Privacy Policy

Last updated: November 1, 2026

Pushup RPG is built to respect your privacy. This policy explains exactly what the app does and does not do with your data.

Android and iPhone. This policy covers both apps. Most of it applies to both, and where they differ, the section says so. On Android, in both the Google Play and the Solana dApp Store editions: pose detection runs on your phone using Google’s ML Kit, which sends Google usage metrics about itself (see Google ML Kit); the app never asks for your microphone, your location or your contacts; it does not use the advertising ID; it contains no Singular or other install-attribution service and no health-platform integration; and two kinds of report name your phone’s make and model where the iPhone reports do not, as Diagnostics you choose to send and Automatic error reports below explain. Questions about what applies on your phone: support@pushup.quest.

On this page

Camera

The app uses your device camera to count pushups, squats, sit-ups, pull-ups and dips by detecting your body pose, and to time your plank the same way. All processing happens on-device, in real time. Pose detection never records, stores, or transmits video, images, or pose data off your device. Unless you turn on clip recording (below), the camera feed exists only in memory while a battle is active and is discarded immediately. Camera data is never uploaded to our servers or anywhere else.

Google ML Kit (Android)

On Android, in both the Google Play edition and the Solana dApp Store edition, pose detection is done by Google’s ML Kit. It runs on your phone, and it sends Google information about how ML Kit itself is performing. Google’s disclosure for ML Kit lists what that is: your device’s manufacturer, model and operating system version; the app’s package name and version; a per-installation identifier that Google says is not intended to identify you; how long processing took; the format and resolution of the images ML Kit was given, and the size of what went in and came out; and event types and error codes. Camera images are not on that list, so what the Camera section says about video, images and pose data holds on Android too. Google states the data is used for diagnostics and usage analytics, is not linked to your identity, is not shared with third parties, and is encrypted in transit. The app also contains Firebase Installations and Firebase Remote Config, which ML Kit relies on and which exchange an installation identifier with Google. The iPhone app does not include ML Kit: it detects your pose with Apple’s Vision framework, on the device.

Clips (optional, off by default)

If you turn on Record clips in Settings, the app records your battle or practice screen — the camera view plus the game overlays — into a video clip stored only on your device. On iPhone, iOS asks for your explicit confirmation before each session's first recording, and a REC indicator is visible whenever recording is active. On Android, recording uses Android’s own screen-capture prompt, which the system shows before recording starts, and a clip goes into your gallery (under Movies) only when you tap Save clip to your gallery.

Microphone (your choice, per the system's own prompt)

When a recording starts, iOS's own consent sheet lets you choose Record Screen and Microphone or Record Screen Only. If you allow the microphone, your clips include audio from the device microphone (your voice and the surrounding room) so shared videos carry the real moment. Like the video, this audio is recorded only on your device, only while you record, and is never uploaded to us. If you pick Screen Only, clips include only the game's own sound effects.

The Android app has no microphone permission, so it never records sound from your microphone.

Photos

Two separate things, and neither gives the app the run of your library.

Your avatar photo (Vigil members, optional)

With a Vigil membership you can use your own photo as your portrait instead of one of our painted ones. Because this is the one thing in the app you upload, here is exactly what happens to it.

Diagnostics you choose to send

If the camera is miscounting your reps, Settings → Reps not counting? lets you send us what the detector decided. The screen shows you the exact lines before anything is sent, and nothing goes anywhere unless you tap send. It contains the detector's own measurements — joint angles, timings, the reason each rep was accepted or refused — plus your app version, attached to your account so we can follow up. On iPhone it does not include your device model. On Android, the report’s first line names your phone’s manufacturer and model and its Android version, because the pose detector behaves differently from one phone to another.

No video, no images, and no photographs of you are ever included in that report — the camera feed never leaves your device, as described under Camera above.

The app also keeps a small tally of why reps were refused (for example "too shallow"), which rides along in your cloud save and helps us see which failures are common.

Automatic camera-session diagnostics. Separately from the report above, and without asking you each time, the app sends us a short summary at the end of every camera session: how long the camera ran, how many reps were counted, how many were refused, how many attempts ended as neither (a rep abandoned halfway, for example), the most common refusal reason as a code, a code for how far the detector got if it never managed to start counting, which screen and which movement you were doing, for push-ups (iPhone, from version 2.5.10) a code for roughly where the phone stood — at your side, at an angle, or in front of you — which the app works out on your phone from how wide your shoulders look compared with how long your torso looks, whether you were on iPhone or Android, your device’s performance tier and the app build. These are numbers and codes only. They are linked to your account, batched, and sent once per session. No video, no images and no joint coordinates are included, and as everywhere else on this page the camera feed itself never leaves your device. We use this to find detection failures we would otherwise only hear about from the few people who write in. Summaries are kept for about a week, then deleted.

