Privacy Policy

This Privacy Notice explains how Nikolai Iakubovskii ("we", "us") collects, uses, and shares your personal information when you use the MistyWay app or visit mistyway.app. Questions go to support@mistyway.app.

1. What Information Do We Collect?

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Account Information. Email address, username, display name, and character selection (avatar choice).

Guest Accounts. You may use the Service without registering. In this case, we generate an anonymous identifier linked to your device. You can upgrade to a full account at any time.

Sensitive information (health data)

With your explicit consent, we process the following health-related data:

• Step count — your daily steps, sourced from Apple HealthKit (iOS), Health Connect, Google Fit, or the device's native step counter (Android)
• Calculated metrics — we derive distance, estimated calories burned, and active time from your step count on our servers. These are never read from your device's health store.

We do not access heart rate, sleep, weight, or any other health categories. Health data is stored on our servers and is not sent to Adapty, Meta, or other advertising providers. Infrastructure providers may process encrypted health data only as needed to host and secure the Service.

Payment data

We do not directly collect or store payment card details. All purchases are processed by the Apple App Store or Google Play Store. We receive only transaction identifiers, product IDs, and subscription status from these platforms.

Information automatically collected

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include:

• Device data — device model, operating system, language, app version
• Device identifier — a unique device ID used for guest account recovery and push notification delivery
• Advertising and attribution data — advertising identifier (IDFA) only when you authorize tracking through Apple's App Tracking Transparency prompt; other device or app identifiers, IP address, operating system details, ad click and campaign metadata, install data, and subscription or purchase events may be used for attribution
• Usage data — feature interactions, in-app events, and which screens you open. These are recorded both by PostHog and by our own analytics on our EU servers (see “First-party analytics” below)
• Log data — IP address, request timestamps, and error logs used for security, diagnostics, and attribution
• Invite link opens — when you open a friend's invite link on an iPhone or Android phone, we record the invite code, whether the phone is an iPhone or Android, the time of the open, and a keyed one-way hash of your network (your IPv4 address, or the network half of your IPv6 address). We never store the address itself or your browser details. If the MistyWay app is first opened on the same network and type of phone within 2 hours, we link the open to that new app account and the app asks whether you want to connect with the friend
• Location — timezone (for notification scheduling); we do not track GPS location

User-generated content

If you use social features, we may process:

• Parallax notes — short messages (up to 70 characters) you leave on the in-game map, visible to your friends
• Friend connections — your friend list and friend requests
• Referral codes — codes you generate to invite other users

2. How Do We Process Your Information?

We process your personal information for the following purposes:

• To create, authenticate, and manage your user account
• To deliver core gameplay — converting your real-world steps into in-game progress
• To manage subscriptions and in-app purchases
• To send push notifications (gameplay events, friend activity, subscription status) — you can disable these in the app settings
• To send you tips, reminders, and news about MistyWay by email — you can unsubscribe at any time
• To respond to support requests
• To monitor and fix technical issues (error tracking)
• To improve the Service through aggregated and pseudonymous usage analytics
• To attribute installs and purchases to advertising campaigns, calculate campaign performance and return on ad spend (ROAS), prevent attribution fraud, and improve our marketing
• To connect a new install with the friend's invite link opened on the same network shortly before
• To prevent fraud, abuse, and enforce our Terms

3. What Legal Bases Do We Rely On?

If you are located in the EU or UK, we rely on the following legal bases under the GDPR:

• Consent (Art. 6(1)(a)) — for processing health data (step counts), sending push notifications, sending marketing emails where you turned them on in the app, and accessing the iOS advertising identifier where required
• Performance of a Contract (Art. 6(1)(b)) — to provide the Service, manage your account, and process purchases
• Legitimate Interests (Art. 6(1)(f)) — for analytics, non-IDFA campaign measurement, matching an invite link to a new install, error tracking, fraud prevention, and emailing existing users about MistyWay itself, where these interests are not overridden by your rights
• Legal Obligations (Art. 6(1)(c)) — to comply with applicable laws

4. When and With Whom Do We Share Your Personal Information?

We share data with the following third-party service providers who process data on our behalf:

Provider	Purpose	Data Region
Amazon Web Services (AWS)	Infrastructure hosting, database	EU (Frankfurt)
Google Firebase	Authentication, push notifications (FCM)	US
Sentry	Error monitoring	EU (Germany)
PostHog	Product analytics	US
Google Analytics	Website visit measurement	US
Resend, Inc.	Product and marketing email delivery	EU (Ireland) sending region; US company
Adapty	Subscription management, revenue analytics, and advertising attribution	May process internationally
Meta Platforms	Campaign measurement and advertising optimization	May process internationally
Apple App Store	iOS payment processing	US
Google Play Store	Android payment processing	US

We do not sell your personal data. We do not send health data (step counts, distance, calories) to Adapty, Meta, or any other advertising or analytics provider.

5. International Data Transfers

Our primary application servers are located in the EU (AWS Frankfurt, Germany). Some service providers, including Firebase, PostHog, Adapty, Meta, Apple, Google, and Resend, may process data in the United States or other countries where they operate.

