Privacy Policy
Last updated: October 23, 2026
The short version
- We collect what it takes to run a workout tracker: your account, the sets you log, and the people and clubs you connect with.
- Signed-in users see your name, username, photo, totals and standings. Your email, height, weight and daily goal numbers stay private.
- We do not sell your data, we do not run ads, and we use no ad or analytics trackers.
- Your workouts and body measurements may be health data. We collect them only with your consent. Read our Health Data Privacy Policy.
- You can download your data or delete your account in Settings at any time.
Who we are
pushup.cc is an exercise tracker with leaderboards, friends, clubs and games. It is run by Nova Hawk Labs LLC, a Texas series limited liability company, at 1122 Colorado Street, Apt 1410, Austin, TX 78701, USA ("we", "us"). We are the controller of the personal information described here. This policy covers the pushup.cc website and app, including the installable app you can add to your home screen.
pushup.cc is offered to people in the United States, Canada (except the province of Quebec), Australia and New Zealand: new accounts are open only there, for now, and club subscriptions only in the United States. If you have an account from somewhere else, this policy, and the rights it describes, still apply to you.
This policy explains what we do with your information. It is a notice, not a contract. The rules for using pushup.cc are in our Terms of Service. Questions go to privacy@pushup.cc.
What we collect
Account and profile
- Email address and, if you sign up with email, a password. Supabase Auth stores the password only as a one-way hash, and we never see it.
- Display name, username, and profile photo if you add one.
- When you created your account, whether you are in the lobby or a member, and whether you are a beta tester.
- The confirmations you give at signup, each with the date: that you agree to the Terms, that you are 13 or older, and your separate health data consent (and the date you withdraw it, if you do).
- If a username was reserved for your email address, that reservation.
Workouts and body measurements
- Each set you log: the exercise; what that exercise records, which is one or more of reps (or steps), the weight lifted, weight added to your body (such as a vest), the distance and the duration; the date and time you did it; and its source, such as a game, a past set you added later, or a set an admin added.
- Your exercise list, and for each exercise your daily goal in its units (reps, weight, distance or time) and the amount the Add button logs.
- Height and weight, only if you choose to add them, and whether you see pounds and miles or kilograms and kilometers.
- Whether Weight Moved is on, and the date you turned it on.
- Injured Reserve status, if you turn it on.
- Stats we calculate from the above: daily, weekly, monthly, yearly and all-time totals, volume for lifts, streaks, personal records, badges, medals, leaderboard placements, averages, percentiles and projections. If you turn it on, Weight Moved: an estimate of the weight you move in bodyweight exercises, from your reps, height and weight.
Friends, games and community
- Your friends, friend requests you send or receive, and the invite links you create.
- How you joined: whose invite you used, or which member vouched for you, and whether an admin approved you.
- Game rooms you host or join, and your game results.
- Exercises you ask us to add to the catalog: the name, what it records, and any note you write.
- Your daily recap preference.
- Reports you file about other users, reports filed about you, and any moderation action taken on your account.
- Messages you send us, such as support or privacy requests.
Clubs
- Clubs you create or join, your role (owner, admin or member), and any club-specific name or photo you set.
- For clubs you own or run: the club name, logo, colors, allowed email domains, and invite links.
- Requests you make to join a club. These include your name and email address, which the club owners and admins can see.
Billing (club owners only)
- Stripe customer and subscription IDs, the plan, the subscription and trial status, and whether the club has used its free trial.
- Stripe collects your card and billing address directly on its own checkout page. We never see or store your full card number. We read only the country of the billing address, to check that the subscription is in the United States, and do not store it.
Technical and usage data
- Request data our hosts record: IP address, browser and device type, the page or API requested, and the time.
- The country your connection comes from and, in Canada, the province, which our host works out from your IP address. We use them when you sign up, to check that you are in the United States, Canada outside Quebec, Australia or New Zealand; when you start a club subscription, to check that you are in the United States; and to decide whether to ask about cookies. We do not store them.
- Crash and error reports: your user ID, browser, the page, and technical details of the failure.
