Privacy Policy

1. Introduction

This Privacy Policy explains how Just Walk ("we", "us", "our") collects, uses, and protects your personal data when you use our mobile application and our website, justwalk.club.

Just Walk is operated by Bending Fork OÜ, Ehitajate tee 91/1-41, Mustamäe linnaosa, Tallinn, Harju maakond, Estonia, which is the controller of your personal data. We comply with the General Data Protection Regulation (GDPR).

2. Data We Collect

2.1 Personal Data

We may collect:

• Name or username
• Email address
• Account login details
• Full name and mobile number, only when you claim a partner benefit that needs them (see section 5)

2.2 Health & Activity Data

• Step count
• Activity levels (walking distance, movement)

This data may be accessed via:

• Device sensors
• Apple Health / Google Fit (if connected)

2.3 Location Data

• Approximate or precise location (only if enabled by you)

Used to:

• Validate activity
• Provide relevant local rewards

2.4 Device & Technical Data

• Device type and OS
• App usage data
• IP address

2.5 Website Visits

When you visit our website we may collect:

• IP address, browser and device type
• Pages viewed, the page that referred you, and campaign tags in the link you followed
• Cookie identifiers, only if you allow analytics or marketing cookies (see section 6)

3. How We Use Your Data

We use your data to:

• Track steps and calculate Points
• Provide rewards and offers
• Prevent fraud and abuse
• Improve app performance
• Comply with legal obligations

4. Legal Basis for Processing (GDPR)

We process your data based on:

• Consent (health & location data; analytics and marketing cookies on our website)
• Contract (providing app services)
• Legitimate interest (fraud prevention, app improvement, crediting referrals made through our links, website security)

5. Data Sharing

We may share data with service providers, including:

• Cloud hosting: Supabase (database) and Vercel (website hosting)
• Email delivery: Resend
• App usage analytics: PostHog (EU servers) — see 5.3
• Crash and error reporting: Sentry (no health data, no screen recordings)
• Analytics and advertising: Google (Google Analytics, Google Ads) and Meta (Meta Pixel), on our website only if you allow it
• Reward and retail partners

All partners are required to protect your data.

5.1 Partner benefit claims

Some rewards are applied by the partner inside their own loyalty app. When you claim one, and only after you tick the consent box on the claim form, we share the full name and mobile number you enter, whether you already use their app, and the step achievement you are claiming. Currently this applies to MyConvenience and MySupermarket (MyRewards benefits). The partner uses these details only to find your MyRewards account and credit the benefit, never for marketing.

5.2 International transfers

Some of these providers are based in, or process data in, the United States. When personal data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework for certified providers, or on the European Commission's Standard Contractual Clauses.

5.3 App analytics

The apps send PostHog a record of which screens and features are used (for example "opened Rewards" or "claimed a reward") so we can improve them. These events never include your steps or other health data, your name, email or location, and we do not record your screen.

By default this is anonymous: it is not linked to your account, and the random identifier it uses changes every time the app starts, so separate visits cannot be connected to each other or to you. Only if you turn on "Link analytics to my account" (offered when you finish sign-up, off unless you choose it) do we connect usage to your account ID, which lets us see how the app is used over time.

You can turn the account link off, or switch analytics off completely, at any time in Profile → Settings. PostHog is configured to discard IP addresses.

We do NOT sell your personal data.

6. Website, Cookies & Similar Technologies

Our website only sets the cookie that remembers your choice unless you allow more. Analytics and marketing cookies stay off until you accept them in the cookie banner.

If you decline, Google may still receive basic signals that a page was viewed, without any cookie or identifier being stored on your device.

6.1 Referral and QR links

When you open a Just Walk referral or QR link, we record a hashed version of your IP address and your browser's user-agent string, so that when you install the app we can credit the right referral. This uses no cookies and relies on our legitimate interest in running our referral programme. We keep this data for as long as it is needed to attribute referrals.

6.2 Changing your choice

You can change or withdraw your choice at any time through "Cookie settings" at the bottom of every page. You can also block or delete cookies in your browser settings.

7. Data Retention

We keep your data only as long as necessary:

• While your account is active
• As required by law
• Partner benefit claim details (name and mobile number): deleted 90 days after the claim is processed, or when you delete your account
• Pre-launch waitlist signups (email address and referral details): until you ask us to delete them, or until we delete the waitlist
• Event invitation and RSVP records: while we run events you are invited to; you can unsubscribe through the link in any invite
• Website cookies and referral link data: as described in section 6

You may request deletion at any time.

8. Your Rights (GDPR)

You have the right to:

• Access your data
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the data protection authority where you live

To exercise your rights, contact us at the email listed in Section 12.

9. Data Security

We use:

• Encryption
• Secure servers
• Trusted third-party providers

However, no system is 100% secure.

10. Children's Privacy

Just Walk is not intended for users under 16 (or local legal minimum age).

The apps ask for your year of birth at sign-up. We use it only to check that you are 16 or older — the year itself is never sent to us or stored; we record only that the check was passed. If someone enters an age under 16, the app stops on that device, sends no analytics, and offers to delete any account. We do not knowingly collect personal data from children under 16; if you believe we have, contact info@justwalk.club and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The date of the latest version is shown at the top of this page, and we will tell you in the app or by email before any significant change takes effect.

12. Contact

Company: Bending Fork OÜ (Just Walk)

Address: Ehitajate tee 91/1-41, Mustamäe linnaosa, Tallinn, Harju maakond, Estonia

Email: info@justwalk.club