Privacy policy

Before the detail

The short version

Your walks are how Emshi works.
Emshi records where you walk so it can check you really walked and which sponsor zones you entered. The route goes to our server for that check; the server keeps the zone visits and the totals, not the route.
Health readings never leave your phone.
What Emshi reads from Health Connect is drawn on your phone and forgotten. It isn’t stored, sent to us or shared.
Sponsors see counts, never you.
They get numbers of visitors and dwell times for their zones. No names, no handles, no routes.
No ads, no analytics, no trackers.
No advertising ID, no analytics or crash-reporting code, and we don’t sell your data.
No “all the time” location.
Location is read while Emshi is on screen, and during a walk you start, until you finish it.
Emshi’s founders can see your account.
Your name, sign-in addresses, points and each walk’s figures, in an internal tool, to answer support questions and judge flagged walks. Never your route — our server does not keep one. Details.
Deleting your account deletes you.
What survives is anonymous: zone visits, walk totals and reward records with no name, email or sign-in left attached — and, today, the internal record of any correction we made to your points. Details.

Section 1

Who we are

Emshi is a walking app for Qatar. You earn points for walking, earn them faster inside sponsors’ booster zones, and spend them on rewards the sponsors fund.

Emshi (“Emshi”, “we”, “us”) operates in Qatar, and decides how the personal data described here is used. We are responsible for it. You can reach us at info@emshi.ai.

This policy covers the Emshi app for Android and this website. When you use a voucher with a sponsor, the sponsor’s own privacy policy covers what they do.

Section 2

Your account

What	Why
Email address	To create your account, sign you in, confirm it’s yours and help you recover it.
Password	To sign in. It is held only by our sign-in provider; Emshi’s own server never receives or stores it.
A code sent by email	To confirm the email address is yours when you sign up, and to reset a forgotten password.
Your Google account’s ID, email, name and whether the email is verified	Only if you use “Continue with Google”: to sign you in without a password. We don’t get your Google password or anything else in your Google account.
Display name	To greet you, and to label your row on a leaderboard if you join one. It comes from Google or from sign-up.
A handle and a referral code we create	So friends can find you without swapping email addresses.
Sign-in sessions	When you signed in, and the IP address and device type it came from — to keep you signed in and your account secure. Kept by our sign-in provider.

Emshi’s introduction asks nothing about you — no home area, no goals. You can’t change your display name in the app yet; email us and we’ll change it for you.

Section 3

Location and your walks

This is the part that matters most, so it is in detail.

When Emshi reads your location

Only with your permission for precise location “while using the app”, and only in two situations:

While Emshi is on screen — to show you on the map and to record walking you do with the app open. Emshi stops reading location as soon as it leaves the screen.
During a walk you start with Track walk, until you tap Finish walk — including with the screen off or the app closed. An ongoing “Recording your walk” notification shows the whole time. If Android stops the app mid-walk, Android restarts the recording for that same walk, under the same notification.

Emshi doesn’t ask for background location (“Allow all the time”), doesn’t register geofences, and doesn’t read your location at any other time.

What is recorded

A series of location fixes — latitude, longitude, time and accuracy — with the distance between them and which booster zone, if any, each fix fell inside.

With the app on screen and no walk tracked, Emshi records untracked stretches too, because points come from walking rather than from pressing a button. Each stretch ends after 30 minutes, when you leave a zone, at the end of the day, or when the app leaves the screen. A stretch where the phone moved but your step counter didn’t — a car or a bus, say — keeps its time but no coordinates, and its route is never uploaded.

What is sent to our server

When a walk or stretch ends: when it started and ended; its distance, duration and step count; one word for the activity (walk, run, stationary, cycling, vehicle or unknown); the points your phone worked out; the zone visits it detected; and the route, simplified to about 500 points, each with its position, its time and the steps taken since the previous point.

What our server keeps

The route is used to work out again which zones you visited, and to check that its speeds and steps are those of a person walking. Then the coordinates are discarded, and the per-point step counts with them. What is kept:

The walk — its start and end, distance, duration, steps, points, how many route points it had, its top speed and the result of the fraud check. No coordinates.
Your zone visits — which zone, when you entered and left, how long you stayed, the multiplier and the points earned.

