Privacy Policy

Last updated: October 6, 2026

Pushup RPG is built to respect your privacy. This policy explains exactly what the app does and does not do with your data.

Android and iPhone. This policy covers both apps. Most of it applies to both, and where they differ, the section says so. On Android, in both the Google Play and the Solana dApp Store editions: pose detection runs on your phone using Google’s ML Kit, which sends Google usage metrics about itself (see Google ML Kit); the app never asks for your microphone, your location or your contacts; it does not use the advertising ID; it contains no AppsFlyer and no health-platform integration; and two kinds of report name your phone’s make and model where the iPhone reports do not, as Diagnostics you choose to send and Automatic error reports below explain. Questions about what applies on your phone: support@pushup.quest.

Camera

The app uses your device camera to count pushups, squats, sit-ups, pull-ups and dips by detecting your body pose, and to time your plank the same way. All processing happens on-device, in real time. Pose detection never records, stores, or transmits video, images, or pose data off your device. Unless you turn on clip recording (below), the camera feed exists only in memory while a battle is active and is discarded immediately. Camera data is never uploaded to our servers or anywhere else.

Google ML Kit (Android)

On Android, in both the Google Play edition and the Solana dApp Store edition, pose detection is done by Google’s ML Kit. It runs on your phone, and it sends Google information about how ML Kit itself is performing. Google’s disclosure for ML Kit lists what that is: your device’s manufacturer, model and operating system version; the app’s package name and version; a per-installation identifier that Google says is not intended to identify you; how long processing took; the format and resolution of the images ML Kit was given, and the size of what went in and came out; and event types and error codes. Camera images are not on that list, so what the Camera section says about video, images and pose data holds on Android too. Google states the data is used for diagnostics and usage analytics, is not linked to your identity, is not shared with third parties, and is encrypted in transit. The app also contains Firebase Installations and Firebase Remote Config, which ML Kit relies on and which exchange an installation identifier with Google. The iPhone app does not include ML Kit: it detects your pose with Apple’s Vision framework, on the device.

Clips (optional, off by default)

If you turn on Record clips in Settings, the app records your battle or practice screen — the camera view plus the game overlays — into a video clip stored only on your device. On iPhone, iOS asks for your explicit confirmation before each session's first recording, and a REC indicator is visible whenever recording is active. On Android, recording uses Android’s own screen-capture prompt, which the system shows before recording starts, and a clip goes into your gallery (under Movies) only when you tap Save clip to your gallery.

• Clips never leave your device unless you choose to share them (on iPhone, via the iOS share sheet) or save them to your Photos library.
• We never receive, upload, or process your clips — there is no server involved.
• Recording stops automatically after 3 minutes, and you can stop it any time by tapping the REC indicator.
• Unshared clips are kept temporarily on-device and cleaned up automatically.

Microphone (your choice, per the system's own prompt)

When a recording starts, iOS's own consent sheet lets you choose Record Screen and Microphone or Record Screen Only. If you allow the microphone, your clips include audio from the device microphone (your voice and the surrounding room) so shared videos carry the real moment. Like the video, this audio is recorded only on your device, only while you record, and is never uploaded to us. If you pick Screen Only, clips include only the game's own sound effects.

The Android app has no microphone permission, so it never records sound from your microphone.

Photos

Two separate things, and neither gives the app the run of your library.

• Saving a clip (via Save Video on the iOS share sheet, on iPhone) uses add-only access.
• On Android, saving a clip to your gallery needs no photo-library permission, and the app has none.
• Choosing an avatar photo (a Vigil perk — see Your avatar photo below) opens Apple's own photo picker, which runs outside the app (on Android, the system’s own photo picker, which works the same way). We receive only the single image you pick; the app cannot see, browse, or search the rest of your library, and it never asks for photo-library permission.

Your avatar photo (Vigil members, optional)

With a Vigil membership you can use your own photo as your portrait instead of one of our painted ones. Because this is the one thing in the app you upload, here is exactly what happens to it.

