Privacy Policy

1. Purpose

This Policy describes the basic principles governing the information we collect in the Service, the purposes of use, third-party sharing, retention periods, security measures, and users' rights.

If the Terms of Use, individual consent screens, app store descriptions, help pages, campaign conditions, or other notices specify additional rules, they supplement this Policy.

2. Information We Collect

For the purpose of providing, operating, improving, and securing the Service, preventing abuse, and complying with laws, we may collect the following categories of information.

2.1 Information users enter or register

• Information required for account registration, authentication, or login
• Information required for point redemption requests, benefit delivery, or inquiries
• Inquiry text and any other information that users voluntarily submit
• Notification settings, consent status, and other settings selected by users

2.2 Device and application information

• Device identification-related information
• OS, model name, device model, app version, build number, language, locale, and time zone
• Crash information, error logs, and performance data (crash information is sent only with the user's consent; see Section 5, item 4)
• Push notification tokens, notification settings, and delivery results
• Advertising identifiers and other information related to ad delivery and measurement

2.3 Activity and usage information

• Step counts, distance traveled, daily activity logs, continuity of use, rankings, streak progress, and similar information
• Advertisement view history, reward-related logs, and campaign participation information
• Operation history, screen transitions, and feature usage history within the Service

2.4 Location information

• We do not collect location information (the device's position via GPS or similar). Walking distance is calculated from the step count obtained from the device's motion sensors.
• Acquisition of the step count depends on the permission granted in the device or OS settings (Motion & Fitness / Physical activity), which users may grant, deny, or change.

2.5 Diagnostic information for inquiries

When users use the inquiry function, we may collect diagnostic information such as the following:

• App version and build number
• Device information
• Masked user identifiers
• Recent logs

We will strive to mask email addresses and other highly identifying information within a reasonable scope.

3. Methods of Collection

• Direct input, submission, registration, or setting changes by users
• Automatic collection through device sensors, OS permissions, in-app SDKs, APIs, cloud services, logging functions, and other technical means
• Collection from advertisers, analytics providers, cloud providers, authentication infrastructure, notification infrastructure, and other partners or vendors

4. Purposes of Use

1. To provide the Service and manage identity verification, authentication, and accounts
2. To provide step counts, distance, points, rankings, streaks, campaigns, redemption applications, and other functions of the Service
3. To execute, record, and verify rewards, redemptions, benefit delivery, and related processing
4. To respond to inquiries, improve support quality, investigate issues, and reproduce failures
5. To detect, prevent, investigate, and respond to abuse, multiple-account use, anomalous movement records, system tampering, and similar conduct
6. To deliver advertisements, measure advertisement effectiveness, determine ad rewards, and run campaigns
7. To conduct analytics, statistics, A/B testing, user experience improvement, and new feature development
8. To send notifications, important notices, update announcements, and support communications
9. To comply with laws, audits, tax and accounting requirements, dispute handling, and protection of rights
10. For purposes incidental to the foregoing

5. Consent, Settings, and User Control

1. The Service may provide settings or consent management functions for advertising-related settings, analytics sharing, tracking permissions, and certain other data uses.
2. Users may change consent states and permission settings through in-app settings or device settings.
3. If permissions or consent are denied or withdrawn, some functions of the Service may become unavailable or may not operate correctly.
4. Sending of crash information (diagnostic data generated when the app terminates unexpectedly) is disabled by default and is enabled only when the user explicitly consents on the confirmation screen shown at first launch or in the in-app settings. The data sent consists of the device model, OS version, app version, error type, and stack trace; no account identifier is attached, and e-mail addresses, phone numbers, location coordinates, and similar data appearing in error messages are masked before sending. Consent can be withdrawn at any time in the in-app settings, and any diagnostic data not yet sent at the time of withdrawal is discarded.