What stays on your phone

Your walk history keeps each walk’s route, so you can look back at your own walks. Walks waiting to upload keep their routes until they are sent. See section 8.

If you say no

Your steps still earn, at the indoor rate — half, up to 300 points a day — but with no zone visits or streak credit, because nothing shows that ground was covered. Approximate location isn’t precise enough to tell whether you are inside a zone, so if you allow only approximate location, those fixes are discarded on your phone and never sent.

Section 4

Steps and motion

Emshi uses Android’s physical activity permission for two things, both to stop rewards being paid for movement that isn’t walking:

Your phone’s step counter is what earns points — about ten steps to a point — and a stretch of GPS only counts as walking if steps were taken during it.
Google Play services’ activity recognition tells the app when your phone seems to be in a vehicle or on a bicycle, and earning pauses while it is.

The step count of each walk is sent to our server with the walk. The activity result is used on your phone only: it isn’t uploaded, logged, or used for analytics or advertising. The only thing derived from it that reaches our server is the one word for the walk’s activity in section 3.

Both keep working when Emshi is closed. The step counter is read about every 15 minutes, to notice when you are walking with nothing recording (see section 7), and activity results keep arriving so that a drive taken before you open the app isn’t paid as a walk. Neither reads your location.

Without Google Play services, or if you refuse this permission, walks can’t earn points, and the app tells you so.

Section 5

Health Connect

What Emshi reads

Five kinds of data, each only if you allow it:

Data	What Emshi uses it for
Steps	The Health tab shows your steps for each day of the week and a twelve-week grid of the days you walked. Emshi’s points are paid from the phone’s own step counter, never from Health Connect.
Distance	The Health tab shows the distance you covered each day beside your steps, and the week’s total.
Active calories burned	The Health tab shows the active calories you burned each day, as a weekly chart, a daily move ring and a figure beside each workout.
Exercise sessions	The Health tab lists this week’s workouts, your exercise minutes and how much of that time was outdoors. And while a bike ride another app is recording is under way, walking points pause, so the ride isn’t paid as a walk.
Heart rate	The Health tab shows your latest heart rate, the highest and average today, and how the week’s time divides across heart-rate zones.

Where those readings go: nowhere

They are read on your phone when you open the Health tab or come back to the app, held in memory, drawn, and dropped when the app closes. Emshi doesn’t store them, doesn’t send them to our server, and doesn’t share them with sponsors or anyone else. None of it pays points; the one way a reading touches earning is the bike ride above, and it only pauses it.

What Emshi writes

Only if you turn on Save walks to Health Connect in Settings → Privacy, which asks for its own permission: each walk our server has accepted is added once, as a walking session called “Walk with Emshi”, with its distance and step count. Emshi never changes or deletes records other apps wrote. You can turn this off in Settings or in Health Connect, and delete the walks Emshi saved from Health Connect itself.

Your control, and Google’s rules

You can withdraw any Health Connect permission at any time in Health Connect; the Health tab then says the data isn’t available rather than guessing.

Emshi’s use of information from Health Connect follows Google Play’s Health Connect permissions policy, including its Limited Use requirements: it is used only for the features described here, never sold, never used for advertising, and never transferred to anyone else.

Section 6

Points, rewards and friends

Your wallet and rank — points balance, lifetime points, points spent, distance totals and active days.
Your streak — the days on which you cleared the 5 km daily target. For now it is kept on your phone, as dates with no distance or location attached.
Reward redemptions — which reward, its cost in points, your voucher code, its status and when — so your voucher works and can be checked with the sponsor who honours it.
Leaderboards — the Nearby leaderboard is off by default, because it would show which areas you walk in. If you turn it on, other walkers can see your display name, handle, avatar colour, rank and a distance figure.
Friends, shared goals, duels, nudges, reactions and milestone posts, if you use them — stored so those features work. Friends see the goals and duels they share with you.

Section 7

Notifications and sharing

Notifications. The “Recording your walk” notification during a tracked walk. Walk nudges, when your phone’s step counter notices you walking with nothing recording — on by default, and turned off in Android’s notification settings for Emshi. Streak reminders, which stay off until you say yes. All of them are decided and scheduled on your phone: Emshi uses no push service and has no device token.
Sharing a walk. The share card is made on your phone, and you decide whether to send it to another app or save it to your gallery. Emshi doesn’t upload it.
Emshi has no access to your camera, microphone, contacts, calendar or photos.