The shape of the camera picture (iPhone, from version 2.5.10). Beside that summary the app sends one more short record about the picture the counter received: its proportions as a number, whether it was taller than it is wide or wider than tall, how many degrees the app turned it, and where that turn came from — your device’s own reading, a reading from an earlier session, your camera-angle setting, or the app’s default — with the same screen and movement, how long the camera ran (so the two records can be matched), whether you were on iPhone or Android, your device’s performance tier and the app build. From version 2.6.1, on the push-up and plank screens, the record also carries a code for how the phone was lying when the camera opened (upright, on its side, flat, upside down or in between), worked out on your phone from its motion sensor; the angle the phone’s own camera orientation settled on once the phone had been still for a second; and whether the app straightened a sideways picture during that session, whether it would have done so had your account been in the group for which it may, whether your account was in that group, and whether you had no account yet when the camera opened. It contains no image. A picture lying on its side makes counting less accurate, and this is how we find out how often that happens (on iPads standing in a keyboard case, for example). Like the summary it is linked to your account and kept for about a week; after that only daily totals with no account attached remain.

Automatic usage events. Also without asking you each time, the app records a handful of other moments in the same way, as numbers and codes linked to your account:

Each event also carries your device’s performance tier, the app build and whether you are on iPhone or Android. None of it includes video, images or anything you typed. This is our own record, kept on our servers, and it is separate from what Singular receives, which is described under Install measurement below. We use it to see which parts of the app work and where people give up. From version 2.6.3 we also use the app build in your most recent app opening for one more thing: hall moments are written about you only if your app has the switch to turn them off (see Hall moments). Usage events are deleted after about a week, and after that only daily totals with no account attached remain.

Your first steps in the app (iPhone, from version 2.6.0). The iPhone app keeps a short record of how far a new installation gets: which setup screens it reaches, and a few moments of the first sessions after that. It does this without asking you each time, and it starts before you have an account, because the setup screens come before sign-in. That makes it different from everything described above, so here is all of it.

We use these records to see where new players stop during setup and in their first sessions. They are kept on our own servers (hosted by Supabase) and are not sent to Singular. Each record is deleted once it is 30 days old, by a clean-up that runs every night. If you delete your account, the records that carry your account identifier are deleted with it straight away; records sent before you had an account carry only the random identifier, and go when their 30 days are up.

Automatic crash and freeze reports (iPhone, from version 2.5.10). When the iPhone app crashes, freezes, or is closed by iOS (for example for using too much memory), iOS can give the app a short report about it the next time you open it. iOS also gives the app a daily count of how it closed, on ordinary days too. The app sends us a few numbers from these reports, without asking you each time:

Nothing else from these reports is sent: not your device model, not your iOS version, not your region, no error message text and nothing from the app’s memory. Like the usage events, these are numbers and codes linked to your account, with your device’s performance tier, the app build and whether you are on iPhone or Android. We use them only to find and fix crashes. They are deleted after about a week, or straight away if you delete your account; after that only daily totals with no account attached remain. The full report stays on your iPhone.

When we ask you how many you actually did. Every so often, after a session in which the camera ran for at least 40 seconds, the app shows how many reps it counted and asks whether that is right. If you say no, it asks how many you actually did. It asks at most once a day on each device, and whether it asks has nothing to do with how the set went. If you answer, we store the number the camera credited, your answer (the same number, if you said it was right), how many reps it refused, how long the camera was running, which movement it was and which screen you were on, along with your app version, attached to your account. For push-ups we also store two measurements of how you appeared in the frame, the width of your shoulders and the length of your torso as a share of the picture, which show roughly how the phone was placed. That is the whole record: no video, no images, no joint coordinates, no free text, and nothing you typed beyond the number. Answering is optional and skipping it changes nothing. We use it to measure how often the detector disagrees with the person actually doing the reps, which is the one thing the camera cannot tell us by itself.