- How you found us: the site that linked you, any campaign tag in that link (such as utm_source or ref), the first page you opened with any invite code hidden, and the date. See Cookies.
- Your cookie choice. We also read your browser’s Global Privacy Control signal on each visit, but do not store it.
What we do not collect
We do not collect your precise location (for a run or a ride we store only the distance and time you enter, never a route), contacts, camera or microphone input, or data from health apps or wearables. We have no advertising or behavioral analytics software in the app, and we do not send push notifications.
Where it comes from
- From you: what you enter when you sign up, log sets, edit your profile, join clubs, play games, or contact us.
- From your browser or device: request data, error reports, and the first-visit attribution cookie described below.
- From other users: a friend or club admin who sends an invite to your email address, a member who vouches for you, a club whose join request you file, someone who plays a game room with you, or someone who reports you.
- From Google: if you choose Sign in with Google: your name, email address and profile photo.
- From Stripe: for club owners: whether a payment succeeded, the state of the subscription, and the country of the billing address.
- From us: the stats we calculate from your logs, and, rarely, a set an admin adds to or removes from your log (for example to fix a mistake you report).
Why we use it (and legal bases)
We use your information only for the purposes below. If you are in the EU, EEA, UK or Switzerland, the right column shows the legal basis under the GDPR or UK GDPR. Where we rely on legitimate interests, you can object (see EU, EEA, UK and Swiss rights).
| Purpose | Information used | Legal basis |
|---|---|---|
| Create your account, sign you in, keep you signed in | Account, technical | Contract (Art. 6(1)(b)) |
| Offer new accounts only where we operate (the United States, Canada outside Quebec, Australia and New Zealand), and club subscriptions only in the United States | Connection country and province, billing address country | Legitimate interests in offering the service only where we support it |
| Track your workouts, goals and stats | Workouts and body measurements | Contract, plus your explicit consent for health data (Art. 9(2)(a)) |
| Estimate Weight Moved from your height and weight, only if you turn it on in Settings, Body | Height and weight, workouts | Your explicit consent (Art. 9(2)(a)), given by turning it on; turn it off anytime |
| Show leaderboards and the sets behind them, friends, clubs, games and the daily recap | Profile, workout totals and sets, friends, clubs | Contract, plus your explicit consent for sharing health data with other users |
| Run club subscriptions: checkout, renewals, reminders, cancellations | Billing, account | Contract; legal obligation for tax and accounting records (Art. 6(1)(c)) |
| Send service emails: sign-in links, invites you ask us to send, join requests, purchase confirmations, trial and renewal reminders, moderation notices | Email, name, club details | Contract |
| Keep the boards fair and the community safe: reports, moderation, fake reps, abuse, fraud and security | Any category, as needed | Legitimate interests in a fair, safe and secure service (Art. 6(1)(f)) |
| Find and fix bugs | Technical, error reports | Legitimate interests in a working service |
| Learn which places bring people who keep using the app (counted in totals, never used to target you) | How you found us | Consent where the law requires it (Art. 6(1)(a) and ePrivacy rules); legitimate interests elsewhere |
| Answer your questions and privacy requests | Contact details, your request | Contract; legal obligation |
| Comply with the law, enforce our Terms, and defend legal claims | Any category, as needed | Legal obligation; legitimate interests |
Giving us your email address is required to have an account. Everything else is up to you, but some features need it (for example, logging sets needs your health data consent). We do not use your information for advertising, and we make no decisions about you that have legal or similarly significant effects using automated processing alone. Leaderboard ranking is automatic; moderation decisions are made by people.
Today we send only the service emails listed above. If we start sending other email, such as recaps, club news or product updates, we will send it only as your Email Preferences in Settings allow (and in the EU, EEA, UK and Switzerland only if you opt in), with an unsubscribe link in every message.
Health data
The sets you log (with their reps, weights, distances and times), your goals, your height and weight, and your Injured Reserve status may be "consumer health data" under laws such as Washington's My Health My Data Act, Nevada law and Connecticut law, and health data under the GDPR. We ask for your consent to collect and share it at signup, separately from agreeing to the Terms and this policy, and again before we collect a new kind of it. We never sell it and never use it for advertising. Using your height and weight to estimate Weight Moved is a separate, optional use: we do it only if you turn Weight Moved on in Settings, Body, which records your consent, and stop when you turn it off.
