Privacy Policy

Last updated 15 September 2026

This policy explains what PushApe collects, why, and what you can do about it. It describes how the app actually behaves — not a generic template.

Who is responsible for your data

PushApe is operated by Sebastian Crabb, a sole trader based in the United Kingdom ("we", "us"). We are the data controller for the personal data described in this policy under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For any privacy question or to exercise your rights, contact support@pushape.app.

Your camera is never recorded

This is the most important thing to understand about PushApe, so it comes first.

When you log a workout, the camera feed is analysed entirely on your own device by an on-device machine-learning model that estimates the position of your joints. No photo, no video and no image frame is ever saved to your device, transmitted to us, or sent to any third party.

The only thing that leaves your device is the resulting number — how many repetitions were counted. We never see the footage, and neither does anyone else.

What we collect

We collect the following, and nothing else:

Account details — your email address and a username you choose. Your password is handled by Google Firebase Authentication and is stored only as a cryptographic hash; we never have access to it.
Workout data — repetition counts, daily logs, current and longest streaks, and your best day.
Goals and progress — your daily and weekly targets, XP, level, trophies, medals and league.
Social data — your friends list, friend requests sent and received, team membership and team invitations.
Competition records — results of head-to-head matches, challenges and team battles you take part in.
Technical timestamps — when your account was created and when you last logged a workout.

What we do not collect

We want to be specific about this, because many apps in this category do collect the following and we do not:

No location data. The app requests no location permission and records no location. (A location usage string appears in the app because a third-party library requires it to be declared; the feature is unused.)
No photos, video, or camera footage, as described above.
No contacts or address book access.
No Apple Health / HealthKit data.
No advertising identifiers, and no advertising of any kind.
No third-party analytics, tracking or profiling SDKs. We do not track you across other apps or websites, and we do not sell or share your data with data brokers.

Why we use your data, and our legal basis

To provide your account and the service — performance of our contract with you. This covers your login, workout history, goals and progress.
To operate social and competitive features — performance of our contract. Leaderboards, friends, teams, challenges and head-to-head matches cannot function without sharing the data described under "What other people can see".
To keep the service safe — our legitimate interests in preventing abuse, investigating reports of objectionable content and enforcing our Terms.
To fix problems and improve the app — our legitimate interests in maintaining a working product.
Camera access — your consent, given through your device's permission prompt. You can withdraw it at any time in your device settings, though rep counting will not work without it.

What other people can see

PushApe is a competitive app, so some information is deliberately public to other signed-in users. On leaderboards, in leagues, in teams and on profile screens, other users can see:

Your username
Your push-up totals, weekly totals, streaks and best day
Your trophies, league, level and medals
Your team membership

Your email address is never shown to other users. Choose a username you are comfortable being seen publicly — you are choosing it for an audience, not just for yourself.

Who processes your data for us

We use a small number of service providers, who act as our processors and may only use your data on our instructions:

Google Firebase (Authentication, Cloud Firestore, Cloud Functions) — stores your account and app data and runs scheduled maintenance such as the weekly leaderboard reset. Provided by Google Ireland Limited / Google LLC.
Expo (EAS Update) — delivers over-the-air updates to the app. Your device contacts Expo's servers to check for updates.
Apple — distributes the app and handles account sign-in to the App Store. Apple's own privacy policy governs that relationship.

International transfers

Our providers may process data on servers outside the United Kingdom, including in the United States. Where that happens, the transfer is protected by the UK International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, or an applicable adequacy decision.

How long we keep it

We keep your account data for as long as your account exists. If you delete your account, we delete your personal data within 30 days, except where we must keep something longer to comply with a legal obligation or to resolve a dispute.

Reports of objectionable content may be retained for up to 12 months after resolution so that repeat behaviour can be identified. These records are kept to the minimum necessary.

Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you
Have inaccurate data corrected
Have your data erased ("right to be forgotten")
Restrict or object to how we process it
Receive your data in a portable, machine-readable format
Withdraw consent at any time, where we rely on consent

To exercise any of these, email support@pushape.app. We will respond within one month. You can delete your account from within the app at any time.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, or call 0303 123 1113.

Security

Your data is held in Google Firebase, encrypted in transit and at rest. Access is restricted by security rules so that you can write only your own records. No system is perfectly secure, but we take reasonable and appropriate measures to protect your information.

Children and young people

PushApe is not intended for anyone under 13, and we do not knowingly collect data from anyone younger. If you believe someone under 13 has created an account, contact support@pushape.app and we will remove it.

If you are under 18, you need a parent or guardian's permission to use PushApe, and they must agree to our Terms on your behalf.

We treat everyone's data the same minimal way, which we think is the right default for younger users: we collect only what the app needs to work, we do not profile you, we do not serve advertising, we do not track you across other apps or websites, and we do not sell or share your data with anyone for marketing.

A parent or guardian can ask us to see or delete a child's data at any time by emailing support@pushape.app.

One thing to be aware of: your username and your push-up statistics are visible to other users on leaderboards. If you are a parent, please help your child pick a username that does not identify them — not their full name, school or anything personal.

Changes to this policy

If we change this policy materially, we will tell you in the app and ask you to accept the new version before continuing to use it. The date at the top shows when it was last updated.