, real locations, or fabricated daily history for the imported baseline.

The local movement store is excluded from ordinary device backups and is not synchronized through CloudKit. Local journey data remains until the person removes imported history, resets the journey, or removes the app, subject to iOS storage behavior.

Notifications are composed and scheduled on the iPhone itself. The optional return reminder names the next nearby Atlas place after three quiet days; it is built from local journey data, scheduled through iOS local notifications, can be turned off in Settings, and sends nothing to any server. Walking to the Moon uses no push-notification service and no remote message content.

Refreshing imported history can preview a higher or lower corrected aggregate. A new nonempty snapshot is stored only after confirmation. An empty refresh does not erase an existing snapshot. Removing imported history does not move the activation boundary or delete post-activation movement.

Anonymous Atlas reach statistics

The app can request worldwide aggregate counts showing how many opted-in Social profiles have reached each numbered Atlas stage. This works without a Firebase account so solo walkers can see the aggregate. The callable request has an empty app payload and does not include steps, a stage number, journey position, Apple Health data, the local profile, or a device-created user identifier. The response contains only the catalog revision and one aggregate count per stage. The app caches a successful response for up to one hour and falls back to local copy if the request fails.

Turning Social on also contributes the profile’s current Atlas stage anonymously to those worldwide counts, whether or not the person separately appears by name on the Global leaderboard. The server derives that stage from post-activation steps plus the imported aggregate baseline shared under social consent, when one exists. It stores one internal account-linked numeric stage mark so it can move or remove the anonymous bucket contribution when progress or consent changes. The mark is not returned in the public aggregate response or a leaderboard row; it is included in the account holder’s Social export and removed when sharing is paused or the Social account is deleted. A Social consent record, version 5 or later, counts as current only after the person checks a self-attestation that they are 14 or older. The app does not verify age or infer it from Apple, Google, Health, or other provider profile data.

Firebase Cloud Functions and Firebase App Check with App Attest process this request in the United States. As with an ordinary network request, Google and Apple may process service metadata needed to deliver and protect it, including IP address, app and device integrity signals, and request or diagnostic metadata under their policies. Walking to the Moon does not write that service metadata into its Social database or combine it with local Health or journey data.

Shop price list

The Moondust Shop can follow a public price list published by the developer. The list can change Moondust prices, which Moondust items are for sale, and their order within Shop sections without an app update. This works without a Firebase account. Like the Atlas request, the callable request has an empty app payload and contains no steps, Moondust balance, Health data, local profile, journey position, or device-created user identifier. The response contains only that price list, which is the same for everyone and holds no personal data. The app asks for it when it opens, and again when you return to it at least an hour after its last successful request. It keeps the latest accepted list and the lowest price it has seen for each item on the iPhone. If a request fails, the Shop keeps those saved prices and uses the prices built into the app for everything else. The same Cloud Functions, App Check, and service-metadata processing described for the Atlas request applies.

Optional social data

Post-activation sharing

After social consent (version 6 at this policy's date) and creation of a Firebase anonymous guest, Walking to the Moon may send a mission aggregate containing:

Wardrobe sharing

Social consent also mirrors your wardrobe so that signing in on a new device can restore the collection you built. That mirror contains only:

Moondust and trophies are claimed by your device in the same way step counts are. Walking to the Moon validates only that each identifier belongs to its own frozen catalog, so nothing outside that catalog can reach another walker's screen.

Your friends can view the items you own, the trophies you hold, the day each trophy was reached, and your lifetime day counts. Your Moondust balance is never shown to another walker. Pausing sharing and resetting the journey each delete the wardrobe mirror along with every other shared aggregate; the items themselves remain on your device.

Reactions

Social consent permits your friends to send you a fixed, wordless reaction, at most one per pair per calendar day. There is no free text of any kind. A reaction record contains the sender and recipient account references, one value from a frozen four-item list, the calendar day, and an expiry derived from that day. It carries no sent-at timestamp. Records are eligible for Firestore time-to-live deletion 14 days after their day and are removed in both directions when either account is deleted. Blocking a walker removes their reactions from your inbox immediately, including reactions sent before the block.

