Your walk,
your business.

The short version

Wolka reads your step count from the health data already on your phone, totals it for the day, and uploads the total. It does not read your contacts, your address book, or the individual movement samples behind the total. It has no advertising or cross-site tracking, and it never sells your information. Operational diagnostics and disclosed feature analytics are described below.

If you choose to record a walk, Wolka also reads your precise position from your phone while that walk is recording, so it can draw the route you walked. Recording is opt-in, begins only when you start a walk, and the route stays on your phone. Wolka does not upload recorded routes to its servers, and no route is shown to another person, to your crew, or on any public page. Drawing the map is done by Mapbox, which necessarily receives the map area you are viewing. That is explained in Recorded walks and maps.

No email address, phone number or password is required. Wolka identifies you by a display name and a random token stored on your own device. You can optionally enable account emails using the verified address supplied by your Google or Apple sign-in.

What is collected

Everything Wolka holds about you falls into these groups.

Your account

• Display name. Between 1 and 30 characters. Stored lowercase. Must be unique across Wolka, so it is checked against the names already in use when you save it, and again when you pick one.
• Avatar. A number from 0 to 23, selecting one of 24 illustrations. The number is stored; the illustration is not personal information about you.
• Credential. A random 256-bit token, generated on your device. Only its SHA-256 hash is stored on the server. Losing the token means losing access to the account, unless you have linked a recovery sign-in, which is why Wolka warns you to keep the app installed.
• Recovery sign-in (optional). If you choose to link a Google or Apple account, Wolka stores the provider's opaque account identifier — a number the provider gives each app to name one person, so you can prove it is you after losing a phone. Provider names and photos are not stored. A verified email claim may be supplied by the provider; Wolka keeps it privately as identity proof for events, rewards, organizer tools and images. This does not enable account emails or marketing.
• Account email (optional). From You → Email updates, you can choose to store the verified email from your Google or Apple sign-in, including an Apple private relay address. Wolka stores the address, provider, verification time and consent time privately. It sends a welcome guide and important account-change alerts through Resend. The address is not public, is not sent to analytics, and is not a sign-in credential. Remove the delivery contact in the same screen to stop account emails and delete queued messages. Your separate sign-in identity proof remains until you remove shared verification or unlink your sign-in.
• Join date. The day you created the account, so Wolka can tell which days of walking belong to you.
• Phone platform. Updated mobile builds report Android or iOS during account creation, restoration or recovery. Wolka keeps the last reported platform privately so the operator can identify the phone platform when helping with an account. It is not shown on public player profiles and contains no device serial number or advertising ID.

Your crews

• Crew name, between 4 and 15 characters, stored lowercase, unique across Wolka.
• Crew avatar, a number from 0 to 7, selecting one of 8 crew badges.
• A six-character invite code, generated by Wolka. Anyone with this code can request to join.
• Whether the crew is private (invite code only) or public (listed for anyone to find and join).
• Membership and join dates, plus which member owns the crew. Only the leader can send and accept challenges, change privacy, or remove a member.

Your walking

• Daily step totals, per calendar day in Africa/Lagos (UTC+1). Wolka also uploads summed challenge-interval observations, provider source, query coverage, observation time and sync time; these are not individual step timestamps.
• Weekly step totals, Monday through today. Computed from the daily totals.
• Derived state that Wolka shows you back: rank points (RP), rank tier and level, the achievement badges you have earned and when, any achievement RP still waiting to be claimed or already claimed, match results, and crew scores.
• Historical daily totals you choose to upload for past days, so your history survives a phone that has already discarded it.
• When you record a walk, summed step counts for the intervals that walk covered, offered to the same daily and weekly totals as above. These are interval summaries attached to a day. They are not individual step timestamps, and they contain no coordinates.

Your recorded walks

• The route. A sequence of precise GPS points, with timestamps, distance and active duration, that exists only on the phone that recorded it. This is the one part of Wolka's data that can describe where you have been, which is why it is never uploaded.
• When and where. The walk's start time, finish time, captured time zone and recorded starting point, stored on the phone with the route.
• Map tiles. Map images for the area you are viewing are downloaded from Mapbox while the map is open. See Recorded walks and maps.
• Walks are private by default and have no sharing control. There is no feature that publishes a route, and no endpoint that serves one.

Not collected, ever

• Contacts or the address book.
• Raw motion samples, accelerometer or pedometer data, heart rate or calories. Wolka only ever receives a summed step count from the health store on your phone.
• Your recorded routes, your recorded starting point, or any coordinate derived from them. They are not uploaded, so no server, and no third party including Mapbox, ever receives your route as Wolka recorded it.
• Any background or automatic monitoring of where you go. Wolka does not watch your location while the app is closed, does not detect walks on its own, and does not start recording without you asking for it.
• A home address, a workplace, a home zone, or any inference drawn from a route.
• Email address, phone number, password, legal name, or payment details.
• Advertising identifiers, and no cross-app or cross-site tracking.
• Your photo library, camera, microphone, clipboard or files.