Our Health Data Privacy Policy explains exactly what we collect, who receives it, and how to access it, delete it, or withdraw your consent.
Who can see what
| Who | What they can see |
|---|---|
| Anyone, signed in or not | Public club pages of published clubs (club name, logo, colors, description, member count and how to join). Your own profile is not shown to signed-out visitors. |
| Every signed-in pushup.cc user | Your display name, username, photo, Injured Reserve status, when you joined, your totals and period totals, leaderboard standings, streaks, records, badges and medals, how often you hit your daily goal (but not the goal itself), and your logged sets as you entered them (reps, weight, distance or time) when they open your row on a board. While you are in the lobby you do not appear on global leaderboards. |
| Your friends | The same, plus your place on their friends leaderboard. |
| Members of your clubs | Your club name and photo (if you set them) and your standings, totals and sets on the club leaderboard, for the exercises the club runs. |
| Club owners and admins | Everything club members see, plus the name and email address on any request you make to join their club. |
| People in a game room with you | Your name, photo and progress in that game. |
| pushup.cc admins (our staff) | Your whole account, including your email, how you joined, your signup source and your moderation history, to run, support and moderate the service. |
| Only you (and our admins) | Your email address, height, weight, Weight Moved, daily goals, settings, consent records, and your privacy and cookie choices. |
If you would rather not appear on other people's leaderboards, email us and we can hide your profile. Your sets still count for your own stats.
Service providers
These companies process data for us under contracts that limit them to providing their service. None of them is an advertising network or a data broker. We may add or change providers; we will update this list when we do.
| Provider | What it does | Data involved | Location |
|---|---|---|---|
| Supabase | Database, sign-in, photo storage, and rate limiting to stop abuse such as password guessing | Everything in your account, plus IP address and user ID for rate limiting | United States (AWS US East) |
| Vercel | Hosts and serves the website and app | Request data including IP address; all data passing between you and us | United States, with a global delivery network |
| Stripe | Club payments, checkout and billing portal | Club owner billing details and email | United States |
| Resend | Sends our emails | Email address, name, and the content of the email | United States |
| Sentry | Crash and error reports | User ID, browser, page, technical details | United States |
| Sign in with Google, only if you use it | Your Google name, email and photo | United States | |
| Cloudflare | Domain name service (DNS) for pushup.cc | No account data | United States |
Stripe and Google also act as independent controllers for their own purposes, such as fraud prevention and legal compliance for Stripe, and your Google account for Google. Their own privacy policies apply to that use.
Other disclosures
- With other users: as described in Who can see what.
- When the law requires it: to respond to valid legal process, or to protect someone’s safety, our rights, or the service.
- In a business transfer: if we are involved in a merger, acquisition or sale of assets, your information may transfer, and this policy will continue to apply to it.
International transfers
We are based in the United States and store data there. If you use pushup.cc from another country, your information is transferred to the United States. Transfers from the EU, EEA, UK and Switzerland rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments where needed) in our providers' data processing agreements, or on the EU-US Data Privacy Framework and its UK and Swiss extensions where the provider is certified. Email us for a copy of the safeguards.
How long we keep it
| Information | How long we keep it |
|---|---|
| Account, profile, workouts, friends, clubs, games | Until you delete your account or we close it. Deletion removes it from our live database right away. |
| Clubs you delete | Hidden right away, then removed for good, with their logos and images, 30 days later. |
| Database backups | Deleted data rolls off our backups within 30 days. |
| Server logs (including IP addresses) | The request logs we can see are kept for 30 days or less. Our hosts may keep their own security records longer under their own privacy policies. |
| Rate limiting records (IP address, user ID) | Used for 2 hours at most, then deleted within a day. |
| Crash and error reports | 90 days. |
| How you found us | The cookie expires after 90 days. If you sign up, the record stays with your account and is deleted with it. |
| Billing and tax records | Up to 7 years after the payment, as tax and accounting rules require. Most of these are held by Stripe. |
| Your agreement to a club subscription’s automatic renewal | At least 3 years, or 1 year after the subscription ends if that is later, as California law requires. |
| Reports and moderation records | Up to 12 months after the report is resolved, longer only if needed for an open dispute or a repeat violation. |
| Support and privacy request emails | 24 months, so we can show how we handled each request. |
| Early access requests from people who never made an account | 12 months after the request, or after our answer if that came later, then deleted. If you made an account, the request stays with it and is deleted with it. |
| Consent and signup confirmations | As long as your account exists. |
If you own a club that has other members, you need to hand ownership to someone else before you can delete your account. A club you own alone is deleted with your account, and its subscription is canceled so no further charges happen.
