Privacy policy
Banana Walk turns your steps into coins and collectible bananas. This page says what the app keeps, where it goes, and how to get rid of it.
Effective [the date this version is published]What the app collects
Without an account, everything below lives only on your phone, in the app's own storage. Deleting the app removes it from the phone; a backup of your phone (such as an iPhone backup to iCloud) may still contain it until that backup is replaced.
| Data | Where it comes from | Why |
|---|---|---|
| Step counts and walking distance | Your phone's motion sensor: on iPhone through Apple's Core Motion, after you allow Motion & Fitness; on Android through the step counter, after you allow Physical activity | To count today's steps, pay coins, and keep your step history and personal records |
| Steps from Apple Health (iPhone) | Apple Health, read only, after you allow it: your step count per day and per hour. This is how steps counted by an Apple Watch reach the app. The app writes nothing to Health. | To make each day's total match Health when the phone was not carried, and to credit steps to the right hour |
| Step records from Health Connect (Android) | Health Connect, read only, after you allow Steps: the counts and the times they were walked. The app writes nothing to Health Connect. | To credit steps walked while the app was closed on the right day and hour, and to match what your phone or watch recorded |
| Wheelchair pushes (optional) | Only if you turn on Count wheelchair pushes in Settings: pushes recorded in Apple Health (for example by an Apple Watch in wheelchair mode) or in Health Connect, read the same way as steps | To count pushes as steps, for players who use a wheelchair |
| Your step history | Made from the counts above: steps for each day, and steps for each hour of the last 90 days | Your history, records, streaks, quests and the goal suggestions |
| Game progress | Created by playing | Coins, pulls, your banana collection, streaks, quests, achievements, the Pass, mileage and records |
| Settings | Chosen by you | Daily goal, text size, sound, haptics, reminders and notifications |
The app does not read your location, contacts, photos, camera or microphone. From Apple Health and Health Connect it reads steps, and wheelchair pushes only if you switch them on; it reads no other health data and writes nothing. It asks for each permission with a short explanation, and you can say no: the app then counts what it can without it. The daily reminder and a leaderboard's five-minute warning are scheduled on the phone itself. Friend and leaderboard notifications (a request, an invite, a board starting, a pledge's result, a gift) are push notifications sent from Banana Walk's server; see below.
Health Connect (Android)
On Android, Banana Walk reads two data types from Health Connect: Steps, and Wheelchair pushes only if you turn on Count wheelchair pushes. It uses them only to count your steps in the app (coins, your daily goal and streak, quests, your step history, and your count on leaderboards you join). It keeps a per-day and per-hour history of them in your game save on the phone, and in your account's copy of the save if you sign in. It does not write to Health Connect, does not read any other health data, never uses health data for advertising, and never sells it or gives it to anyone except as described in this policy for leaderboards you join. You can withdraw access at any time in Settings, Health Connect, App permissions, Banana Walk.
Banana Walk's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.
If you sign in
You can sign in from the You tab: with Apple, Google, or an email and password on iPhone, and with Google or an email and password on Android. An email account is confirmed with a link sent to that address. Sign-in is handled by Firebase Authentication, a Google service. When you sign in, the app receives and stores:
- A user id created for you by Firebase.
- Your email address and, with Apple or Google, the name the provider shares. With Sign in with Apple you can hide your email, and the app works fine with the relay address Apple gives it. Your name and email are never shown to other players.
A copy of your game save is then stored in Cloud Firestore under your account: the progress and settings listed above and your step history (steps per day, and per hour for the last 90 days), together with your total step count. It is uploaded when it changes and when the app goes to the background. When you sign in on another phone, the app offers to restore that copy. Only your signed-in account can read it.
Reward records. While you are signed in, a record of each reward the app gives you and each coin spend is also kept with your account: what it was (such as a quest, a capsule, an achievement, a grant from us, a leaderboard payout, a pull, or an accessory, look or pedestal you unlocked), how many coins, your coin balance after it, the time and date on your phone, the app's version, and a random code for this phone's records (not the usage counts' code). They are kept with your account for support, to check a reward you say did not arrive, and for fairness, to spot a reward paid twice or coins that do not add up; only we read them, and no one can change them once written. They never include your steps, distance, Health data or location, and coins earned by walking are not recorded, but because your balance is, the rise between two records gives a rough idea of how many coins you walked for in between. Rewards earned while signed out are recorded on your phone and sent after you next sign in. They are deleted with your account.