• The image is cropped and shrunk on your device before it leaves — we never receive the full-resolution original.
• Before upload, the device screens it on-device for explicit content — on iPhone this is Apple's own analyser. This uses Apple's own analyser and, like everything else in the camera path, the picture is not sent anywhere to be checked.
• It is then stored on our servers, attached to your account.
• It is public. Your avatar is shown to other players wherever your name appears — your guild roster, the friends list, the worldwide leaderboards, duels. Anyone who can see your name can see your face. Please only upload a photo you are happy for strangers to see, and only one you have the right to use — do not upload a picture of someone else without their agreement.
• You can remove it whenever you like, from the same portrait picker you chose it in. Removing it takes it off every screen in the app immediately.
• It is deleted when you delete your account.
• Other players can report your avatar, and we can remove it — see Content moderation below.

Diagnostics you choose to send

If the camera is miscounting your reps, Settings → Reps not counting? lets you send us what the detector decided. The screen shows you the exact lines before anything is sent, and nothing goes anywhere unless you tap send. It contains the detector's own measurements — joint angles, timings, the reason each rep was accepted or refused — plus your app version, attached to your account so we can follow up. On iPhone it does not include your device model. On Android, the report’s first line names your phone’s manufacturer and model and its Android version, because the pose detector behaves differently from one phone to another.

No video, no images, and no photographs of you are ever included in that report — the camera feed never leaves your device, as described under Camera above.

The app also keeps a small tally of why reps were refused (for example "too shallow"), which rides along in your cloud save and helps us see which failures are common.

Automatic camera-session diagnostics. Separately from the report above, and without asking you each time, the app sends us a short summary at the end of every camera session: how long the camera ran, how many reps were counted, how many were refused, how many attempts ended as neither (a rep abandoned halfway, for example), the most common refusal reason as a code, a code for how far the detector got if it never managed to start counting, which screen and which movement you were doing, for push-ups (iPhone, from version 2.5.10) a code for roughly where the phone stood — at your side, at an angle, or in front of you — which the app works out on your phone from how wide your shoulders look compared with how long your torso looks, whether you were on iPhone or Android, your device’s performance tier and the app build. These are numbers and codes only. They are linked to your account, batched, and sent once per session. No video, no images and no joint coordinates are included, and as everywhere else on this page the camera feed itself never leaves your device. We use this to find detection failures we would otherwise only hear about from the few people who write in. Summaries are kept for about a week, then deleted.

The shape of the camera picture (iPhone, from version 2.5.10). Beside that summary the app sends one more short record about the picture the counter received: its proportions as a number, whether it was taller than it is wide or wider than tall, how many degrees the app turned it, and where that turn came from — your device’s own reading, a reading from an earlier session, your camera-angle setting, or the app’s default — with the same screen and movement, how long the camera ran (so the two records can be matched), whether you were on iPhone or Android, your device’s performance tier and the app build. It contains no image. A picture lying on its side makes counting less accurate, and this is how we find out how often that happens (on iPads standing in a keyboard case, for example). Like the summary it is linked to your account and kept for about a week; after that only daily totals with no account attached remain.

Automatic usage events. Also without asking you each time, the app records a handful of other moments in the same way, as numbers and codes linked to your account:

