How Far Privacy Policy
Last updated: September 23, 2026
This Privacy Policy applies only to the How Far mobile app ("How Far", "the app"), published by Zero to One ("we", "us"). Other Zero to One apps have their own privacy policies.
The short version
- How Far counts your steps to measure how far you walk. It never uses GPS or your location.
- We store your email, your display name, and your daily steps, distance and estimated calories.
- Other players can see your display name, distance, steps, calories, level, gemstones and join date. Nothing else.
- No ads, no analytics SDKs, no tracking, and we never sell your data.
- You can delete your account and all its data at any time inside the app.
1. Data we collect
| Data | How we get it | Why we need it |
|---|---|---|
| Email address | You enter it when you sign up, or it is provided by Apple or Google when you sign in with them | To create and secure your account, confirm your email, and reset your password |
| Password | You choose it if you sign up with email | To sign you in. It is stored only as a salted hash; we can never see it |
| Display name | You enter it, or it is taken from your Apple or Google profile. You can change it any time in Settings | Shown on your profile and on the leaderboard |
| Step count, distance, and estimated calories per day | Read from your phone's motion sensor (step counter) after you grant the Motion & Fitness / Physical Activity permission. Distance and calories are estimates calculated from your steps | The core function of the app: your daily progress, levels, gemstones, and leaderboard ranking |
| Gemstones (achievements) earned and when | Generated by the app from your activity | To show your collection on your profile |
| Preferences (distance unit, appearance) | You choose them in Settings | To display the app the way you prefer |
| Account timestamps (created, last active) and request counters | Generated automatically when you use the app | To run the service, time the weekly reminder, and protect the service from abuse |
What we do not collect
- No GPS, location or route data. How Far does not request location permission.
- No Apple Health / HealthKit or Google Health Connect data.
- No contacts, photos, microphone or camera access.
- No advertising identifiers, and no third-party analytics or advertising SDKs.
- No height, weight, age or other body measurements.
2. What other users can see
How Far is a competition, so some information is visible to other signed-in users: your display name, your distance, steps and calories, your level, the gemstones you have earned, and the date you joined. Your email address is never shown to other users. If you do not want your real name to be visible, choose a different display name in Settings.
3. How we use your data
- To provide the app: track your progress, calculate levels and gemstones, and rank the leaderboard.
- To manage your account: sign-in, email confirmation and password reset emails.
- To keep the service secure and prevent abuse, such as fake sign-ups or automated requests.
We do not use your data for advertising, we do not track you across other apps or websites, we do not build marketing profiles, and we do not sell or rent your data to anyone. Motion and fitness data is used only to provide the features described above.
4. Notifications
If you allow notifications, How Far shows a notification when you level up and at most one reminder per week if you have not opened the app. These notifications are created locally on your device. We do not collect a push notification token, and you can turn notifications off at any time in your phone's settings. The app works without them.
5. Service providers we share data with
We share data only with the providers needed to run the app, and only for that purpose:
- Supabase hosts our database and authentication service. All account and activity data listed above is stored there, encrypted in transit and at rest. Supabase also sends our account emails (confirmation, password reset).
- Cloudflare Turnstile protects the sign-up and sign-in forms from bots. When those forms are shown, Cloudflare receives technical information such as your IP address and device/browser signals to decide whether the request is genuine.
- Apple and Google, only if you choose "Sign in with Apple" or "Sign in with Google". They confirm your identity to us and provide your email address and name. With Sign in with Apple you can hide your real email address from us.
These providers are required to protect your data to at least the standard described in this policy. They may process data on servers outside your country; where required, such transfers are covered by appropriate safeguards such as standard contractual clauses. We may also disclose data if the law requires it.
6. Data stored on your device
The app keeps your sign-in session in your device's secure storage and caches recent data (such as today's progress and the leaderboard) so it opens quickly and works briefly offline. This is removed when you log out, delete your account, or uninstall the app.
7. Retention and deletion
We keep your data for as long as you have an account.
To delete your account: open How Far, go to Profile → Settings → Delete account and confirm. This immediately and permanently deletes your account, your email address, your activity history and your gemstones from our live database, and removes you from the leaderboard. Residual copies in encrypted backups are overwritten within 30 days.
If you cannot access the app, email zerotoonebros@gmail.com from the address your account uses and we will delete it for you within 30 days.
8. Your rights and choices
- Access and correction: your data is visible in the app, and you can change your display name any time.
- Deletion: see section 7.
- Withdraw consent: you can turn off the motion/physical activity permission or notifications in your phone's settings at any time. Without the motion permission the app cannot count new steps.
- Copy, objection, restriction, complaint: depending on where you live (for example under the GDPR or CCPA) you may have the right to receive a copy of your data, to object to or restrict certain processing, and to complain to your local data protection authority. Email us and we will respond within 30 days.
Where the GDPR applies, our legal bases are: performance of our contract with you (providing the app), your consent (motion data and notifications), and our legitimate interest in keeping the service secure.
9. Children
How Far is not directed at children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will delete it.
10. Security
All traffic between the app and our servers is encrypted with TLS, passwords are stored only as salted hashes, database access is restricted per user by row-level security rules, and sign-in forms are protected against automated abuse. No system is perfectly secure, but we work to protect your data and will notify you as required by law if a breach affects you.
11. Changes to this policy
If we change this policy we will update the date at the top of this page. If a change is significant, for example if we add paid features or start collecting a new kind of data, we will also tell you in the app before it takes effect.
12. Contact
How Far is published by Zero to One. For any privacy question or request, emailzerotoonebros@gmail.com. For general help, see theHow Far Support page.