Imported-history sharing

Since social consent version 5, the optional imported history you brought in during onboarding is part of the same social consent rather than a separate permission. If you consented to social sharing and imported history, Walking to the Moon may send a separate baseline containing only:

No imported dates, distances, or day-level history cross the wire — only the two totals above. The server stores mission and history baselines separately and derives combined totals for authorized leaderboard projections and the anonymous Atlas stage count. Withdrawing social consent removes the remote history baseline together with every other shared aggregate and may move the anonymous Atlas stage mark downward. It does not remove post-activation mission progress or the imported history on your device.

Walking to the Moon does not send the complete-day Today cache, recorded or resolved distance, estimation status, observed dates, raw Apple Health samples, workouts, source devices or apps, routes, GPS location, granular activity timestamps, height, stride, private recaps, bios, chat, free text of any kind, or Contacts to its Social database or other walkers. If you link Google, Google Sign-In and Firebase Authentication receive and retain the provider account identifier and basic profile data, which can include name, email address, phone number, and profile-photo URL depending on the provider account and authentication flow. The app does not offer phone authentication or request extra Google scopes. Those provider fields are never copied into public Social documents.

Friends, Global, and leaderboard periods

Friendships are pairwise and formed by request: since social consent version 6, your public username is an exact-match address another consented walker can type to send you a friend request, which you accept or decline. There is no browsing, no people-you-may-know suggestions, no contact upload, and no partial-name search; a walker who does not know your exact username cannot find you. Friends receive private aggregate leaderboard summaries after a request is accepted. The Global leaderboard is separately opt-in and exposes only an opaque public ID, claimed username, validated modular avatar, authorized aggregate progress (including the daily-average inputs: period step totals and the journey start day), virtual checkpoint, rank, and day-rounded freshness. Firebase user IDs are not returned in leaderboard rows.

Walking to the Moon does not disclose whether a zero imported value means the person did not import history or removed it in Settings.

Public usernames are 3–20 lowercase ASCII characters, begin with a letter, and permit digits or single underscores. The server claims usernames case-insensitively, filters reserved and profane terms, and limits public username changes to once every 30 days. Public avatars use only bundled allowlisted parts; uploaded photos are not supported. People can block another user immediately or submit a fixed-reason report. A report stores the reporter and target account identifiers, the target’s random public ID, one fixed reason, status, and timestamps. Privileged review uses an IAM-private moderation service deployed for this app. It is reachable only by individually granted reviewer identities and is never public. It shows the target’s current public username and voyager plus sharing, Global-visibility, and moderation state, and can add a compact case reference, operator identity, fixed decision code, before-and-after moderation state, and projection-verification result. It can temporarily suspend leaderboard projections. A qualifying removal proposal temporarily holds the target’s linked-identity fingerprints while a different allowlisted reviewer decides whether to confirm or reject removal. Independent rejection or cancellation releases those holds; if the profile still exists, its projections can be restored. If the person voluntarily deleted the profile while review was pending, releasing the holds does not recreate deleted data. Confirmed removal reuses the complete Social cleanup, deletes the app-side Firebase Authentication account, verifies removal, and promotes the applicable holds into blocks. That removal path does not reset public identity and cannot revoke the provider’s own Apple or Google grant because the operator does not have the user’s fresh authorization. Restricted identity records retain only a SHA-256 fingerprint and provider type, not the raw provider identifier, email, name, photo, or token. These records do not contain raw Health data, walking totals, daily charts, screenshots, or free-form report text. The workflow requires two different allowlisted reviewers: one proposes removal, and one independently confirms or rejects it. Until a second reviewer is named, the developer moderates alone: suspensions, restorations, and appeals take effect immediately, while a permanent removal remains a pending, suspended state until a different reviewer independently confirms it. Support and moderation questions can be sent to doldorijw@gmail.com.