• Opening the app: how long since you last opened it and since you installed it, and a rough band for your lifetime reps.
• Finishing onboarding: how long it took and which steps you saw.
• Your first counted rep: how long after you installed the app it came.
• A membership screen closing: how long it was open, which screen and which version of it, what opened it, which price tiers it showed, and whether you closed it, started a trial or bought.
• Being refused a place in a guild: the reason, such as the guild being full or you being below its minimum level.
• Battle clips, only if you turned clip recording on: how many seconds of clip were captured, how long the camera ran, which screen you were on, how the recording ended, and whether you went on to share it.
• Your difficulty baseline changing: the old and new value, and whether onboarding, Settings or a suggestion in the app changed it.
• Accepting the offer to count knee push-ups: how many reps had counted by then, what prompted the offer, and which screen you were on.
• Reps paying out: each time a set, wave, floor or duel bout is credited, where it happened (training, a fight, a duel), how many reps it credited, how many of them earned rewards, and why a set earned less (for example a replayed fight, or reps past the daily reward limit).
• Sharing a result that is not a clip (today, a duel result card): the movement, whether you won, lost or drew, whether the caption carried your duel invite link, and whether the share was opened or completed.
• Starting a New Game+ cycle: which cycle and your hero’s level at the time.
• Waiting for an Arena opponent: each step of the offer to be notified when a rival appears (shown, tapped, notifications declined, watch set, woken by the notification), how long you had waited, how many others were searching and which movement.
• Claiming a weekly leaderboard trophy: the week, your shared rank on the board, the gems it paid, its tier and which board (push-ups or squats).
• Finishing a fight (iPhone, from version 2.5.9): whether the foe fell, the clock (from version 2.5.10, sometimes your hearts) ran out or you left, how long the fight lasted, the time left on its clock, the reps you did in it, how much of the foe’s health was left, the wave or Descent floor, and whether it was a boss fight, a timed fight and one showing the foe’s attacks (from version 2.5.10, one fought with hearts).
• A timed part of a fight ending (iPhone, from version 2.5.10): whether the foe fell, your hearts or the clock ran out, or you left; the movement; whether it was a timed fight, a timed wave or a boss’s final onslaught; whether it ran past the old time limit; and, when it was fought with hearts, how many you started with and lost, how many of the foe’s attacks you blocked, how many hearts were saved by attempts the camera did not count as reps, and how many hearts you lost while the camera could not see you.

Each event also carries your device’s performance tier, the app build and whether you are on iPhone or Android. None of it includes video, images or anything you typed. This is our own record, kept on our servers, and it is separate from what AppsFlyer receives, which is described under Install measurement below. We use it to see which parts of the app work and where people give up. Usage events are deleted after about a week, and after that only daily totals with no account attached remain.

Automatic crash and freeze reports (iPhone, from version 2.5.10). When the iPhone app crashes, freezes, or is closed by iOS (for example for using too much memory), iOS can give the app a short report about it the next time you open it. iOS also gives the app a daily count of how it closed, on ordinary days too. The app sends us a few numbers from these reports, without asking you each time:

• For a crash or a freeze: whether it was a crash or a freeze, the app build it happened in, codes for the kind of error (for example “invalid memory access” or “stopped for not responding”), how long a freeze lasted, and where in our own program it happened, as a position in the app’s program file.
• Once a day, whether or not anything went wrong: how many times the app closed normally, ran out of memory, crashed, or was stopped for not responding, counted separately for while it was on screen and while it was in the background, and in which app build. For the background, also how many times iOS closed it for holding on to a file while it was paused, or for running a background task for too long.

Nothing else from these reports is sent: not your device model, not your iOS version, not your region, no error message text and nothing from the app’s memory. Like the usage events, these are numbers and codes linked to your account, with your device’s performance tier, the app build and whether you are on iPhone or Android. We use them only to find and fix crashes. They are deleted after about a week, or straight away if you delete your account; after that only daily totals with no account attached remain. The full report stays on your iPhone.

When we ask you how many you actually did. Every so often, after a session in which the camera ran for at least 40 seconds, the app shows how many reps it counted and asks whether that is right. If you say no, it asks how many you actually did. It asks at most once a day on each device, and whether it asks has nothing to do with how the set went. If you answer, we store the number the camera credited, your answer (the same number, if you said it was right), how many reps it refused, how long the camera was running, which movement it was and which screen you were on, along with your app version, attached to your account. For push-ups we also store two measurements of how you appeared in the frame, the width of your shoulders and the length of your torso as a share of the picture, which show roughly how the phone was placed. That is the whole record: no video, no images, no joint coordinates, no free text, and nothing you typed beyond the number. Answering is optional and skipping it changes nothing. We use it to measure how often the detector disagrees with the person actually doing the reps, which is the one thing the camera cannot tell us by itself.

