Privacy Policy
Effective 2026-11-01 · LUNALINK
Gilu (the "App") rewards walking with points. This policy explains what the App and this website process and why.
1. What we process
| Data | Purpose | Retention |
|---|---|---|
| (Required) A random device ID issued by us, OS type, app language, country of connection (derived from the IP address; the IP itself is not stored), sign-up time | Account-less use, country-based daily limits, fraud prevention | Until you delete your account |
| (Required, separate consent) Health data: daily step count and flights climbed. The server stores only the points earned that day and the stairs bonus, not raw step counts; minute-level raw data never leaves your device. | Calculating points | Until account deletion |
| Point ledger (walking, ad bonus, visit check-in, coupon and gift-voucher exchanges) | Balance, expiry, dispute handling | Until account deletion (gift-voucher order records: 5 years under Korean e-commerce law) |
| Fraud signals (low motion score, failed device attestation: type and date) | Preventing fraudulent earning | Until account deletion |
| Rewarded-ad confirmation (ad unit, transaction ID) | Confirming bonus grants | Until account deletion |
| Support messages: optional email, subject, message, app version, language | Replying and support | 1 year after resolution |
| (Partner shops) email, shop name, campaign details | Partner login and campaigns | Until the relationship ends |
Even for gift-voucher exchanges (Korea only) we do not collect phone numbers; vouchers are delivered inside the App.
We do not collect location, contacts, photos or microphone data. Whether you allow notifications or ad tracking does not affect earning.
2. Separate consent for health data
Step and stairs data is treated as sensitive health data and we ask for your separate consent first. If you decline, you cannot earn points but can use the rest of the App. Step data is never given to advertisers or third parties and is never used for advertising. You can withdraw consent in Settings at any time.
3. Processors, sharing and international transfers
| Recipient | Role | Data | Where / when / how |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, data storage, email delivery | Data in section 1 | United States and other Cloudflare locations · continuously while you use the App · encrypted in transit |
| Google LLC (AdMob) | Rewarded ads | Advertising ID and device info if you allow it. Never health data | United States and others · when an ad is requested · encrypted in transit |
| Apple Inc. / Google LLC | Reading health data on your device, in-app purchases, device attestation | Processed on-device, or attestation tokens | United States and others |
We do not otherwise share personal data with third parties without your consent. If you object to international transfer, stop using the App and delete your account.
4. Deletion
Data is deleted when the retention period ends or the purpose is fulfilled. "Delete account" in the App immediately deletes your device ID, points ledger, coupons and fraud signals. Gift-voucher order records that we must keep by law are kept only for the legal period, detached from your device. This page is the account-deletion information URL. Uninstalling the App alone does not delete server data; delete your account in the App first, or contact us with your device ID.
5. Your rights
You may request access, correction, deletion, restriction, portability and withdrawal of consent through the App settings or support. EU/UK users: our legal bases are contract (the rewards service), explicit consent (health data) and legitimate interests (fraud prevention); you may complain to your supervisory authority. Until an EU representative or DPO is appointed, the support address is the contact point. Transfers rely on standard contractual clauses or equivalent safeguards.
6. California (CCPA/CPRA)
Categories collected: identifiers, internet activity, and health/fitness information, for the purposes above. We do not sell personal information and do not share step data for advertising.
7. Security, cookies, children
We use encryption in transit, least-privilege access and separated secrets. The App uses no cookies; the partner page uses one essential login cookie. The advertising ID is used by the ad SDK only for ads and only as you permit; you can turn off personalised ads. Users under 16 may not sign up and we do not knowingly collect their data.
8. Changes and contact
We announce changes 7 days in advance (30 days if unfavourable). Privacy officer: Park Yeonghwa · support@lunalink.co.kr · +82-70-5236-4556