Cookies and device storage
We use first-party cookies and your browser's storage only. There are no third-party cookies, ad trackers or analytics tags on pushup.cc.
| Name | Type | What it does | How long |
|---|---|---|---|
| Supabase sign-in cookies (sb-...) | Essential | Keep you signed in | Until you sign out or the session expires |
| pu_consent | Essential | Remembers your answer to the cookie banner | 6 months, then we ask again |
| pu_cr | Essential | Tells the app to show the cookie banner where consent is required | Until you close your browser |
| pu_sc | Essential | Carries what you ticked on the sign-up form (the Terms, your age, health data consent) until your account is created | Up to 1 day |
| pu_ft | Optional (attribution) | Notes how you first found pushup.cc, as described above. It contains nothing that identifies you and is never shared. | Up to 90 days, or until you sign up |
| Local storage and app cache | Essential | Lets the app work offline, queues sets you log offline until you reconnect, and remembers display preferences | Until you clear site data |
- EU, EEA, UK and Switzerland: we set pu_ft only if you choose Allow in the cookie banner. We use the country your connection comes from to decide whether to ask.
- Everywhere: we do not set pu_ft, and we remove one already set, if your browser sends a Global Privacy Control signal or you have declined in the banner. We never set it for signed-in users.
- Any time: you can delete cookies in your browser settings. Blocking essential cookies will sign you out.
GPC, selling, and sensitive data
- We do not sell or share your personal information: We have never sold personal information, and we do not share it for cross-context behavioral advertising or use it for targeted advertising or profiling, as those terms are used in US state privacy laws. That has been true for the past 12 months and will stay true. Because of this, there is nothing to opt out of, but you can still tell us not to, and we will record it.
- Global Privacy Control: If your browser sends a GPC signal, we treat it as a valid request to opt out of sale, sharing and targeted advertising, and we do not set the optional attribution cookie.
- Limit the use of sensitive personal information: Your login details and your health data are sensitive personal information. We use them only to provide the service you asked for, keep it secure, and as the law allows, so we do not offer a separate "Limit" link. If you want to limit them further, you can remove your height and weight, or delete your account.
- California "Shine the Light": We do not disclose personal information to third parties for their own direct marketing.
Your rights
Wherever you live, you can:
- Access and download: get a copy of your data in a machine-readable file (Settings, Download My Data), including every set you logged with all of its measures. The stats we calculate from your sets are shown in the app.
- Correct: edit your name, username, photo, goals, height and weight in Settings. Email us to change your email address.
- Delete: delete your account and its data (Settings, Delete My Account).
- Withdraw consent: for health data (see the Health Data Privacy Policy), for Weight Moved (turn it off in Settings, Body), or for the attribution cookie, without affecting what happened before.
- Opt out: of sale, sharing, targeted advertising and profiling. We do none of these, and we honor GPC.
- Appeal: if we say no to a request.
We will not charge you more, give you a worse service, or treat you differently for using any of these rights.
Canada
If you are in Canada, Canadian privacy law (PIPEDA) gives you these rights too: to see the information we hold about you, to have it corrected, and to withdraw your consent, subject to legal or contractual limits. We answer within 30 days. We and the providers listed above store and process your information in the United States, where courts, law enforcement and national security authorities may be able to reach it under US law. If you are not satisfied with how we handle a request or a concern, you can complain to the Office of the Privacy Commissioner of Canada.