Push token. If you allow notifications, a push token for your phone is stored with your account so the server can send you friend and leaderboard notifications through Firebase Cloud Messaging. It identifies the app on that phone only. It is removed when you sign out (with a connection) or delete your account, and when Firebase reports it no longer works. Settings, Notifications, Friends and leaderboards stops the server sending you these notifications.
Limits. To stop abuse, the server counts how many friend requests, reports, gifts, leaderboards and new push tokens each account makes in a day. The counts are deleted the next day.
Firebase Authentication, Cloud Firestore, Cloud Functions and Cloud Messaging are operated by Google LLC on Google Cloud servers, which may be outside your country. Their handling of that data is described in Google's Privacy and Security in Firebase. The app has Firebase Analytics and advertising features switched off.
Friends and leaderboards
These need an account and are entirely optional. When you use them, the following is stored in Cloud Firestore:
- Your username, which you choose, and the banana you have equipped. Anyone signed in to Banana Walk can send a friend request to an exact username; your username and banana are shown only to your friends, and to someone you ask to be friends (so they can see who asked). Asking someone does not show you theirs until they accept. Your name, email and step history are never shown this way.
- Your player card, if you set one up: the character, pose, color, pattern and background you picked and the badges you chose to show (achievements you earned). It is shown behind your name to your friends and to the other members of a private leaderboard you join, never to strangers on a public one. It holds nothing else about you.
- Your friends list: who you have asked, who asked you, and who accepted. Only the two people involved can see a friend request or friendship.
- Your steps on each leaderboard you join: the steps you walked while its timer ran, with your banana, your player card and your username (on a public leaderboard, a made-up name instead and no player card; see below). Only that leaderboard's members can see them. On a pledge leaderboard, or one ranked by % of normal, your normal day goes with them (the middle of your step counts on the last seven days you walked, fixed when you join), seen by the same members only. Leaving a leaderboard removes your steps from it.
- Leaderboard names you type for the leaderboards and team walks you make. Your invited friends see them, and they appear in the notifications sent to them. Names with offensive words are refused or replaced.
- Any coins you pledge on a leaderboard, the target you had to reach, and what each member got back. Coins are in-game only; they cannot be bought back as money or cashed out.
- Public leaderboards, if you make or join one: it has a name the app makes up, anyone signed in with a username can find it by that name and join it (up to 30 people), and its members see each other's steps and banana on it. Strangers on a public leaderboard see a made-up name for you (like "Brisk Otter 12"), not your username or your player card; only your friends see your username there. A public leaderboard holds no account id: you are on it under an id made for that leaderboard alone, from a secret key stored with your account that only you can read, so your made-up names on two leaderboards cannot be linked to each other or to your username. Which account is behind each of these ids is kept on our server, where no other user can read it, for limits, reports and deleting your account. Your profile keeps a list of the public leaderboards you are on, which only you and your friends can read. Search shows only a leaderboard's name, how many are on it and the time left. Public leaderboards are deleted three days after they end.
- Gifts: when you send a friend a spare banana, the banana's name and your username go to that friend, and the gift is deleted once they open it (or after 30 days unopened).
- Grants from us: if we make up for a problem on our side (coins, a banana, streak freezes, a streak put back, cosmetics), the grant is stored under your account id with what it holds and the reason shown to you, and it is marked received when you claim it. We keep our own log of each grant (what, when, who for, and our note of why) to check what was given. A grant for everyone holds no personal data at all.
- People you block, visible only to you, so they cannot send you requests and are hidden from the leaderboards you see (someone you block on a public leaderboard, under a made-up name, is hidden on that leaderboard).
- Reports: if you report a username or someone's steps, the report (your user id, theirs, the username, the reason and the leaderboard) is kept for the developer to review. On a public leaderboard the report names the id that person has there, and our server adds their account id for us. Reports cannot be read by other users.
Private leaderboards, and every member's steps on them, are deleted 30 days after they end (or 30 days after the hour to accept, if nobody joined). Friends and leaderboards have no public profiles, no global rankings and no messages. Usernames and leaderboard names are checked for offensive words; offensive usernames are removed, and accounts that post them or fake their steps can be banned.