Automatic error reports. Also without asking you first, the app records a short note when something fails in a way it recovered from quietly, such as a camera session that was interrupted or a save that had to be retried. Each note is a short label for what happened, a technical detail such as an error code, your app version and your account, and at most one of each kind is recorded per hour. On Android, when the camera itself fails, the note also names your phone’s manufacturer and model and its Android version, because camera faults depend on the hardware. Our servers write a note of the same shape in four situations, and those carry more: renaming a guild you captain records the old and new names, so a moderation takedown has a trail; a day's reps going past the leaderboard cap records that day's count and your lifetime total; and a friend addition that trips our flood or consent checks records both players' account identifiers, on the account that made the addition; and a save that tries to raise your lifetime totals faster than our servers allow may be recorded, at most once in any 20 hours, with how many reps were held back from that save, the allowance that was available, how long it had been since your profile was last updated, and your lifetime push-up and squat totals. These notes contain no video, no images and no location. Each is deleted when the account it is recorded on is deleted.

Apple Health (iPhone only, optional)

Only pushup and squat sessions are written to Apple Health — sit-ups and planks are not, and nothing about them reaches Health at all. If you turn on Sync to Apple Health in Settings, Pushup RPG saves your battles and practice sessions to Apple Health as workouts, with your rep count, and an estimate of active energy if you allow it in Apple Health. This is opt-in and write-only: we only add workouts to your Health data — we never read any of your health information, it never leaves your device to our servers, and we never sell it, use it for advertising, or share it. You can turn this off anytime in Settings, and manage or delete the data in the Health app.

Accounts and cloud sync

To back up your progress across devices and to power the friends leaderboard, the app uses a cloud account (provided by Supabase). You can sign in with:

Sign in with Apple is available on iPhone only, and Google sign-in on iPhone and in the Google Play edition.

What we store on your account:

We do not collect contacts, and no health/fitness data beyond the rep counts that are part of your game progress. The app never asks for GPS or precise location, and there is no location permission prompt. There is one coarse exception, and we would rather name it than bury it: your country is derived on our server from the IP address your device connects from, so that country leaderboards can exist. Your country below explains exactly what is stored and what it is used for.

Solana wallet (Solana dApp Store edition)

The edition of Pushup RPG sold in the Solana dApp Store lets you sign in with a Solana wallet and pay for Vigil in SOL. If you use either:

This edition includes neither RevenueCat nor Singular. It uses push notifications the same way as the Google Play edition (see Notifications).

Google ML Kit. Like the Google Play edition, this edition includes Google’s ML Kit; see Google ML Kit.

Notifications

To send you notifications, the app needs a push token: an identifier that Apple (on iPhone) or Google (on Android) issues so that a notification can reach the app on your phone. The app stores it on our servers against your account, a guest account included, together with which platform it came from, when it was last registered and, from recent versions of the iPhone app, the app version. On iPhone, the app only asks Apple for a token after you have allowed notifications.

We use it to tell you when a friend cheers you on or challenges you to a duel, when a referral you made pays out, when your streak is about to lapse, when another player starts searching the Arena while you are waiting in it, if you run a guild, when someone applies to join, and, on iPhone, once when the App Store tells us a payment for your membership did not go through. Hall chat sends no notifications. If a different account later signs in on the same phone, the token moves to that account. When Apple or Google tells us a token no longer works, we delete it. You can turn notifications off at any time in your phone's settings.

The Solana dApp Store edition uses push notifications the same way, through Google, on phones that have Google Play services; on a phone without them it cannot receive push notifications and no push token is created. The first Seeker build sent to the dApp Store used no push notifications at all. The Seeker edition also sets one reminder on your phone itself, two days before a pass paid in SOL ends.

Install measurement

The iPhone app includes Singular for install attribution and product analytics. (Versions of the iPhone app before 2.6.2 used AppsFlyer for the same purpose, and keep sending it the same kinds of events until they are updated.) The Android app contains no Singular and no other install-attribution service. It is not limited to aggregate counts, and we would rather describe it accurately than reassure you: alongside Apple’s SKAdNetwork, the app sends Singular an event stream tied to your account:

With these, Singular’s software sends what it reads from your phone: Apple’s identifier for this app on your device (the IDFV, which is not the advertising ID), an identifier Singular makes for this installation, your device model and iOS version, the IP address and browser-style “user agent” of the connection, and Apple’s ad-attribution token (from which Apple tells Singular whether you came from an Apple Ads campaign). Your Pushup RPG account id is passed to Singular as the customer identifier, so those events are linked to your account rather than being anonymous.

To tell which campaigns paid for themselves, RevenueCat (below) also sends Singular your trial starts, purchases, renewals and refunds with their amounts, matched by Singular’s identifier for this installation. The amounts come only from RevenueCat; the app itself sends Singular none.