Section 8

What stays on your phone

Emshi keeps on your phone: a copy of your account’s totals and settings, your streak, your walk history with each walk’s route, walks waiting to upload with their routes, the zone and reward catalogue, the latest step count and activity reading, the reminders it has scheduled, and your signed-in session.

None of it is backed up to your Google account or copied to a new phone — Android’s backup and device transfer are turned off for Emshi. After a reinstall or on a new phone, your points, zone visits and redemptions come back with your account, but your streak, that phone’s settings and any walks that hadn’t uploaded do not.

Signing out removes your session from the phone. Deleting your account clears Emshi’s data from it. Uninstalling Emshi removes everything it stored.

Section 9

Who at Emshi can see your data

Emshi has an internal dashboard over the same server the app talks to. Only the founders can open it — the addresses on a list the server holds, each one a verified sign-in. Anyone else gets nothing: the server answers as though the pages do not exist. Sponsors never have access to it.

What a founder can see about you

Your display name, handle, the email addresses you sign in with, your points balance, lifetime points and points spent, your tier, whether you turned on the Nearby leaderboard, and when you made the account. For each walk: when it started and ended, how long it took, its distance, steps, stride, the one word for its activity, the points your phone claimed and the points our server worked out, and the result of its fraud check. Then the zone visits our server derived from it, your redemptions — which reward, its cost, its status and when, but not the voucher code — and any manual correction to your points.

What it cannot show

Your route. There is nothing to show: our server does not keep coordinates (section 3).
Your health data. It never leaves your phone (section 5).
Your IP address, which Emshi’s own code does not record.
Your streak, your friends, or anything in the feed.

What they can change, and the record it leaves

Two things: approving or rejecting a walk the fraud check flagged, which credits or removes that walk’s points; and correcting a points balance. Each needs a reason, and each is written to an audit trail — who did it, what it touched, the reason, and what changed — in the same step as the change itself, so a change cannot exist without its record. Both are for answering support questions and for judging flagged walks, and for nothing else: no profiling, no marketing, no sharing with sponsors.

The audit trail, the record of any points correction, and the list of addresses invited to a closed test are kept indefinitely today, and a deleted account does not remove them — see section 13.

Section 11

Services that handle your data

We use these providers to run Emshi. They handle data on our behalf, for the purposes below.

Service	What it does	What it handles	Where
Neon	Sign-in, and Emshi’s database. Sends the sign-up and password-reset emails.	Your account, your sign-in sessions, and everything our server keeps	Frankfurt, Germany (Amazon Web Services)
Render	Hosts Emshi’s server.	Every request the app makes, including walks as they upload. Its logs record each request and the IP address it came from, for a limited time.	Frankfurt, Germany
Google	Sign-in with Google, if you use it. Activity recognition in Google Play services, which runs on your phone. Google Fonts, which serves the app’s typefaces. Google Play, which delivers the app.	Your Google account’s basic profile, if you sign in with Google. Your IP address and device details when the typefaces load.	Google’s data centres worldwide
OpenFreeMap	The map itself.	The area of the map you are looking at, and your IP address — enough to tell roughly where you are	OpenFreeMap’s servers
Health Connect	The health data store on your phone.	Stays on your phone. Google doesn’t receive your health data through Emshi.	Your phone

Even before you create an account, the app loads map tiles from OpenFreeMap, its typefaces from Google Fonts, and the zone, sponsor and reward catalogue from our server. Every server that answers a request sees the IP address it came from. Emshi’s own code doesn’t store it; our host’s logs do, for a limited time.

What the app tells our server about itself

Every request carries which version of Emshi sent it — “1.0.1, from the Play Store”, say. It names the build and nothing about your phone: no model, no Android version, no identifier, and nothing that differs between two phones running the same version. It is there so a support question can be answered and so a test build can be told from a real one.

Our server keeps a short log of requests for 30 days: which kind of request it was — the shape of the address, never one with your walk’s ID in it — whether it succeeded, how long it took, that version, and whether anyone was signed in. Not your IP address, not who you are, and not anything you sent. It exists so we can tell “nobody is walking today” from “the app cannot reach the server today”, which from the outside look identical.

