Privacy

Welcome to Push-up Hero,

Push-up Hero turns push-ups into a game you actually want to win. Point your phone's camera at yourself and it counts every rep in real time and tracks your progress workout after workout so you can watch yourself get stronger instead of guessing.

Every session earns you XP, builds your streak, and pushes you up the ranks, with quests and daily reminders that keep you coming back and a last set that's built to make you earn it.

Then it gets personal: add your friends, see their totals, best sets, streaks and ranks, and go head-to-head in friendly battles where the prize is bragging rights, which, honestly, is the best kind. The whole thing is designed around one simple idea: show up, drop down, and become the hero of your own push-up story.

This Privacy Policy explains what we collect, why we collect it, how we keep it safe, and what choices you have.

It's written to be read rather than skimmed past. If anything here isn't clear, ask us.

Push-up Hero is created by Ten Ten (“we”, “us”), in France.

That means we follow the GDPR (European data protection rules).

If you ever have questions, complaints, or just wanna say hi, slide in there:

[email protected]

• The camera never leaves your phone: Push-up detection runs entirely on your device. No video, no images, and no body-position data are ever sent to us.
• An account is required: Push-up Hero syncs your progress across devices, so you sign in with Apple, Google, or an email code before using the app.
• We don't sell your data, and there are no ads, no ad networks, and no advertising or tracking identifiers.
• Friends see your stats, not your account: Only people you have accepted as friends can see your name, avatar, and workout stats. There is no public leaderboard.
• We do use analytics (technical and product-usage data) to improve reliability and performance.

We don't want your life story, we just need enough info to keep Push-up Hero running smoothly and to improve it.

Here's what we might collect:

Data your phone shares automatically

When you use Push-up Hero, we get some basic, technical data like:

• Your device model and OS version
• App version and platform (iOS/Android)
• Your device language (so notifications arrive in the right language)
• Basic performance signals from a workout, so we can tell when rep counting is struggling on a given device

Data you give us

When you create an account:

• Email address
• Sign-in identifiers provided by:
  • Apple (if you use Sign in with Apple)
  • Google (if you use Google Sign-In)

When you set up your profile:

• Your display name — pre-filled from your Apple or Google name if you sign in that way, but change it to anything; it doesn't have to be your real name
• Your profile picture, if you add one

Data we create when you work out

Every workout you complete is saved to your account so it can follow you to a new phone:

• Workout date, sets and reps, duration, and the XP it earned
• Your totals: lifetime push-ups, best set, workout count, current streak, perfect weeks, XP and rank
• Achievements and ranks you have unlocked, and rest days you have claimed

What we don't collect

• No location. Push-up Hero never asks for or collects your location.
• No advertising identifiers. No IDFA, no ad tracking, no ad networks.
• No answers from the setup questionnaire. What you tell us about yourself when you first open the app (gender, goal, motivation, what's held you back) stays on your phone and is never sent to our servers. Only the name and picture you choose are saved to your account.

This is the part people ask about most, so let's be very clear.

When you start a workout, Push-up Hero turns on the camera and analyses the video on your device, in real time, to detect your body position and count reps. This uses an on-device pose-detection model. No frames, no images, and no body-position data ever leave your phone.

Your workout clip

Each workout is recorded so you can watch your set back afterwards. That video:

• Is stored in the app's private storage on your device, which other apps can't read
• Is never uploaded to us or anyone else

The clip leaves the app only if you decide to send it somewhere — by saving it to your photo library, or by sharing it through your phone's share sheet. What happens to it after that is up to you and the app you shared it with.

Push-up Hero may request:

• Camera – required, to see and count your push-ups
• Photo Library – optional, to pick a profile picture and to save your workout clip to your camera roll
• Notifications – optional, for friend requests and workout reminders. We ask when you pick a reminder time during setup, or the first time you do something social — never out of the blue at launch.

You can change any of these at any time in your phone's settings. Turning off the camera means we can't count your push-ups; the others simply disable the matching feature.