Purchases

Walking to the Moon may offer optional Supporter Packs and tips. They appear only when the App Store offers them. Apple processes every purchase, including payment, Ask to Buy approval, restoring purchases, and refunds, under Apple's own terms and privacy policy. The app asks the App Store which packs your Apple ID owns and unlocks the matching items on your iPhone. The price paid, payment details, receipts, and transaction IDs never leave your iPhone, and the app sends no purchase event to TelemetryDeck. If Share anonymous usage data is on, putting on a paid item sends its catalog name with that anonymous event, as it does for every item, so the event can show that an item from a pack was worn.

Items you buy show on your voyager like any outfit. When Social is on, the items you wear are part of your public voyager, which your friends see. Other consented walkers see it too when they look up your exact username or exchange a friend request with you, and so does the Global board if you joined it. Only friends can see the full list of items you own. Because each paid item belongs to one pack, the wardrobe mirror described above tells the service which packs you bought, tied to your Social account. With Social off, nothing about a purchase reaches the app's servers.

Tips unlock no items and leave no record outside Apple.

Signing in on a new iPhone with Apple or Google does not bring back paid items from Social. They return through the App Store when you use the same Apple ID. Resetting the journey keeps them. If Apple refunds a purchase, the items from that pack leave your wardrobe.

Service providers and processing location

Network features use:

Firebase Authentication is a United States-hosted service. Google processes service data under its Firebase terms and privacy documentation.

Walking to the Moon sends anonymous product-usage events to TelemetryDeck (TelemetryDeck GmbH, Germany) so we can see which screens and features are used and where people stop. An event names the screen or action (for Shop and wardrobe actions, also the catalog name of the item involved), the app version, device model, OS version, and a random per-install identifier that is hashed on your phone before sending and is reset when you reset your journey. Events never include step counts, distance, Atlas position, trophies, daily walking, health permission details, your name, username, email, or account identifier. You can turn this off at any time in Settings > Export, reset & deletion > Share anonymous usage data. The app does not integrate Firebase Analytics or Crashlytics.

Firebase SDKs and App Check can still process limited request, attestation, and service-quality metadata, including during the account-free Atlas and Shop price list requests. Their bundled privacy manifests declare unlinked other diagnostic data for analytics purposes.

Apple processes Apple Health and optional Sign in with Apple information under Apple’s terms. Google Sign-In and Firebase Authentication can process the provider account identifier and basic profile fields supplied by Google for optional account linking and recovery. Google documents that Google Sign-In may process an IP address to estimate coarse location for fraud prevention. The Google Sign-In SDK privacy manifest also declares linked name, email address, phone number, user ID, device ID, coarse location, other usage data, and other data types for app-functionality and/or analytics purposes. These declarations do not mean the app requests iOS location access, accesses the advertising identifier, enables advertising, or uses cross-app tracking. Walking to the Moon uses provider credentials only to authenticate or protect the Firebase account and does not copy provider name, email, phone number, profile-photo URL, device information, location, or SDK usage metadata into public Social or leaderboard documents.

Linking Apple or Google preserves the guest Firebase account identifier and its social data. If a provider credential is already attached to another profile, Walking to the Moon does not automatically merge the profiles. The person can keep the guest profile or explicitly delete its remote social account before opening the provider-protected profile. This choice does not alter local Apple Health steps or the local journey on this iPhone.

On a new iPhone, signing in with a previously linked Apple or Google account can recover only the same Social profile and data still held for it: public identity, friends, consent state, post-activation aggregate progress, and any imported aggregate step total and active-day count shared under that same Social consent. It does not recover daily charts, recaps, the Today cache, private recorded or resolved Health distance, observed activity dates, or device settings. The local movement store remains outside CloudKit and ordinary backups.

