Before I started to bot/spoof, I played 6 ~ 12 hours per day, frequently for consecutive days.
Moreover, there are people who leave the real app on all days just to hatch eggs,
so playing time per day is likely not a primary factor, just a minor one (however never taking breaks would look very suspicious indeed).
It is what is accomplished during play that mostly like the primary factor.
For example, even I occasionally run two 5-6 hour bot sessions within a 24 hour period, I have never ever reached the catching / spinning softban limits because I always set my bot to walking/jogging speed ( 2.8 m/s or less, which is 10 kmh or less ).
Additionally, I only play one account, so I have no issue of IP sharing wutsoever. (*)
What if this account gets banned you say? Well, I'll just quit playing. Frankly I am no diehard fan of pokemons, and it has been more than half year since I started playing PoGo -- staying in a nest for a whole day, chasing rare pokemons on foot, spoofing, botting, sniping -- I've experienced it all except PvP and trading. As a player leaning toward collecting (I've got most catching gold medals except the tiny rattata and the new dark and unown ones, but I've not yet obtained gold on gym battles and training), PvP isn't something really appealing to me, especially when Niantic can't even solve the annoying "invisible" bug in gym battle even now. Also as a botter/spoofer/sniper, trading is quite pointless to me.
So, I still bot/play just to see how far I can ride on the PoGo bandwagon until get kicked out of it. Otherwise, this game has become a grind to me already (Lv 35+).
Oops, I digressed too much. To sum up what I do/don't do:
Dos:
1. I snipe, but only within my local country boundary ( a small island country, so mostly within 300 km radius);
2. I spoof when bot is waiting for new API update, or when I feel like to play "by hand but not on foot;"
- I do train/attack gyms when spoofing;
3. I bot for more than 6 hours per day quite frequently, often for consecutive days;
4. I bot for jogging speed most of the time; (10 kmh)
5. I set up walking path in respect to the real map in the bot I use, although occasionally I let the bot go loose by only setting coverage radius;
6. If I run two bot sessions in one day, there is always a multi-hour break in-between;
7. Botted oversea with VPN/proxy providing local IPs to catch regionals ------ and lapras;
Don'ts:
1. Never be the first bunch to test new APIs; It is the only reason my only account got away with any ban caused by API mistakes/updates to this point of time (Kinda strange to pay to be a lab mouse, doesn't it? Get the API right before releasing it, and also shut the old one in time, plz.);
2. Never be too greedy to catch so many and result in limit softbans; greed is a good thing, but do manage it properly;
3. Never snipe oversea;
4. Never have multiple accounts simultaneously;
5. Never use bot to train/attack gyms ( Because I want to enjoy the fight by hand, don't really care about free poke coins that much );
6. Never fire up the real app just to see the result of botting; When I start the real app, I always actually play for quite sometime;
7. Never do auto-evolve or mass-evolve+transfer for many pokemons each time (never done it for more than 10 each time).
My account is currently active at the time of this post. How long will it last? Don't know, don't care.
*IP sharing
- Simply running multiple instances of PokemonGo on a single IP would not raise a flag. I've personally seen a mom tethering her phone for her two kids to play the game.
However, if multiple accounts traveling at largely apart locations are sharing the same IP? That just looks extremely suspicious and can be easy targets.