Automatic error reports. Also without asking you first, the app records a short note when something fails in a way it recovered from quietly, such as a camera session that was interrupted or a save that had to be retried. Each note is a short label for what happened, a technical detail such as an error code, your app version and your account, and at most one of each kind is recorded per hour. On Android, when the camera itself fails, the note also names your phone’s manufacturer and model and its Android version, because camera faults depend on the hardware. Our servers write a note of the same shape in three situations, and those carry more: renaming a guild you captain records the old and new names, so a moderation takedown has a trail; a day's reps going past the leaderboard cap records that day's count and your lifetime total; and a friend addition that trips our flood or consent checks records both players' account identifiers, on the account that made the addition. These notes contain no video, no images and no location. Each is deleted when the account it is recorded on is deleted.

Apple Health (iPhone only, optional)

Only pushup and squat sessions are written to Apple Health — sit-ups and planks are not, and nothing about them reaches Health at all. If you turn on Sync to Apple Health in Settings, Pushup RPG saves your battles and practice sessions to Apple Health as workouts (with an estimated active-energy value and your rep count) so they count toward your Activity rings. This is opt-in and write-only: we only add workouts to your Health data — we never read any of your health information, it never leaves your device to our servers, and we never sell it, use it for advertising, or share it. You can turn this off anytime in Settings, and manage or delete the data in the Health app.

Accounts and cloud sync

To back up your progress across devices and to power the friends leaderboard, the app uses a cloud account (provided by Supabase). You can sign in with:

• Sign in with Apple, Google, or email (a one-time code / magic link),
• a Solana wallet, in the Solana dApp Store edition. See Solana wallet below. Or
• Continue as a guest — an anonymous account is created so your save still backs up, with no name or email attached.

Sign in with Apple is available on iPhone only, and Google sign-in on iPhone and in the Google Play edition.

What we store on your account:

• Game progress — level, XP, streak, gear, currencies, settings, lifetime reps.
• Profile — the display name you choose, a randomly generated friend code, your level, class, current streak, and weekly rep total. This profile is visible to friends you add and to the members of any guild you join — see Guilds below.
• Contact identifier — if you sign in with email, your email address; with Apple or Google, the identifier they return. Used only to authenticate your account.
• A push token, so the app can send you notifications. See Notifications below.
• Your Solana wallet address and payments in SOL, in the Solana dApp Store edition. See Solana wallet below.
• Your avatar photo, if you are a Vigil member and chose to upload one. See Your avatar photo above — it is public to other players.
• Detection diagnostics, if you sent a report. See Diagnostics you choose to send.

We do not collect contacts, and no health/fitness data beyond the rep counts that are part of your game progress. The app never asks for GPS or precise location, and there is no location permission prompt. There is one coarse exception, and we would rather name it than bury it: your country is derived on our server from the IP address your device connects from, so that country leaderboards can exist. Your country below explains exactly what is stored and what it is used for.

Solana wallet (Solana dApp Store edition)

The edition of Pushup RPG sold in the Solana dApp Store lets you sign in with a Solana wallet and pay for Vigil in SOL. If you use either:

• Your wallet’s public address is stored on our servers, linked to your account, so the same wallet always returns to the same account and a payment can be matched to the player who made it.
• An account made from a wallet. If you have no account yet, signing in with a wallet creates one. Inside our system it is identified by an address at wallet.pushup.quest derived from your wallet’s public key. No mailbox exists behind it, and we never send mail to it.
• For each payment in SOL, we store its transaction signature, the amount, the plan and when we redeemed it, so that we can grant and restore your membership.
• To sign in, you sign a one-time message in your wallet app. We check the signature, then keep a hash of that message together with the wallet address and the time, so the same message can never be used to sign in again.
• Stopping scripted sign-ups. Anyone can create Solana wallets for free, so to stop a script from making unlimited accounts, our server keeps a one-way hash of the internet address a wallet sign-in came from, salted with a secret only our server holds, and counts how many accounts that hash has created. It cannot be turned back into an address, it is never stored on your profile, and it is deleted after 24 hours.
• We never receive your private key or your recovery phrase. Your wallet app does all the signing, so the app cannot move funds on its own.
• Payments are public. Anyone can see a transfer on the Solana blockchain, including one between your wallet address and ours. We do not publish which account a wallet belongs to.
• Confirming a payment. To check that a payment landed, the app and our server look it up on the Solana network through an RPC node, a server that answers questions about transactions. It receives your wallet address and the transaction signature. We read nothing else from your wallet’s history.