Retention

Cloud provider operational logs and SDK service-quality systems may retain request, usage, or diagnostic metadata under provider policies. Walking to the Moon does not intentionally place health values in application logs, SDK analytics, diagnostic reports, support tickets, or push-notification payloads.

Controls

The app provides controls to:

Health access can be changed in iOS Settings or Apple Health. Motion & Fitness access for the foreground Today live display can be changed separately in iPhone Settings. Apple does not reveal Health read-access denial directly to apps, so Walking to the Moon cannot always distinguish no data from unavailable access.

Security and integrity

Walking to the Moon uses transport encryption, provider encryption at rest, App Check, App Attest, server-only writes, strict Firestore rules, transactional username claims, strict modular-avatar allowlists, reserved-name and profanity filtering, hashed expiring invitations, fixed-reason reporting, suspension-aware projections, deletion fencing, and exact payload allowlists.

Implausible-jump filtering applies only to post-activation mission steps. Imported-history replacements may move up or down to reflect Health corrections, but require an active social consent, App Check, a higher revision, bounds checking, and a 24-hour server-side replacement cooldown. Health-derived totals can still be edited in Apple Health and are not represented as cheat-proof.

Children

Walking to the Moon is not intended for anyone under 14, and the operator does not seek to collect personal information from anyone under 14.

Fourteen rather than thirteen: COPPA sets the United States threshold at 13, and PIPA requires a legal guardian’s consent below 14. The higher number satisfies both launch regions.

If you believe someone under 14 has created a Social account, write to doldorijw@gmail.com. The workflow immediately suspends that account’s leaderboard projections, and the app-side Social account is removed only after a second, different allowlisted reviewer confirms the proposal. Until a second reviewer is named, the account remains suspended with its linked-identity holds in place, and removal completes once independent review is available. Restricted-record retention follows the approved schedule in the Retention section.

Overseas transfer of personal information

This section is provided for users in South Korea, where transferring personal information abroad must be disclosed.

With Social off, Health-derived walking aggregates, the solo journey, the local profile, and local progress do not leave the iPhone. However, the empty Atlas aggregate and Shop price list requests and their App Check protection can still transfer network, attestation, and diagnostic metadata to the providers below. Turning Social on additionally transfers only the consented aggregate and Social data described earlier; raw Health samples and private Health distance remain on the iPhone.

Leaving Social off, or turning it off later, prevents transfer of walking aggregates and Social profile data. It does not disable the read-only Atlas aggregate and Shop price list requests. Using the app without a network connection prevents those requests. The core journey stays usable with local Atlas fallback copy, and the Shop uses its saved prices and the prices built into the app.

Privacy officer

PIPA requires a named person responsible for personal information. For Walking to the Moon that is the operator:

Enquiries, access requests, correction requests, and deletion requests all go to that address. Settings can delete the active Social account and separately reset the local journey without writing to anyone. Requests concerning restricted moderation case, audit, removal-approval, or linked-identity hold or block records must use the contact address and remain subject to the approved legal-retention rule.

Your rights

In both launch regions you may ask what is held about you, ask for it to be corrected, and ask for it to be deleted.

Most active account data does not require asking. The app exports the package listed under Controls, deletes the active Social account from Settings, and can reset the local journey there too. The in-app export does not include reports submitted about you or restricted moderation case, audit, removal-approval, or linked-identity hold or block records. Contact the privacy officer for requests involving records the app cannot expose or delete directly.

Changes and contact

Material policy or upload-scope changes require an updated in-app consent version before affected publication resumes. Purchased items are the one exception. The purchase sheet says, before you pay, that items you buy show on your profile like any outfit, and only people who choose to buy are affected. Since social consent version 5, the imported-history baseline is governed by the same social consent rather than a separate permission; established sharing continues across app updates for any accepted version at or above the supported minimum, and a new consent version gates only the additional surfaces it introduces.

Questions about this policy: doldorijw@gmail.com

Reference material