6. Third-Party Sharing

6.1 Cases where we may share information

Except where permitted by law or other legitimate reasons, we do not provide personal information to third parties unless one of the following applies:

• With the user's consent
• As required by law
• When necessary to protect life, body, or property
• When especially necessary for improving public health or promoting sound development of children
• When cooperation with national or local government bodies is required
• In connection with business succession, merger, company split, business transfer, or other organizational restructuring

6.2 Use of external providers

In providing the Service, we may use external providers or their services such as the following:

• Cloud, authentication, and databases: Firebase-related services provided by Google LLC
• Ad delivery and measurement: ad networks, ad measurement providers, or offerwall providers used by us
• Step count features: motion sensors and other OS or device capabilities provided by iOS or Android
• App stores and distribution infrastructure: Apple App Store and Google Play
• Other services necessary for notifications, analytics, support, external link launching, and operations

The handling of information by such providers may be subject to their own privacy policies or contractual terms.

7. External Transmission, SDKs, and Analytics Tools

The Service may use SDKs, APIs, tags, log collection tools, and other external transmission technologies for feature provision, stable operation, ad delivery, analytics, fraud prevention, and crash analysis.

We may disclose additional details regarding external transmission technologies in this Policy or on our website when necessary.

8. Retention Periods

We retain collected information for the period necessary to achieve the purposes of use or as required by law. Typical retention periods are as follows.

The above periods are guidelines and may vary due to legal retention obligations, audits, fraud investigations, disputes, security responses, or other reasonable grounds.

9. Account and Data Deletion

1. Users may request account deletion or data deletion by the methods described on our account deletion page (deletion from the Settings screen in the app, or email to info@calshe.net).
2. Once account deletion is completed, all or part of the account, step and distance data, point display information, redemption history, advertisement-related information, setting information, and other data in the Service may be deleted and may not be recoverable.
3. The Company may retain certain information to the extent necessary when required for legal retention obligations, tax and accounting matters, audits, abuse prevention, security, dispute handling, or other legitimate reasons.

10. Security Measures

We endeavor to implement security measures such as the following to prevent leakage, loss, damage, unauthorized access, tampering, misuse, and other risks regarding collected information:

• Access control, authentication, and permission management
• Encryption of communications and use of cloud platform security features
• Log management and recording of audit trails
• Fraud detection, anomaly detection, rate limiting, and other security controls
• Retention management and preparation of automatic deletion or deletion procedures
• Selection, supervision, and contractual management of vendors

11. Information of Minors

If minors use the Service, they must obtain consent from a parent or other legal representative where required by law. We may perform additional checks if necessary.

12. International Transfers

We or our contractors may store or process user information outside Japan, including in the United States, as necessary for cloud services, analytics services, advertising infrastructure, and other operational needs. We will endeavor to confirm the data protection regime of the destination countries and take necessary and appropriate measures in accordance with applicable law.

13. Changes to this Policy

1. We may change this Policy when there are reasonable grounds such as changes in laws, changes to the Service content, or changes in operations.
2. If we make a material change, we will provide notice through the app, our website, notifications, or another method we consider appropriate no later than seven days before the effective date. This does not apply where immediate action is required by law or for urgent security purposes.
3. The revised Policy applies from the effective date separately specified by the Company.

14. Requests for Disclosure and Related Rights

1. Users may request disclosure, correction, addition, deletion, suspension of use, or suspension of third-party provision of their personal information under the Act on the Protection of Personal Information or other applicable laws.
2. Requests must be sent by email to info@calshe.net. For account deletion, see also our account deletion page. We may request identity verification documents as necessary.
3. After confirming that the requester is the data subject, we will respond within the period required by law and notify the result.
4. If we cannot comply based on applicable law, we will notify the requester of that fact and the reason.

15. Operator Information

• Operator: Calshe LLC
• Address: Ginza Otake Bizidensu 2F, 1-22-11 Ginza, Chuo-ku, Tokyo 104-0061, Japan
• Contact: info@calshe.net / https://calshe.net/banana-walk#support
• Effective Date: April 9, 2026
• Last Revised: September 21, 2026 (stated that location information is not collected and named the advertising / attribution recipients; September 15, 2026: crash reporting made opt-in)
• Personal Information Protection Manager: Personal Information Protection Manager