We also use RevenueCat, on iPhone and in the Google Play edition, to manage subscriptions and entitlements. It receives your account id and your purchase and subscription history, and our server asks it whether your account has an active membership.

When Apple or Google reports that a payment for your membership failed, RevenueCat tells our server, and we keep a record of it against your account: when it happened, which store and plan, until when your access lasts, whether we sent you a notification about it, and how it ended (the payment went through, or the access ended). The record is deleted when you delete your account.

What we can still tell you plainly: the app never shows an App Tracking Transparency prompt and does not use the ATT advertising identifier, the Android app does not use Google’s advertising ID either, and there are no ad-serving SDKs — you will not see ads in Pushup RPG. We do not sell your data. Singular is nonetheless an attribution vendor with its own tracking capabilities, so if that matters to you, treat this as a real third-party disclosure rather than a formality.

Creator codes

Some players come to Pushup RPG from a creator who makes videos about training. If you enter a creator’s code in the app, we record which creator referred your account, and we attach the code to your purchase record at RevenueCat (as an attribute called creator_code) so the creator can be paid a share of what we receive from your purchases. Entering a code is optional, it does not change any price, and it can be done once, within your first 7 days. A code can be entered on iPhone only, from version 2.6.2; the Android app does not offer this yet.

Creators see only counts and earnings, never who you are. A creator’s dashboard shows how many accounts entered their code, how many started a trial or paid, and what they earned each month. It shows no name, account, email or individual purchase.

If you apply to be a creator on this website, we keep what you send us (your name, social handles, audience size, country, payout email, the code you asked for, and the note, if you added one) to review your application and, if you are approved, to run your page and pay you. Your IP address is used to limit repeated applications and is kept only as a one-way scrambled value, for 2 days. An application we turn down is deleted after 180 days. An approved creator’s details are kept while they are in the programme, and after it ends for as long as we need them to settle earnings and for tax and accounting records. The code stays reserved so no one else can take it.

Friends

Adding a friend is mutual and is done by exchanging friend codes. A friend code only resolves to a profile when entered exactly — profiles cannot be browsed or listed. Removing a friend removes the connection for both people and revokes their access to your profile.

What a friend can see. The app on a friend’s phone receives your whole profile: your display name, friend code, class, level, portrait (and your avatar photo, if you uploaded one), the flag you picked, whether you are a Vigil member, the name of your guild, your current streak, and your push-up and squat counts for today, for this week and in total since you started. Their friends board shows your counts for today and this week, and your lifetime totals. Anyone who enters your friend code to look you up receives the same profile, before you are friends. It also carries some things the app does not display: your country code (see Your country), when your profile was last updated (which is roughly when you last played), and a few technical values, such as the ones our server uses to check your totals. Someone you have blocked, or who has blocked you, cannot find you by your code.

Guilds

You can join a guild — a small team that shares a weekly goal — or, with a Vigil membership, create one. This makes some information visible more widely than Friends:

Hall chat (iPhone, from version 2.6.3)

The members of a guild can write to each other in its hall. We switch hall chat on from our server, so it may appear some time after you update, and in some guilds before others. While it is on:

Hall moments. The chat also shows short lines our server writes on its own about what the guild’s members do, so that a quiet hall still has news. They are built from records we already hold; nothing new is collected.

Deleting your account deletes your messages, the moments about you, your read position, your milestones setting and those notes at once. Two things stay: the copy of a message of yours that someone reported, until the report is decided (at most 90 days), and a chat ban, as above.

Your country

Country leaderboards need to know which country you belong to. Two separate things do that, and only one of them involves your IP address. (The Solana dApp Store edition uses it once more, briefly and hashed, to stop scripted sign-ups; see Solana wallet.)

Live duels and the Arena

You can duel a friend, or enter the Arena and be matched with another player you have not met. There is no chat and no messaging in a duel — two cameras and a timer.

Data we share

We do not sell or share your data with advertisers or data brokers. Your profile is shared with the friends you add and the members of any guild you join, and a guild name or motto you create, and an avatar photo you upload, are public to other players. Your hall chat messages and the hall moments about you are shown to the members of your guild (see Hall chat). Be aware it also goes wider than that: if you rank on the worldwide daily or weekly rep ladders, on your country's ladder, or on the Endless Descent board, your display name, class, level and the ranked figure are visible to every signed-in player — together with the flag you picked, if you picked one. Entering the Arena shows your display name, class, level and portrait to the player you are matched with; see Your country and Live duels and the Arena above. Three processors handle data on our behalf: Supabase (hosting, accounts and cloud saves), RevenueCat (subscriptions and entitlements — it receives your account id and purchase history), and Singular (install attribution and product analytics, on iPhone only — see Install measurement above for what it receives; iPhone versions before 2.6.2 used AppsFlyer instead). The Solana dApp Store edition includes neither RevenueCat nor Singular. When you pay in SOL there, the app and our server send your wallet address and the transaction signature to a Solana RPC node to confirm the payment; see Solana wallet. On Android, Google’s ML Kit sends Google usage and diagnostic information about itself; see Google ML Kit.

