1. Purposes and categories of processing
Walkmoa processes information necessary to identify members, record walking activity and rewards, prevent misuse and respond to customer inquiries.
| Category | Information processed | Purpose |
|---|---|---|
| Email accounts | Email address, one-way password hash, nickname and account identifier | Registration, authentication and account management |
| Social accounts | Selected provider, provider user identifier, email and nickname supplied within the scope of consent, and authentication information | Social sign-in, account identification and disconnection |
| Walking and rewards | Steps by date and time period, walking goal, activity identifiers, reward, adjustment and benefit records, and balance | Displaying and synchronizing records, detecting duplicates and crediting rewards |
| User consent | Self-confirmation of being at least 14, versions and timestamps of consent to the Terms and personal data processing | Managing eligibility and consent records |
| Device and security | App installation identifier, operating system and app information, sign-in sessions, connection, error and permission status, and abnormal usage records | Device connection, service protection and troubleshooting |
| Customer inquiries | Email address, inquiry content, materials submitted by the user and response records | Handling inquiries and requests to exercise rights |
| Referrals and weekly challenges | Invite codes, referral connections, participation, completion and reward records, one-way hashes of account and installation identifiers | Displaying progress, granting rewards and preventing self-referrals and repeated registration |
We do not collect GPS location, contacts or call content to record walking activity. Passwords are not stored in plain text. Please do not include unnecessary personal information in support requests.
2. Collection methods and storage on your device
We receive information through your direct input, your chosen social sign-in provider and device sensor permissions you have granted. Steps and records awaiting synchronization are first stored on your device, for example in SQLite, and synchronized with the server when an internet connection is available. Records that have not synchronized before you delete the app may not remain on the server.
We use web session cookies to keep you signed in and maintain security. You can delete or block cookies in your browser, but this may prevent your sign-in session from being maintained.
3. Retention and deletion
Account information, walking records and reward records are retained to provide account services and deleted when you delete your account. Electronic records are deleted from their respective stores, and account records on your device are also cleared during the app's account deletion process.
Customer inquiry records and security or dispute-related records are deleted when their purpose has been fulfilled. If the law requires separate retention, they are retained on the relevant legal basis and for the required period. When processing a deletion request, we explain the reason and scope of any separate retention. Reinstalling or deleting the app alone does not delete your server account.
If you delete your account after participating in referrals, account links are removed. One-way hashes of account and installation identifiers are retained for 90 days after deletion to prevent duplicate rewards, then deleted.
4. External services and SDKs
Depending on your chosen sign-in method, we exchange authentication information with Google, Apple, Kakao or NAVER. Please also review the relevant provider's terms and privacy policy.
The app includes the Firebase core SDK and Firebase Analytics (Google Analytics for Firebase), the Google AdMob advertising SDK and the AdStage attribution SDK. Enabled SDKs may process device and installation identifiers, app interactions and technical information. After you accept the terms, Firebase Analytics sends an app instance identifier, device and app version, the country estimated from your IP address, screen views and usage events to Google; the Android advertising ID is not collected (added October 21, 2026). AdStage measures installation attribution and events such as sign-in and registration; detailed step records and passwords are not sent as advertising events. Advertising rewards are provided when the feature is enabled and the necessary consent process has been completed.
You can change tracking permissions and advertising settings in your operating system settings. Use of advertising identifiers follows the applicable device permissions and consent status. See Google's Privacy Policy for information about Google's processing.
Opening an external link alone does not merge your Walkmoa account, steps or balance with another service account. If additional information needs to be shared to provide a partner product, we will separately explain the recipient, purpose and information involved.
5. Permission choices
Physical activity or Motion & Fitness permissions are used to measure steps, and notifications are used to show recording status. On Android, display-over-other-apps permission and exemption from battery restrictions support the lock screen and background recording features you choose. You can change these permissions in device settings at any time. Features associated with denied permissions may not work or may be limited.
6. Your rights and contact information
The service is currently intended for users aged 14 and over. If we discover that a child under 14 has registered, we restrict use and explain the process for deleting the personal information concerned. Services for children will be provided after a separate legal guardian consent process is established.
You may request access to, correction or deletion of your personal information, restriction of processing, or withdrawal of consent. Manage your account in app settings or see Account and data deletion. We process requests after verifying account ownership. Authorized representatives may also contact support.
You may ask us to recheck a reward validation or account restriction result you disagree with. Please use the contact below for privacy inquiries and requests to exercise your rights.
StageUp Co., Ltd.Room 902, Building A, 767 Sinsu-ro, Suji-gu, Yongin-si, Gyeonggi-do, Republic of Korea
cs@stageupcorp.com
7. Safeguards and changes
Production service connections use HTTPS, and passwords are stored as one-way hashes. Administrative features are restricted to authorized administrators, and changes to important settings and balances are recorded. If this Policy changes, including the information processed or the purposes of processing, we will announce the effective date and changes.
Operational analytics and visit sources (added October 19, 2026)
We use a short-lived visit identifier, app or website screens, language, app version, IP-derived country, referral host, campaign labels (UTM) and install attribution to understand service use and signup sources. We record event-banner views and clicks, ad loading and completion status, API response codes and response times. Raw IP addresses, full URLs and query strings, advertising click IDs, coupon codes, contact details and error message bodies are not stored in this analytics dataset. For security investigations, a one-way IP hash changes each day.
The website uses a first-party visit cookie and session storage with a 30-minute inactivity window. Detailed analytics events and visits are retained for 90 days; signup and last external-source summaries remain with the account until deletion. Account-linked analytics records are removed when the account is deleted. Push opens are recorded only when a notification is opened; returns within 24 hours are measured separately and are not treated as caused by the push.