Permissions, and why each one is asked for

Wolka asks for step access when you choose to connect your steps. OS notification permission is a separate choice offered in context, not required for your saved history or inbox.

• iPhone. Motion & Fitness, so iOS can report your step count to Wolka.
• Optional iPhone background sync. Health Steps read access, requested only when you enable background step sync in You. HealthKit supplies update notifications that let iOS wake Wolka. Synced totals still come from your iPhone through Motion & Fitness; Wolka does not read Apple Watch totals or write health data.
• Android. Health Connect, specifically the steps record.

If you decline, or later revoke the permission in system settings, Wolka keeps working. Your name and your crew stay exactly as they are. The app simply shows “Steps not connected” where your totals would be, and you stop appearing in daily standings and stop earning step-based progress.

Steps sync while Wolka is open. With optional iPhone background step sync enabled, Wolka also tries to upload today's phone total when iOS wakes it. Background updates may be delayed and are not guaranteed. Turning this off, or declining Health Steps access, leaves the usual in-app refresh available. Your phone records steps independently of Wolka.

Location permission is separate again, and is asked for only if you start recording a walk. Wolka explains why it needs location at that moment, before the system prompt appears.

• iPhone and Android location. Precise location, so the route you actually walked can be drawn rather than a straight line between two distant points. Used only while a walk is recording.
• Background location, while a walk records. On iPhone, a recording walk continues with the screen locked until you pause or finish it, so a phone in your pocket does not drop the middle of your walk. On Android this runs as a foreground service with a visible notification. It is active only for the duration of a walk you started.

Declining location does not affect anything else. Your step totals, Ranked standings, crews and badges all work exactly as before; only recorded routes are unavailable.

Recorded walks and maps

Maps and route recording are optional. Viewing an event or crew map does not request your GPS location. A walk you start records on your phone and continues while the screen is locked until you pause or finish.

Your private route

Routes, timestamps, distance and duration are stored in your account's private app folder. On iPhone this folder is excluded from device backup; Android app backup is disabled. If private walk backup is available and you explicitly enable it, Wolka uploads your route to authenticated account storage so you can restore it. Private backup does not publish your route to other walkers. You can delete backed-up walks or your account.

Temporary event and crew sharing

To share, choose a specific event or crew, choose approximate or precise position, and confirm. Approximate positions are rounded on your phone before transmission and again on the server. Sharing lasts at most two hours, ends with an event, and stops publishing when you pause or finish your walk. Viewing is restricted to verified, eligible event participants or current verified crew members; people you block are excluded in both directions. Your name and avatar accompany the shared position. Your route history is never included in live presence.

Wolka keeps only the latest shared fix, valid for at most one minute. Stopping sharing removes the grant and latest fix when the server is reachable; offline publishing stops on the phone immediately and the previous fix expires. Position data is excluded from durable database backups. People who can view a position may still remember it or take a screenshot.

Wolka Events identity and rewards

Joining, contributing to a crew event, hosting, claiming rewards and accessing shared maps requires a linked Google or Apple sign-in with a provider-verified email. Wolka reuses the verified email and provider identity from your account sign-in for events, rewards, organizer access and image uploads. Older accounts without a verified email may need a one-time confirmation. This private proof stays tied to the current linked sign-in. Participants see your Wolka name, avatar and event score, never your email. Each crew member accepts event rules individually. Event verification does not subscribe you to News and updates or enable location sharing.

Hosts and partnership inquiries are reviewed by authorized operators. Reward claims may include private delivery details you choose to provide; operator access is audited. Claim details are deleted when fulfillment is recorded or after 30 days. Event entries, consent, results and reward status are kept with your account. Deleting your account removes its identity, sharing, inquiries and reward records; frozen event results may retain an anonymous entry and score.

Mapbox, the map provider

The map is drawn by Mapbox, a third party with its own privacy policy. Using it means Mapbox is separate from Wolka and receives its own data directly from your phone:

• Map requests. To draw a map, your phone asks Mapbox for the map tiles and style covering the area on screen. Mapbox therefore learns which part of the map you are looking at, and can infer approximately where you are while you are recording. This cannot be avoided for any online map. Wolka does not send your route, your recorded points, your Wolka account, your display name, your avatar, your crews or your step totals to Mapbox.
• Mapbox's own SDK data. Mapbox's SDK collects its own usage data, including information about the map area in use, which it handles as its own independent data controller under its own policy rather than on Wolka's instructions. Mapbox states it does not collect advertising identifiers such as IDFA or AAID. Read Mapbox's privacy policy and its telemetry page for the detail, including retention. Mapbox's stated retention for network addresses is 30 days.

