Privacy Policy

Last updated: 4 August 2026

Chonky is a walking game for iPhone and Apple Watch made by Russell Ong. This policy explains what the app reads, what it stores, and what leaves your device. The short version: the game runs on your steps, your steps stay on your phone unless you opt into online play, and nothing is sold or shared with advertisers.

Playing without an account

The full local adventure works without any account. In that mode your progress, rewards, and home decorations are stored only on your device and in your personal iCloud device backup. We cannot see them.

Apple Health

• The app requests read-only access to step count and nothing else. It never reads workouts, heart rate, weight, location, or any other Health data, and it never writes to Health.
• Step data is processed on your device to charge attacks and track daily progress.
• If you sign in and take part in competitive features (boss fights that count, Pack rankings, leaderboards), the app submits step totals as plain numbers to our server so results can be verified and shared fairly. A daily cap applies. No other Health information ever leaves your device.

Signing in with Apple

Online features (Packs, leaderboards, friends, home sync) require Sign in with Apple. When you sign in:

• We create a pseudonymous player record. Your raw Apple identifier, email address, and identity tokens are never stored or logged; where the server needs to recognize you, it uses one-way keyed hashes instead.
• We store your player profile (display name, avatar choice), game state you share online (Pack membership, contributions, inventory, home room layouts, friends, gifts), and the security records needed to keep sessions safe.
• Apple's App Attest is used to confirm requests come from a genuine copy of the app on a real device. Attestation material is verified, not kept.

Purchases

Optional purchases are processed by Apple through the App Store. We use RevenueCat to validate transactions. We never see your payment details, and transaction identifiers are stored only as one-way hashes.

What we do not do

• No advertising and no ad networks.
• No third-party analytics or tracking SDKs.
• No selling, renting, or sharing of personal data.
• No reading of contacts, photos, location, or the clipboard.

Your data, your controls

• Export: signed-in players can download a portable copy of their online game data from inside the app.
• Deletion: you can delete your account from inside the app. This removes your account and personal game state from our server. Only unlinkable operational records (for example, anonymous audit counters) are retained.
• Deleting the app removes all local game data from your device.

Data security

Server traffic is encrypted with TLS. The database is not reachable from the internet, requests are rate limited and strictly validated, and production secrets and backups are locked down. Where identifiers must be correlated, we use domain-separated keyed hashes rather than raw values.

Children

Chonky does not knowingly collect personal information from children. Playing offline requires no personal information at all. If you believe a child has created an online account without permission, contact us and we will delete it.

Changes

If this policy changes, the new version will be posted here with an updated date. Material changes will be called out in the app.

Contact

Questions about privacy or your data: russellongdev@gmail.com