Signing in

Push-up Hero has no passwords. You sign in with Apple, with Google, or with a code we email you. Those emails are service emails (not marketing).

If you sign in with Apple or Google, they tell us your email address and your name, which we use as your starting display name. In Apple's case, that's only what you agree to share — including Apple's private relay address if you choose to hide your email.

Encryption & security

We use measures designed to protect data:

• Encryption in transit: HTTPS/TLS for all network traffic.
• Encryption at rest: Your account data and profile picture are stored encrypted at rest by our hosting provider.
• On-device storage: Your session tokens are encrypted on your device, with the encryption key held in the device's secure storage (iOS Keychain / Android Keystore). Your workout history and workout clip are stored in the app's private storage, which other apps can't read.
• Access controls: Our database enforces per-user access rules, so one account cannot read another account's data.

A note on profile pictures

Your profile picture is served from a web address that doesn't require signing in, so that friends' phones can display it — including inside notifications. That address is built from your account identifier — a long random ID that is never listed, indexed, or searchable — so it isn't something anyone can find by browsing or guess. As with any unlisted link, someone you sent it to could open it.

Push-up Hero Premium is sold through the Apple App Store and Google Play. We never see or receive your payment card details.

We use RevenueCat to manage subscriptions and tell us whether yours is active. Your account identifier is shared with them whenever you use the app — not only when you buy something — so that a subscription stays attached to your account across devices. We don't share your name or your email address with them.

Push notifications are delivered through Expo's push service, which passes them to Apple (APNs) or Google (FCM).

• We store a push token for each of your devices, along with your device language, so we can reach the right phone in the right language.
• Social notifications (friend requests) include the name and profile picture of the friend who triggered them, so your phone can show them. That information passes through Expo, Apple, and Google to reach you.
• Workout, streak, and rest-day reminders are scheduled on your phone itself — they never go through a server.

We delete your push token when you sign out. If your phone is offline at that moment, it's cleaned up the next time that device signs in.

Push-up Hero is social by design, but scoped tightly.

People you have accepted as friends can see:

• Your display name, profile picture, and when you joined
• Your lifetime push-up total, your best set, and your current streak
• Your push-ups and best set for the current week, and which days this week you've trained or rested — that's what powers the weekly duel and streak war
• Your rank

Your raw XP, your individual workouts, and your workout clips are never shared with anyone.

Everyone else

• There is no public leaderboard. Nothing about you is visible to strangers or searchable inside the app.
• Someone with a pending friend request from or to you can see your name, profile picture, and when you joined, so they know who they're adding.

Invite links

You can invite a friend with a link (pushuphero.app/l/invite/…). If they don't have Push-up Hero yet, the link sends them to download it — then, once they're in, they're shown a friend request from you with your name, profile picture, and when you joined. They become your friend only when they accept it; it's never automatic. Invite links expire after 7 days, and you can revoke them anytime.

We use PostHog to understand how the app is used and to fix what's broken. We don't let the analytics library collect whatever it likes — we send a short, deliberate list of events, covering things like opening the app, signing in, and whether a workout was started, completed, or abandoned.

Those events carry your account identifier, basic technical details about your app and device, and whether you're a Premium subscriber. We do not send your name, your email, your rep counts, your friends, or anything from the camera.

Data protection law says we need a valid reason — a “legal basis” — for every use of your personal data. Here are ours, in plain terms.

To give you the app you signed up for

Your account, your progress syncing across devices, friends, notifications, and Premium. We can't provide any of it without processing this data, so our basis is performing our contract with you.

Providing this data isn't optional: without an account and a workout history, there is no app to use.

To keep your account secure

Sending login codes, keeping sessions valid, and preventing abuse of the service. Our basis is a mix of performing our contract and our legitimate interest in keeping Push-up Hero safe for everyone.

To fix bugs and make the app better

Analytics tells us which parts of the app people actually use and where it breaks. Our basis is our legitimate interest in running a reliable app and improving it — balanced against your privacy by keeping what we collect deliberately small.

Because this one relies on legitimate interests rather than your agreement, you have the right to object to it. See Your rights below.