This edition includes neither RevenueCat nor AppsFlyer. It uses push notifications the same way as the Google Play edition (see Notifications).

Google ML Kit. Like the Google Play edition, this edition includes Google’s ML Kit; see Google ML Kit.

Notifications

To send you notifications, the app needs a push token: an identifier that Apple (on iPhone) or Google (on Android) issues so that a notification can reach the app on your phone. The app stores it on our servers against your account, a guest account included, together with which platform it came from, when it was last registered and, from recent versions of the iPhone app, the app version. On iPhone, the app only asks Apple for a token after you have allowed notifications.

We use it to tell you when a friend cheers you on or challenges you to a duel, when a referral you made pays out, when your streak is about to lapse, when another player starts searching the Arena while you are waiting in it, and, if you run a guild, when someone applies to join. If a different account later signs in on the same phone, the token moves to that account. When Apple or Google tells us a token no longer works, we delete it. You can turn notifications off at any time in your phone's settings.

The Solana dApp Store edition uses push notifications the same way, through Google, on phones that have Google Play services; on a phone without them it cannot receive push notifications and no push token is created. The first Seeker build sent to the dApp Store used no push notifications at all. The Seeker edition also sets one reminder on your phone itself, two days before a pass paid in SOL ends.

Install measurement

The iPhone app includes AppsFlyer for install attribution and product analytics; the Android app contains no AppsFlyer and no other install-attribution service. It is not limited to aggregate counts, and we would rather describe it accurately than reassure you: alongside Apple’s SKAdNetwork on iPhone, the app sends AppsFlyer an event stream tied to your account — app opens and activation, onboarding steps (including whether you allowed notifications and camera access), paywall views and dismissals, trial starts, level milestones, and completed purchases with the amount, currency, product and Apple transaction id. Your Pushup RPG account id is passed to AppsFlyer as the customer identifier, so those events are linked to your account rather than being anonymous.

We also use RevenueCat, on iPhone and in the Google Play edition, to manage subscriptions and entitlements. It receives your account id and your purchase and subscription history, and our server asks it whether your account has an active membership.

What we can still tell you plainly: the app never shows an App Tracking Transparency prompt and does not use the ATT advertising identifier, the Android app does not use Google’s advertising ID either, and there are no ad-serving SDKs — you will not see ads in Pushup RPG. We do not sell your data. AppsFlyer is nonetheless an attribution vendor with its own tracking capabilities, so if that matters to you, treat this as a real third-party disclosure rather than a formality.

Friends

Adding a friend is mutual and is done by exchanging friend codes. A friend code only resolves to a profile when entered exactly — profiles cannot be browsed or listed. Removing a friend removes the connection for both people and revokes their access to your profile.

Guilds

You can join a guild — a small team that shares a weekly goal — or, with a Vigil membership, create one. This makes some information visible more widely than Friends:

• Your profile (display name, class, level, streak, weekly reps) is visible to the other members of any guild you join, who may not be your friends.
• A guild name and motto you create, and the guild names shown in the public browse directory, are visible to all players and may appear on images you choose to share.
• The hall log (iPhone, from version 2.5.9). The members of your guild see a log of the past week in the hall: your push-up and squat total for the week, when you joined, when you landed the blow that felled the weekly boss, when you cheer another member, and whom, and each gift of gold you give to the hall, with its amount (until now only the hall’s totals and your own share were shown). Only current members appear in it, only for what they did after joining — a cheer appears only if both of you were already members — and someone you have blocked, or who has blocked you, is left out of your log. Nothing new is collected: the log is built from records the guild already held, and it cannot be seen from outside the guild. A guild’s level, which rises with the gold its members give, is shown to all players on the guild ladders.
• Content moderation. Guild names/mottos, display names and avatar photos are all content players create. Names are filtered against a blocklist, and avatar photos are screened on-device before upload by Apple's analyser, which catches sexually explicit imagery — other objectionable content, including a photo of someone who did not consent, is caught by the report path rather than the filter. You can report an offensive name or picture from inside the app — the ⋯ button beside any player, on every screen that shows one. We review reports and remove violating content, and may remove an offending account's ability to upload a picture at all — there is zero tolerance for objectionable content.

