PenguPace: Rewards for Steps

"We may also collect, store, and use information about apps or games installed on Your mobile device through Company or separately, either before or during the use of Service. This information is collected, stored, and used for targeting and personalization to improve user experience and personalization. We may collect your device's advertising identifiers (Google Advertising ID or Apple IDFA) for analytics purposes and to ensure accurate attribution through mobile measurement partners (MMPs)."

The app scans and stores a list of all apps installed on your device, which reveals sensitive personal information (health apps, dating apps, financial apps, etc.), and collects advertising IDs — all for targeting and personalization purposes that go beyond core functionality.

"We may use certain user attributes and engagement data, including demographic information (such as age or gender where available), device identifiers (such as advertising identifiers), and in-app activity data to measure the effectiveness of advertising campaigns, attribute installs, conversions, or other events to our advertising partners, detect fraudulent activity, and optimize the offers and promotions displayed within the Service."

The company uses advertising identifiers and mobile measurement partners (Adjust, AppsFlyer, Kochava, Singular) to track user behavior across multiple apps and services, building cross-app profiles for attribution and campaign optimization.

"We may share certain pseudonymized information with our business partners, such as app developers, advertisers, and measurement providers, in order to provide offers, measure campaign performance, and optimize advertising and promotions displayed through the Service. This information may include, but is not limited to, device identifiers (such as advertising identifiers), attribution data, engagement information, and limited demographic attributes (such as age or gender where available)."

The company shares device identifiers, demographic data, and engagement information with a large network of third-party partners including Adjust, AppsFlyer, Kochava, Singular, Segment, Mixpanel, and others — primarily for advertising and attribution purposes.

"The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Notice. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. Typically, if Your account has been inactive for more than 2 years, it will be deleted, except for any data we are legally required to retain."

While they mention a 2-year inactivity deletion policy, the retention period is otherwise undefined ('as long as necessary') with broad exceptions for legal obligations, disputes, and enforcement — giving the company wide discretion to retain data indefinitely.

"Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers, device Information, referral source, network information, and other diagnostic data. When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device's unique ID, the IP address of Your mobile device, country of location, timezone."

The company automatically collects IP addresses, country of location, and timezone data, and uses MaxMind (an IP geolocation service) as a third-party provider, enabling passive location tracking of users.

"We may update Our Privacy Notice from time to time. We will notify You of any changes by posting the new Privacy Notice on this page. We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Notice. Changes to this Privacy Notice are effective when they are posted on this page."

While they promise email or prominent notice, the changes become effective simply by being posted on the page, with no requirement for user consent or meaningful opt-out period before new terms take effect.