Anonymous usage counts
To learn what people enjoy and whether they come back, the app sends one small message a day to Banana Walk's server (a Google Cloud Function): the week the app was installed, how many days ago that was, the date, the app version, iPhone or Android, and for each day since the last message: how many times you opened the app and for how many minutes, which of its screens you opened and how often (such as Pull, Collection, the quests or Settings), how many game coins you earned and spent and where (such as quests, pulls or a leaderboard pledge), how many pulls you made and how many of them brought nothing new, how many daily quests you finished, whether you reached your daily goal that day (yes or no, never the steps), and whether you were on a team walk. Once each, it also says how many days after installing you first did certain things in the app, such as your first pull, your first quest, dressing a banana, adding a friend, sending a gift or finishing the welcome walk. It carries a random code made on your phone, only so the same phone is not counted twice in a day; the code is not linked to your account, your name or any other identifier, and goes with the app when you delete it. It never includes your step counts, your location or anything about your account. The server adds the numbers to daily, monthly and install-week totals and keeps nothing per phone beyond that day's duplicate check, deleted after two days. To stop anyone flooding the totals it also counts how many messages arrive from each internet address in a day, under a scrambled code that cannot be turned back into the address, and deletes those counts the next day; your address itself is never stored. It works the same signed in or not. You can switch it off in the You tab, Settings, Data: Share anonymous usage counts; the app then sends nothing and drops what it had not sent.
Crash reports
If the app crashes, it sends a crash report to Firebase Crashlytics, a Google service, the next time it opens. A report holds what the app was doing when it stopped (the program's call stack and the last error lines the app printed, which are its own technical messages), your phone's model, its operating system version, free memory and storage, the app's version and build, the time, and a random identifier Crashlytics makes for this installation of the app. It never includes your steps, your account, your username, your email or your game save; it is not linked to your identity and is not used for tracking or advertising. Reports are used only to find and fix bugs, and Crashlytics keeps them for 90 days. Crash reports follow the same switch as the usage counts: with Share anonymous usage counts off, the app sends no crash reports and deletes any it had not sent yet. Google's handling of them is described in Privacy and Security in Firebase.
The widget and the Apple Watch app (iPhone)
The widget and the Watch app show your equipped banana, today's steps against your goal, the coins toward your next pull, your streak and today's quests. They read a small snapshot the app shares with them, on your phone and over Apple's connection to your paired Watch. Nothing about them goes to Banana Walk's server.
What the app never does
- Show ads or use advertising identifiers.
- Run third-party analytics or any tracking SDK. The only usage information it sends is the anonymous daily counts and the crash reports above, both behind one switch.
- Sell, rent or share your data with anyone other than the providers named above, and only as far as sign-in, cloud backup, notifications and the leaderboards you join need them.
- Collect data from children on purpose. Banana Walk is not directed at children under 13, and no account is needed to play.
Deleting your data
- On this phone: delete the app to remove its copy from the phone (a backup of your phone may still hold one until that backup is replaced). This does not delete your account: Sign Out or deleting the app keeps your account's copy so you can come back to it. To remove that too, delete your account (below).
- Your account: open the You tab, then Account, then Delete account. The app asks you to sign in again first. If something cannot be removed (no connection), nothing is deleted and the app asks you to try again. Deleting the account removes:
- your Firebase account (user id, email, name), the cloud copy of your save with your step history, your total step count and your push tokens;
- your username, profile and player card, your friendships, the people you blocked, and gifts you sent or were sent that are still unopened;
- your reward records, the grants made to you, and the server's own records about your account (weekly reward and bonus ledgers, the daily limit counts);
- your steps (and normal day) on every leaderboard, the leaderboards you made, and your place in their results; on public leaderboards, the record of which id there was yours, and your secret key for those ids.
- What is kept, and for how long:
- A leaderboard you made that others still need is not deleted at once: a pledge others paid into (until they have collected their coins), a team walk, or a public leaderboard. It stays without your steps and without your name as its maker, until it is deleted with everyone's steps: private leaderboards and team walks 30 days after they end, public ones three days after. Until then, your account id may remain on a pledge's list of who paid in.
- Reports you made, or that were made about you, are kept for one year after they were made, so we can act on them.
- Our log of grants keeps what was given and when, with your account id, username and our note removed.
- Anonymous usage totals and crash reports are not linked to your account, so they cannot be picked out; crash reports go after 90 days.
- Without the app: email the address below from the account's email and ask for the account to be deleted; it is done within 30 days.
- Motion access: can be withdrawn at any time in iOS Settings, Privacy & Security, Motion & Fitness, or on Android in Settings, Apps, Banana Walk, Permissions, Physical activity. The app then stops counting steps.
- Health access: can be withdrawn at any time in the Health app under Sharing, Apps (iPhone), or in Health Connect, App permissions (Android). The app then counts only what the phone's own sensor sees.
Changes
If the app starts handling data differently, this page will be updated and the date at the top will change. Changes that matter will also be mentioned in the app's release notes.
Contact
Questions about privacy in Banana Walk, and requests to see or delete your data, go to info@enmotionstudio.com.