For transfers outside the EEA, we rely on:

• The European Commission's adequacy decisions, where available
• Standard Contractual Clauses (SCCs) approved by the European Commission
• The service provider's participation in recognized data protection frameworks

6. Cookies and Tracking Technologies

Our website (mistyway.app) uses Google Analytics to count visits. For visitors in the EU, UK, and Switzerland it runs without cookies; elsewhere it sets Google’s analytics cookies, which you can block in your browser or with Google’s opt-out add-on.

Our mobile app uses the following tracking technologies:

• First-party analytics — the app records product events, including which screens you open, directly to our own servers in the EU (AWS Frankfurt). These events are linked to your account or device identifier so we can understand how the app is used and improve it. They do not use the advertising identifier (IDFA), are not shared with advertising networks, and are never used to track you across other companies’ apps or websites. You can opt out by contacting us.
• PostHog — product analytics to understand feature usage. You can opt out by contacting us.
• Sentry — crash and error reporting for app stability.
• Device identifiers — for account recovery and push notification delivery.
• Adapty Attribution and Meta — campaign click, install, and paid subscription measurement. We use these signals to calculate campaign performance and ROAS and to improve our marketing.

On iOS, access to IDFA is controlled by Apple's App Tracking Transparency (ATT) prompt. If you deny permission, IDFA is unavailable and the core app remains usable. Where permitted by law, Adapty may still use limited device, IP, timing, and campaign signals for probabilistic attribution without IDFA. You can change tracking permission later in iOS Settings.

7. Push Notifications

We use Firebase Cloud Messaging (FCM) to send push notifications. Types of notifications include:

• Daily goal achievements and game progress
• Friend activity (friend requests, reactions)
• Subscription status updates (trial expiry, renewal)
• Weekly quest reminders

You can manage notification preferences in the app settings, including per-type controls and quiet hours. You can also disable notifications entirely through your device's system settings.

8. Product and Marketing Emails

We may use the verified email address you sign in with to send you tips for getting started, reminders about your walk, and news about MistyWay features and offers. These emails come from hello@mistyway.app.

You can stop them at any time with the unsubscribe link in every email or by switching off Email reminders in the app’s Settings. Essential emails about your account — sign-in and security messages, purchase and subscription notices, and replies to your support requests — are not affected.

9. How Do You Sign In?

You can sign in with Google, with Apple (both through Firebase Authentication), or with an email address and password. From Google or Apple we receive your name and email address; we never see your Google or Apple password.

10. How Long Do We Keep Your Information?

We keep your personal information for as long as your account is active. Specific retention periods:

• Account data — until you delete your account
• Health data — until you delete your account
• First-party analytics events — 365 days, or until you delete your account, whichever comes first
• Error logs — 90 days
• Push notification logs — 30 days
• Invite link opens — 7 days
• Email preferences — until you delete your account; a one-way hash of an unsubscribed address is kept so that we never email it again
• After account deletion — all personal data is permanently erased within 30 days (the hashed unsubscribe entry above is kept)

11. How Do We Keep Your Information Safe?

We have implemented appropriate technical and organizational measures, including:

• Encrypted database connections (TLS/SSL)
• HTTPS for all API communication
• JWT-based authentication with token signing
• Rate limiting and bot protection
• Input validation on all API endpoints

However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure.

12. Do We Collect Information from Minors?

The Service is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13. If you are between 13 and 16 years old and located in the EU, you must have your parent or guardian's consent to use the Service.

If we become aware that we have collected data from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us at support@mistyway.app.

13. What Are Your Privacy Rights?

Depending on your location, you may have the following rights under applicable law (including the GDPR and US state privacy laws):

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your personal data
• Restriction — request that we limit processing of your data
• Data portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests, including direct marketing
• Withdraw consent — withdraw your consent at any time (e.g., for health data processing or marketing emails) without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, contact us at support@mistyway.app. We will respond within 30 days.

You can review and update your information in the app settings. Account deletion: You can delete your account directly from the app settings or via mistyway.app/delete-account. Deletion removes all your data, including health records, friend connections, achievements, and subscription history.

14. Right to Lodge a Complaint

If you are located in the EU/EEA and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD):

www.aepd.es
C/ Jorge Juan, 6, 28001 Madrid, Spain

15. Controls for Do-Not-Track Features

Our website does not respond to browser “Do Not Track” signals.

16. US Residents' Specific Rights

If you are a resident of California or another US state with applicable privacy legislation, you may have additional rights, including the right to know what personal information we collect, the right to delete it, and the right to opt out of "sales" of personal information. We do not sell personal information. To exercise your rights, contact us at support@mistyway.app.

17. Do We Make Updates to This Notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date.

18. How Can You Contact Us?

If you have questions or comments about this notice, you may email us at support@mistyway.app or contact us by post at:

Nikolai Iakubovskii
Calle Emilio Tuya, 37
Gijon, Asturias 33202
Spain