Section 12

Where your data is stored

Emshi’s database and server are in Frankfurt, Germany, so if you use Emshi in Qatar, your data is transferred there. Google’s services may handle data in other countries, including the United States.

Everything between the app and our servers travels encrypted over HTTPS — the app only talks to our server that way — and our database provider encrypts the data it stores.

Section 13

How long we keep it

Data	How long
Your account and everything tied to it	For as long as your account exists.
After you delete your account	Your name, email, handle, sign-in, sessions, friends, posts, reactions, nudges, shared goals and duels are deleted straight away. Your walk totals (which never had coordinates), zone visits and reward redemptions are kept, attached to an account record with no name, email or sign-in left in it — because sponsors are invoiced on counts of distinct visitors, and issued vouchers have to be accounted for. More on deletion.
What deleting your account does not reach	Three things outlive it, kept indefinitely today: the record of any manual correction to your points, the internal audit trail of that correction or of a walk a founder reviewed — including the reason they typed — and, if you were invited to a closed test, your email address on that invitation list. See section 10. Whether these should go when an account does is one of the questions still open for review.
Database backups	Deleted data can stay in our database provider’s restore history for a short time — no more than 30 days — before it is overwritten.
Our request log	30 days, then deleted. It holds no IP address, no account and nothing you sent — see section 11.
Server logs	Kept by our host for a limited time, then deleted.
On your phone	Until you sign out, delete your account, clear Emshi’s storage or uninstall it.
Emails you send us	As long as we need them to deal with what you asked.

Section 14

Why we’re allowed to use it

We handle personal data under Qatar’s Law No. 13 of 2016 on Personal Data Privacy Protection and, where it applies, the EU’s General Data Protection Regulation. Our reasons are:

To provide Emshi — your account, recording and checking walks, points, rewards, and the features you choose to use.
Your consent — for location, physical activity, notifications and each Health Connect permission. Each is asked for separately, with an explanation, before Android asks. You can withdraw any of them at any time in Android’s settings or in Health Connect; that stops the feature it serves, not the others.
Legitimate purposes — preventing fraud, keeping Emshi secure, and reporting to sponsors in totals.
Legal obligations — where the law requires us to keep or disclose data.

Precise location and health information are sensitive. Health information never leaves your phone, and location is used only as described in section 3.

Section 15

Your rights and choices

You can ask us to:

show you the data we hold about you, and give you a copy;
correct it — including your display name, which you can’t yet change in the app;
delete your account and data (see Delete your account), or delete specific data;
stop using your data for a particular purpose, where you object to it.

Email info@emshi.ai from the address on your account. We reply within 30 days. We may ask you to confirm the request comes from you — we will never ask for your password. You can also complain to Qatar’s data protection regulator, or to the regulator where you live.

In the app you can, at any time: turn the Nearby leaderboard or Save walks to Health Connect on or off (Settings → Privacy), switch permissions off in Android’s settings or in Health Connect, and delete your account (Settings → Account).

Section 16

Children

Emshi is for people aged 13 and over. If you are 13 to 17, you need a parent’s or guardian’s permission to use it, and they should read this policy with you.

We don’t knowingly collect data from children under 13. If we learn that an account belongs to a child under 13, we delete it. A parent or guardian can contact us to see or delete their child’s data.

Section 17

Security

Everything between the app and our servers is encrypted in transit.
Your password is held only by our sign-in provider; Emshi’s own server never sees it.
Your session is stored only on your phone, and Emshi’s data on your phone isn’t backed up to the cloud.
Our server keeps no coordinates from your walks.

No system is perfectly secure. If a breach affects your data, we will tell you, and the regulator, as the law requires.

Section 18

This website

This website uses no cookies, no analytics and no tracking, and its fonts are served from the site itself. The company that hosts it receives your IP address and browser details to deliver the pages, and may keep them in its logs for a short time. If you email us, we receive your email address and whatever you write, and use them only to reply.

Section 19

Changes to this policy

If we change this policy, we will update the date at the top. If a change matters to you — a new kind of data, say, or a new reason to use it — we will tell you in the app or by email before it takes effect.

Section 20

Contact

Questions, requests or complaints about your data: info@emshi.ai.

Emshi operates in Qatar.