Your country

Country leaderboards need to know which country you belong to. Two separate things do that, and only one of them involves your IP address. (The Solana dApp Store edition uses it once more, briefly and hashed, to stop scripted sign-ups; see Solana wallet.)

• A country code we derive (not chosen by you). When your profile is written, our server reads the two-letter country code that our network provider attaches to the request — a value derived from the IP address your device is connecting from — and stores that code on your profile. Your IP address itself is not stored on your profile; only the two-letter country code. (Every internet service processes IP addresses in order to route traffic at all, and our hosting providers are no exception.)
• It is recorded once and never updated. The first value seen is kept, and later connections do not move it. That is deliberate: re-reading it on every write would turn a single coarse attribute into a running record of where you have been, and we did not want to hold that. The practical consequence is that it reflects where you were when you first played — a VPN, a trip or a move will not change it, and you cannot edit it. It is deleted with your account.
• Where it is used. It decides which country's leaderboard you appear on, and it can be counted in country-level figures we publish, which never identify you (see Statistics we publish). If your country cannot be determined — including connections our provider reports as unknown, and traffic arriving over Tor — nothing is stored, and you simply do not appear on a country board.
• A flag you pick (optional). Separately, you can choose a flag in the app. That one is your choice, it is shown publicly next to your name, and you can change or clear it whenever you like. We suggest a likely country when you open the picker, but nothing is saved unless you tap it.

Live duels and the Arena

You can duel a friend, or enter the Arena and be matched with another player you have not met. There is no chat and no messaging in a duel — two cameras and a timer.

• While you are searching, we hold a short-lived queue entry with your account id, your level and which exercise you picked, so the matchmaker can pair you with someone at a similar level. It is removed the moment a match is made, and it is ignored after 90 seconds.
• During a bout, your opponent sees your display name, class, level, your portrait or avatar, and your rep count as it climbs. They do not see your camera: pose detection stays on your device, and only the number of reps is sent. Nothing about your opponent's video reaches you either.
• Blocking. You can block a player from the result card. We store that as a pair of account ids and the time it was made, and it stops the two of you being matched again. You can undo a block you made, from Settings — you cannot remove someone else's block on you, which is the point of the feature.
• Reporting. Reporting a player sends their account id and your reason to our moderation queue, along with context we use to judge the report — their level, lifetime reps, best day, and how deep they have gone in Endless Descent. See Content moderation above for how reports are handled.
• Recording a bout is optional and off by default. A clip stays on your device until you choose to share it. See Clips above.
• What we keep after a duel. For each duel against another player we keep both scores, the exercise, when it ended, who the two players were, and whether it was an Arena match or a duel between friends.
• Your duel record (iPhone, from version 2.5.11). We use those results to match you in the Arena with players of a similar level and to show you your own duel record: how many Arena duels you have won, lost and drawn, and your latest twenty, with each opponent’s display name beside the score. Your opponent sees the same about you. Nobody else can see your record. The app keeps a copy of your own record on your phone so it can be shown before the server answers; that copy is removed when you sign out or delete your account.
• How long duel results are kept. Until you delete your account. Deleting it removes your results, and the record we keep for your opponents then shows the score of their duels against you without your name. A duel from the last few days is removed for both of you.
• One copy is not removed. Every player’s saved game, on their phone and in their cloud save, lists their own last twenty duels of any kind, each with the opponent’s display name as it was at the time (its first 16 characters) and the score. An opponent’s saved game can therefore still hold the name you had, until twenty newer duels of theirs replace it. Other versions of the app show that list as the duel history.