To answer you when you get in touch

Support conversations. Our basis is our legitimate interest in helping our users, and performing our contract where your question concerns the service itself.

To comply with the law

Responding to lawful requests and defending our rights. Our basis is our legal obligations and our legitimate interest in protecting the service.

Where your permission is required for something on your device — the camera, your photo library, notifications — the system prompt is what asks for it, and you can change your answer at any time in your phone's settings.

We don't sell your personal data.

We share data only with trusted service providers (processors) who help us operate Push-up Hero:

• Supabase (database, authentication, and file storage)
• PostHog (analytics)
• RevenueCat (subscription status)
• Expo (push notification delivery)
• Apple and Google (sign-in, when you choose those methods; push delivery; payments)

We may also disclose data if required to comply with law or to protect users and our services.

We are based in France, and our database, authentication, and file storage are hosted in the United States. Some of our other providers are also located outside the EEA/UK.

When personal data leaves the EEA or the UK, we rely on approved safeguards to keep it protected to the same standard:

• Standard Contractual Clauses — the contract terms approved by the European Commission for exactly this — and the UK Addendum where it applies
• Additional technical and organizational protections where appropriate

You can ask us for a copy of these safeguards at [email protected].

We keep data only as long as needed for the purposes described above.

Account & workout data

• We keep your account, profile, and workout history while your account is active.
• If you request account deletion, your account is deactivated immediately — you are signed out everywhere and disappear from your friends' lists — and permanently deleted after 30 days. Signing in again within those 30 days cancels the deletion and restores everything.
• When the deletion goes through, we erase your profile, workouts, stats, unlocks, friendships, invites, push tokens, and profile picture, and we ask PostHog to erase your analytics data.
• We keep a minimal record that a deletion was carried out, so we can prove it was done. It contains an account identifier and dates, and nothing else.

Analytics

Analytics data is retained for a limited period and then deleted or anonymized. We keep it for at most 13 months.

Invites

Invite links expire 7 days after they are created, and expired invites are cleaned up automatically.

On your device

Your workout history and your profile picture stay on your phone until you sign out or uninstall the app. Your latest workout clip stays on your phone until your next workout replaces it, you sign out, or you uninstall the app. Uninstalling removes everything the app stored locally.

If you are in the EEA or the UK, data protection law gives you the following rights over your personal data. They're free to use, and we'll respond within one month.

• Get a copy of it — ask us what we hold about you. You can also grab a full copy yourself: Profile → Menu → Export my data
• Correct it — you can edit your name and picture right in the app
• Delete it — the “right to be forgotten”, available in the app under Profile → Menu
• Take it with you — receive the data you gave us in a portable format. The in-app export (Profile → Menu → Export my data) gives you exactly that, as a file you keep
• Limit how we use it — ask us to pause certain processing while a question is resolved
• Withdraw your permission — where we relied on it, without affecting what we did beforehand

Your right to object

• You can tell us to stop using your data for analytics, and we will. This is a separate right, and you don't need a reason beyond your own situation. Because our analytics runs on legitimate interests rather than your consent, this is the control that matters most — so we're calling it out on its own rather than burying it in the list above.

Email us at [email protected] to use any of these rights. We may need to confirm it's really you — usually just by checking you can receive mail at the address on the account.

Complaints

You can lodge a complaint with your local supervisory authority. In France, this is CNIL.

Push-up Hero isn't intended for children. You must be at least the minimum legal age in your country to use it. If you believe a child has provided personal data to us, contact us and we'll take appropriate steps.

Push-up Hero does not make decisions about you by automated means that would have a legal or similarly significant effect.

Your training program and rank progress are calculated from your own workout history. They affect what the app shows you, nothing more.

Push-up Hero counts push-ups. It is not a medical device and gives no medical advice. Your workout data is fitness data you generate — we treat it with care, but you should talk to a professional, not an app, about your health.

If we make material changes, we'll update the effective date and provide notice in the app where appropriate.

Push-up Hero

France

[email protected]