Statistics we publish

We may publish figures calculated across many players, such as the total number of push-ups counted in the app, or how players in different countries compare. A published figure never includes your name, your account or anything else that identifies you, and we do not publish a figure about any group of fewer than 30 players, because a figure drawn from that few people can amount to one person's result. This is separate from the leaderboards, which do show individual players, as described under Data we share above.

Who is responsible for your data

Pushup RPG is made by Yerasyl Amanbek, who is the data controller for the information described on this page. The contact address is support@pushup.quest, or use the contact page and put Privacy in the subject.

Your rights over your data

If you are in the UK or the EEA, data protection law gives you the rights below. We apply them to everyone, wherever you live, because splitting them by country would be more work than honouring them.

We will not charge you for any of this and will not make you justify the request.

Why we are allowed to process it

How long we keep it

Where your data goes

The processors we use are named under Data we share: Supabase for accounts and cloud saves, RevenueCat for subscriptions and entitlements, and Singular for install measurement (AppsFlyer for iPhone versions before 2.6.2). Apple and Google hold your purchase records because they take the payment. A payment in SOL is recorded on the Solana blockchain, which is public and outside our control.

These are international services, so your data may be processed outside the country you live in, including outside the UK and the EEA. Each of them publishes its own data-processing terms and transfer safeguards, which are linked from their own sites.

Deleting your data

You can delete your account at any time from Settings → Account → Delete account. That removes your profile, cloud save, avatar photo, leaderboard entries, friend connections, duel results, and your hall chat messages and the hall moments about you from our servers (what an opponent’s own saved game can still hold is described under Live duels and the Arena). A few things survive by necessity — a one-way referral hash, purchase and entitlement records held for accounting, the creator records described under Creator codes (a creator’s count of the accounts that entered their code, their earning lines and the store transaction numbers behind them, with no player id), any anti-abuse record (a hall chat ban among them), and, until its report is decided (at most 90 days), the copy of a chat message of yours that someone reported — and records held by Apple, Google Play, RevenueCat, Singular and AppsFlyer are not ours to delete. The deletion page lists each one and how to reach those providers. Uninstalling the app removes the local copy on your device.

In the Solana dApp Store edition, deleting your account also removes your wallet link and your pass. We keep each redeemed payment’s transaction signature, amount, plan and time, and the wallet sign-in records described under Solana wallet, with no link to any account, only so that the same payment or sign-in can never be used twice. Transactions on the Solana blockchain cannot be deleted by anyone, including us.

Children

The app is designed for general audiences. Account creation (and therefore the social features) is intended for users able to consent under their local law; younger players can use the app fully in guest mode.

Android beta waitlist (closed)

Pushup RPG is now released on Google Play, so the Android beta waitlist is closed and we are no longer collecting emails for it. If you signed up while it was open, we stored only your email address in order to send you a single notification, and it was never used for anything else, sold, or shared. You can have it deleted at any time by emailing support@pushup.quest.

Website analytics

This website uses privacy-friendly, cookieless analytics (Vercel Web Analytics) that count aggregate page views. It sets no cookies and builds no advertising profile.

Advertising measurement on this website

If we are running ads, we need some way to tell which ones actually bring people here. We ask first. When advertising measurement is switched on you will see a banner offering Accept or Decline, and nothing is set until you choose Accept. Declining costs you nothing: every page works identically either way.

If you accept, we load tags from Google Ads and Meta. These are ordinary advertising trackers and we would rather say so plainly than call them something softer: they set cookies, they can recognise you on other websites that use the same networks, and they let us see that someone who clicked an ad went on to open the App Store link. They do not receive your name, your email, your account, or anything you do inside the app.

Your choice is remembered in your browser, not on our servers, and it applies until you clear your browser storage. To change it, clear site data for pushup.quest and the banner returns. If you never see a banner, no advertising tag has been loaded at all.

None of this applies to the app. Advertising measurement described here is a website matter only. What the app collects is described above, under Install measurement.

Contact

Questions or data requests: support@pushup.quest