Data we share

We do not sell or share your data with advertisers or data brokers. Your profile is shared with the friends you add and the members of any guild you join, and a guild name or motto you create, and an avatar photo you upload, are public to other players. Be aware it also goes wider than that: if you rank on the worldwide daily or weekly rep ladders, on your country's ladder, or on the Endless Descent board, your display name, class, level and the ranked figure are visible to every signed-in player — together with the flag you picked, if you picked one. Entering the Arena shows your display name, class, level and portrait to the player you are matched with; see Your country and Live duels and the Arena above. Three processors handle data on our behalf: Supabase (hosting, accounts and cloud saves), RevenueCat (subscriptions and entitlements — it receives your account id and purchase history), and AppsFlyer (install attribution and product analytics, on iPhone only — see Install measurement above for what it receives). The Solana dApp Store edition includes neither RevenueCat nor AppsFlyer. When you pay in SOL there, the app and our server send your wallet address and the transaction signature to a Solana RPC node to confirm the payment; see Solana wallet. On Android, Google’s ML Kit sends Google usage and diagnostic information about itself; see Google ML Kit.

Statistics we publish

We may publish figures calculated across many players, such as the total number of push-ups counted in the app, or how players in different countries compare. A published figure never includes your name, your account or anything else that identifies you, and we do not publish a figure about any group of fewer than 30 players, because a figure drawn from that few people can amount to one person's result. This is separate from the leaderboards, which do show individual players, as described under Data we share above.

Who is responsible for your data

Pushup RPG is made by Yerasyl Amanbek, who is the data controller for the information described on this page. The contact address is support@pushup.quest, or use the contact page and put Privacy in the subject.

Your rights over your data

If you are in the UK or the EEA, data protection law gives you the rights below. We apply them to everyone, wherever you live, because splitting them by country would be more work than honouring them.

• Access. Ask what we hold about you and we will send it.
• Rectification. Correct anything wrong. Your display name and flag you can change yourself in the app.
• Erasure. Delete your account from Settings → Delete account, or ask us. Read Deleting your data below first, because a few records survive and we would rather you knew which.
• Portability. Ask for a copy of your account data in a machine-readable format.
• Objection and restriction. Object to, or ask us to pause, processing that rests on our legitimate interests.
• Withdrawing consent. Where something is optional and you turned it on, you can turn it off: clip recording, the avatar photo, sending a detector report, and Apple Health.
• Complaint. You can complain to your national data protection authority. In the UK that is the ICO; in the EEA it is your country's supervisory authority. We would rather you told us first, but you do not have to.

We will not charge you for any of this and will not make you justify the request.

Why we are allowed to process it

• Running your account, syncing progress, friends, guilds, duels and leaderboards — performance of the contract you enter when you create an account and play.
• Deriving your country from the connecting IP address — legitimate interests, so that country leaderboards can exist. The IP itself is not stored on your profile.
• Install measurement and product analytics — legitimate interests in understanding which channels bring players and which features get used.
• Including Google’s ML Kit in the Android app — legitimate interests in counting reps with an on-device pose detector. The usage metrics it sends go to Google, as described under Google ML Kit.
• Automatic usage events, camera-session summaries, crash and freeze reports and error reports — legitimate interests in finding what is broken and which parts of the app work.
• Purchases, entitlements and accounting records — performance of the contract, and our legal obligation to keep records of sales.
• Push tokens and notifications — legitimate interests in reaching you about your game, such as a friend's challenge or a streak about to lapse. You can turn notifications off in your phone's settings.
• Statistics published across many players — legitimate interests in reporting what players achieve, limited as described under Statistics we publish.
• Security, anti-abuse and moderation — legitimate interests in keeping the boards honest and players safe.
• Keeping SOL payment and wallet sign-in records after an account is deleted — legitimate interests in making sure the same payment or sign-in can never be used twice.
• Counting wallet sign-ups per hashed internet address — legitimate interests in stopping scripts from creating accounts without limit.
• Clip recording, the avatar photo, detector reports and Apple Health — your consent, given by turning each one on, and withdrawable by turning it off.