Wolka draws your route on top of the map locally. The route geometry is rendered on your phone from your own recorded points; it is not sent to Mapbox to be drawn.

If the map cannot load, recording still works. A map outage cannot lose or truncate a walk.

What becomes public

Wolka starts private. Nothing about you is visible to another person on Wolka until you unlock the public leaderboard.

• The unlock. One day of 1,000 steps opens personal Ranked. Once that day is recorded, your name, avatar, and your daily and weekly totals appear on the public leaderboard automatically. Before that day, you are not listed.
• Stays earned. Once unlocked, the unlock does not expire if you go a quieter week. One day is enough.
• Crews. A crew you create is private unless you, as its leader, choose public. A private crew is reachable only by its invite code.
• Teammates. Crewmates see your name, avatar and synced steps inside that crew. That is the point of the crew.
• Rank history. The step-by-step history of how your rank and RP changed is visible only to you and to the crews you currently belong to.
• Profiles. An open profile shows your name, avatar, totals, best day, earned badges, settled match results and the crews you walk with. It shows your recorded step totals, never a route, a starting point or a map. Recorded walks are private and are not part of any profile.
• The website's live total. The website shows one running sum of the steps recorded by every account, for today and for the week so far. It is a total only. No account, name, avatar, crew or individual contribution appears in it, and it cannot be traced back to anyone. It is measured in Africa/Lagos, so it rolls over at the same moment the app's does.

Notifications

Optional account emails are delivered by Resend, which receives the recipient address and email content to deliver them. Automatic account emails contain account guidance and security changes, not step counts or crew invite codes. Wolka removes addresses and message content from queue records once Resend accepts a message or delivery permanently fails; minimal delivery records expire after 30 days. Removing your email or deleting your account removes the contact and queue. Messages already handed to Resend may still arrive; removing them from Wolka cannot retract them from a mailbox or erase Resend's delivery records.

News and updates is a separate optional subscription in You → Email updates. It permits Wolka announcements, guides, invitations and operator-authored updates. We store your explicit subscription time and unsubscribe preference. Every campaign includes an unsubscribe link; unsubscribing does not disable account emails. Bounced or complained addresses are suppressed to prevent further sends. Admin campaign drafts and saved templates persist until removed; completed campaign content and per-account recipient results expire after 90 days from campaign creation. Minimal delivery receipts expire after 30 days. Account deletion also removes your recipient records.

Wolka authors a durable server inbox and uses Firebase Cloud Messaging and Apple/Android delivery services for optional OS banners. Account-scoped topics route messages; the app fetches private content through authenticated endpoints. Push acceptance is not proof that a person received or read a message. The inbox works without OS permission. Android's ordinary daily reminder is a local alarm.

Weekly Rhythm alerts are a separate opt-in, unavailable until this release is enabled. They contain no step figures or inferred routine. They target Monday after 10:00 in your stored timezone (UTC fallback), respect quiet hours from 22:00 to 08:00, and share a server budget with other proactive nudges. Enabling weekly alerts replaces the ordinary daily reminder on an updated device. Old clients and disconnected devices may still run legacy alarms. Already-delivered banners cannot always be withdrawn remotely.

Private Rhythm and optional explanations

In local development; not yet released. Daily Rhythm uses saved daily totals to calculate supported weekly patterns, comparable-day change, coverage and spread. Missing is unknown, not zero. A complete record means a provider query covered the day; it does not prove the phone measured all walking. Joining-day, partial and simulator records cannot support inactivity comparisons. Rhythm is private and is not shown on public profiles.

Facts, external explanations and weekly alerts are independent choices. External explanations default off. If enabled after reviewing the current provider disclosure, selected derived walking facts and submitted questions are sent to the named backend provider. DeepSeek is the initial candidate. Other OpenAI-compatible providers require a matching disclosure before use. TypeSafe Jev is an evaluation candidate and remains off pending measured promotion. Provider services may process information abroad under their applicable API terms; Wolka does not promise zero provider retention or training exclusions that have not been agreed.

No names, bearer tokens, invite codes or another walker's private history belong in model requests. Do not include sensitive personal details in questions. Chat remains session-local; no transcript is saved by default. Hosted explanations cannot change competition results, send messages, or infer sleep, work, home, location or health.