Australia
If you are in Australia, the Privacy Act 1988 and its Australian Privacy Principles give you the right to see the personal information we hold about you and to have it corrected. We answer within 30 days. Your information is stored and processed in the United States by us and the providers listed above. If you are not satisfied with how we handle a request or a concern, you can complain to the Office of the Australian Information Commissioner.
New Zealand
If you are in New Zealand, the Privacy Act 2020 gives you the right to see the personal information we hold about you and to have it corrected. We answer within 20 working days. Your information is stored and processed in the United States by us and the providers listed above. If you are not satisfied with how we handle a request or a concern, you can complain to the Office of the Privacy Commissioner.
US state privacy rights
Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with similar laws have the rights listed above under their state law. We give the same rights to everyone, whether or not a law requires it.
- What we collected in the past 12 months: identifiers (email, user ID, IP address); customer records (name, email, billing IDs); commercial information (club subscriptions); internet activity (request logs, error reports, how you found us); physical characteristics (height and weight, if you add them); and sensitive personal information (account login, and health data: your logged sets with their reps, weights, distances and times, your goals, and your body measurements). We collect it from the sources and for the purposes above, and keep it for the periods above.
- Who received it: the service providers listed above, for business purposes. We sold or shared none of it, and we do not knowingly sell or share the data of anyone under 16.
- Response time: we answer within 45 days. If we need more time (up to 45 more days), we will tell you why.
- Appeals: if we deny your request, reply to our decision or email us with "Appeal" in the subject. We answer within 45 days. If you disagree with the result, you can contact your state attorney general.
- Authorized agents: someone you authorize can make a request for you. We may ask for proof of that authority and confirm the request with you.
EU, EEA, UK and Swiss rights
If you are in the EU, EEA, UK or Switzerland, you also have the right to restrict our use of your data, to object to processing based on legitimate interests (we will stop unless we have compelling grounds), and to data portability. We answer within one month, or tell you if we need up to two more months.
You can complain to your local data protection authority, or in the UK to the Information Commissioner's Office. We would appreciate the chance to fix things first.
Write to us directly at privacy@pushup.cc; we handle requests from everywhere the same way.
How to use your rights
- In the app: Settings lets you edit your profile and body measurements, download your data, and delete your account.
- By email: write to privacy@pushup.cc from the email address on your account. If you write from another address, we will need to confirm it is you before we act.
- By mail: Nova Hawk Labs LLC, Attn: Privacy, 1122 Colorado Street, Apt 1410, Austin, TX 78701, USA.
Deleting your account is permanent. It removes your profile, sets (with all of their reps, weights, distances and times), goals, body measurements, the stats calculated from them, friends, invites, game results, signup source and photos from our live database right away. Leaderboards recalculate without you. An exercise you asked us to add to the catalog stays in our records, no longer linked to your account.
Children
pushup.cc is not for children under 13, and you must confirm you are 13 or older to sign up. We do not knowingly collect information from children under 13. If you believe a child under 13 has an account, email privacy@pushup.cc and we will delete it. If you are a parent or guardian of a teen who uses pushup.cc, you can contact us with questions about their account.
Security
- All traffic is encrypted in transit with TLS, and our database provider encrypts data at rest.
- Database rules check every read and write, so users can only reach what they are allowed to see. Private columns such as email, height and weight are not readable by other users.
- Passwords are stored only as hashes. Card details never touch our servers.
- Only a small number of staff have admin access, and only to run and moderate the service.
No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.
Reporting a security issue
Found a vulnerability? Email security@pushup.cc (see also our security.txt). Please give us a reasonable time to fix it before you share it, do not access or change other people's data beyond what you need to show the issue, and do not degrade the service for others. We will not pursue legal action against good-faith research that follows these rules.
Changes to this policy
We will update the "Last updated" date whenever this policy changes. If we make a material change, we will tell you in the app and by email before it takes effect. If a change means collecting a new kind of health data or using your health data in a new way, we will ask for your consent first.
Contact
Nova Hawk Labs LLC, 1122 Colorado Street, Apt 1410, Austin, TX 78701, USA. Email privacy@pushup.cc.