How long we keep it

• Your account and game data — until you delete the account. We do not expire accounts for inactivity.
• Detector reports you send — kept while we investigate the counting problem they describe, then deleted.
• Usage events, camera-session summaries and crash and freeze reports — about a week, then deleted. Only daily totals with no account attached are kept after that.
• Purchase and entitlement records — kept after deletion for as long as accounting and tax rules require.
• The referral anti-abuse hash — kept after deletion by design, because its whole purpose is to stop the same device claiming a referral repeatedly. It is one-way and cannot be turned back into a device or an account.
• SOL payment and wallet sign-in records (Solana dApp Store edition) — kept after deletion, with no link to your account, because their only purpose is to stop the same payment being redeemed twice or the same sign-in being replayed. The payments themselves stay on the Solana blockchain, where nobody can delete them.
• Hashed internet addresses from wallet sign-ins (Solana dApp Store edition) — deleted after 24 hours. They are never linked to an account.

Where your data goes

The processors we use are named under Data we share: Supabase for accounts and cloud saves, RevenueCat for subscriptions and entitlements, and AppsFlyer for install measurement. Apple and Google hold your purchase records because they take the payment. A payment in SOL is recorded on the Solana blockchain, which is public and outside our control.

These are international services, so your data may be processed outside the country you live in, including outside the UK and the EEA. Each of them publishes its own data-processing terms and transfer safeguards, which are linked from their own sites.

Deleting your data

You can delete your account at any time from Settings → Account → Delete account. That removes your profile, cloud save, avatar photo, leaderboard entries, friend connections and duel results from our servers (what an opponent’s own saved game can still hold is described under Live duels and the Arena). A few things survive by necessity — a one-way referral hash, purchase and entitlement records held for accounting, and any anti-abuse record — and records held by Apple, Google Play, RevenueCat and AppsFlyer are not ours to delete. The deletion page lists each one and how to reach those providers. Uninstalling the app removes the local copy on your device.

In the Solana dApp Store edition, deleting your account also removes your wallet link and your pass. We keep each redeemed payment’s transaction signature, amount, plan and time, and the wallet sign-in records described under Solana wallet, with no link to any account, only so that the same payment or sign-in can never be used twice. Transactions on the Solana blockchain cannot be deleted by anyone, including us.

Children

The app is designed for general audiences. Account creation (and therefore the social features) is intended for users able to consent under their local law; younger players can use the app fully in guest mode.

Android beta waitlist (closed)

Pushup RPG is now released on Google Play, so the Android beta waitlist is closed and we are no longer collecting emails for it. If you signed up while it was open, we stored only your email address in order to send you a single notification, and it was never used for anything else, sold, or shared. You can have it deleted at any time by emailing support@pushup.quest.

Website analytics

This website uses privacy-friendly, cookieless analytics (Vercel Web Analytics) that count aggregate page views. It sets no cookies and builds no advertising profile.

Advertising measurement on this website

If we are running ads, we need some way to tell which ones actually bring people here. We ask first. When advertising measurement is switched on you will see a banner offering Accept or Decline, and nothing is set until you choose Accept. Declining costs you nothing: every page works identically either way.

If you accept, we load tags from Google Ads and Meta. These are ordinary advertising trackers and we would rather say so plainly than call them something softer: they set cookies, they can recognise you on other websites that use the same networks, and they let us see that someone who clicked an ad went on to open the App Store link. They do not receive your name, your email, your account, or anything you do inside the app.

Your choice is remembered in your browser, not on our servers, and it applies until you clear your browser storage. To change it, clear site data for pushup.quest and the banner returns. If you never see a banner, no advertising tag has been loaded at all.

None of this applies to the app. Advertising measurement described here is a website matter only. What the app collects is described above, under Install measurement.

Contact

Questions or data requests: support@pushup.quest