Rhythm retains at most eight completed weekly anchors. Terminal AI jobs expire after seven days; feedback and prospective opted-in participation events after 90 days. Per-account rate/attempt records expire after two days. Delivery and proactive decision records expire after 30 days. Hashed network-address rate/spend counters and aggregate operational usage expire after 30 days. These minimal ledgers support spending and spam limits, with owner linkage removed on deletion. Turning facts off removes derived private reports, context and feedback while keeping Wolks. Turning AI off cancels jobs and removes generated prose. Account deletion removes all derived owner-linked records.

Operator Insights describes the enabled real-source cohort and its denominators. Behavioral cells below ten eligible accounts and complementary values are suppressed. Participation comparisons use prospective consented events, never reconstructed membership, and do not establish cause. No private report or chat browser is added to admin.

Security

Access tokens are random 256-bit values. The server stores only their SHA-256 hashes, so a copy of the database does not reveal a usable token. All traffic is over HTTPS. Crew invite codes are six characters and are the weakest link in the design: treat sharing one as sharing access, which is exactly what it is.

When you link or recover with a Google or Apple sign-in, the provider signs a short-lived statement that it is you, and Wolka verifies that signature before acting on it. The statement is checked and discarded. Wolka keeps the provider’s opaque identifier and, when verified by the provider, your private email as account identity proof for events, rewards, organizer tools and images. This does not enable account emails, marketing messages or location sharing. Wolka never stores your Apple or Google password or a reusable provider access token.

Wolka receives phone-reported step totals and checks their source, coverage and event window. These checks do not independently prove that a person walked. Event results allow late syncing and operator review of incomplete coverage. Rewards follow the published event rules; Wolka Events does not offer cash staking or paid entry.

Where your data lives

Wolka's data is stored on a PostgreSQL database operated by the individual behind kiishi.space, the same person who made the app. There is no advertising network or data broker. Builds configured for diagnostics use Telling for screen, error and progression events, with account/display identifiers; this is separate from private Rhythm report and question content. Notification delivery, optional recovery and opt-in explanation providers process the minimum required information for their disclosed functions.

Routes stay on your phone unless you enable available private backup. Temporary shared positions are separate from route history, as described in Recorded walks and maps. The map provider, Mapbox, is contacted directly by the app and keeps its own records under its own policy; Wolka has no copy of them.

If that operator is ever unable to run the service, the database is deleted rather than sold or transferred.

How long it is kept

Your account and its data are kept until you delete them, or until the service is discontinued. Daily step totals are retained so that your wolks, badges and rank history remain intact. Crew contributions already counted toward a crew's total are retained after you leave, because crew scores are averages across a locked roster and removing one member would silently rewrite every past result.

Recorded walks stay on your phone until deleted. Available private backups stay in authenticated account storage until you delete the backup or account. Temporary live positions expire within one minute and sharing grants within two hours.

Deleting your account

You can delete your account from inside the app: open You, scroll to the bottom, and use Delete account. You will be asked to confirm. Deletion is immediate and cannot be undone. It removes:

• your account, display name and avatar,
• every crew membership, and leadership of any crew you led,
• your daily and weekly step totals and your history,
• your rank, RP and rank history, and
• your linked recovery sign-in, if you added one, and
• your earned achievement badges.

Deleting your account also deletes the recorded walks stored on this phone: recording stops and that account's walk folder is removed. Any private route backups, active sharing sessions and latest shared positions are also removed from Wolka’s server.

One deliberate exception: in matches you have already completed, your entry is replaced with an anonymised record so that past results stay readable to the people you raced against. That record has no name, no avatar and no step totals attached to you. It is not linked back to you.

If you cannot reach the app, email kiishidart@gmail.com from the address you would like removed. See Support for the full walkthrough.

Children

Wolka is not directed at children under 13, and Wolka does not knowingly collect information from them. Because accounts require no email address and no verification, Wolka cannot ask a child's age; if you believe a child has created an account, delete it as described above and tell us, so we can remove it.

Recorded routes can reveal where a person lives, works or spends time, so they warrant more care than a step total. Wolka keeps them out of the cloud for that reason. On a shared or supervised device, deleting a walk or deleting the app removes it, and the folder is excluded from device backup on iPhone.

Changes to this policy

This policy was first published on 6 October 2026, and last updated on 14 October 2026 to describe the optional walk-recording and map feature and its use of Mapbox, and to describe optional provider-verified account emails, the News and updates subscription and Resend delivery, alongside recovery, notifications, diagnostics and the unreleased optional Rhythm feature. This update corrects the earlier statement that Wolka never collects GPS or location: Wolka does read precise location while you record a walk. Routes stay private; available private backup and temporary location sharing require separate choices. If it changes, the date at the top of this page changes with it. Material changes will be announced inside the app.

Wolka is operated by the individual behind kiishi.space. Questions, corrections and deletion requests all go to kiishidart@gmail.com.