Privacy policy

Effective 2026-10-24

PushUp Arena is a daily push-up competition for iPhone. This policy explains what personal data the PushUp Arena app and this website collect, why, who sees it, how long we keep it, and the choices and rights you have. “We” means Tinfit LLC, which runs PushUp Arena.

Who we are

PushUp Arena is run by Tinfit LLC, 515 W 38th St 22G, New York, NY 10018, United States. Tinfit LLC decides how and why your personal data is used (it is the “controller” under laws such as the EU and UK GDPR). For questions, requests or complaints about your data, email support@pushuparena.net.

What we collect and why

Your account

Your email address and password, or, if you use Sign in with Apple, the identifier Apple gives us and the email address Apple shares (your own or a private relay address, as you choose). Your username, your country if you choose one, your privacy settings, and which version of the terms of use you accepted and when. We store your password only as a salted hash (Argon2id), never the password itself. If you sign in with Apple, the app may use the name Apple shares to suggest a username on your iPhone; we don't keep your name.

Why

To create and run your account, sign you in, reset your password and show your username to other players.

Legal basis

Contract: we need it to provide PushUp Arena to you.

Kept

Until you delete your account.

Your profile photo (optional)

A photo you choose for your profile. Your iPhone makes it smaller and removes location and camera details before uploading it, and our server removes any that remain.

Why

To show it next to your username. A moderator checks each new photo first: other players see it only once it's approved, and a rejected photo is deleted.

Legal basis

Contract (a feature you choose to use). For the check: legitimate interests in keeping PushUp Arena safe.

Kept

Until you remove or replace it, a moderator removes it, or you delete your account.

Competition sets

When you start a competition set, the app tells our server which versions of the app and iOS you use and your iPhone model, and gets a random live check; when you do the check, the app reports when you did each move. When you tap Submit to leaderboard, the app sends what your iPhone measured: your count; the time and angles (elbows and body line) of each rep and its form feedback; when the set started and finished; whether you held at the top when asked; and technical details of the recording, such as frame rates, dropped frames, the iPhone's temperature state and interruptions.

Why

To verify the set, put it on the leaderboards and show your history and statistics.

Legal basis

Contract; legitimate interests in fair competition and preventing cheating.

Kept

While your account exists. After you delete your account, kept without your profile for 90 days, then deleted.

Competition videos

A video of each competition set, recorded only after you agree, and never in Practice. It's video only, with no sound: the app never uses the microphone. Recording runs from the end of calibration until you finish. The video stays on your iPhone until you tap Submit to leaderboard; if you tap Discard, it's deleted from your iPhone and never sent.

Why

To check that the set happened as counted: our verification system checks every submitted video, and moderators may watch any set you submit (see How competition sets are checked). Other players never see your videos.

Legal basis

Your consent. You can withdraw it at any time in Settings → Competition → Withdraw recording consent. Competition then can't record until you agree again; Practice keeps working.

Kept

Deleted 24 hours after the set's competition day ends (00:00 UTC). If a review or an appeal of the set is still open then, the video is kept until it's settled, then deleted. You can delete all your videos sooner in the app.

Results and leaderboards

Your verified push-ups and your best single set of each day, with when you reached them, your places on the leaderboards, streaks and history, all worked out from your verified sets. Leaderboards also show push-ups still waiting for verification, labelled pending and never ranked.

Why

To run the leaderboards and show your progress.

Legal basis

Contract.

Kept

While your account exists. When you delete your account, you're removed from the leaderboards at once.

Friends, blocks, reports and appeals

Your friends and friend requests, the people you block, the reports you make (who you report, the reason and any details you add), and the appeals you write about decisions on your sets. If someone reports you, we keep their report and what a moderator decided. We don't tell the person you report who reported them.

Why

To run your friends' leaderboards, keep people you block away from you, and handle reports and appeals.

Legal basis

Contract; legitimate interests in keeping PushUp Arena safe and fair.

Kept

Friends and blocks until you remove them or delete your account. Reports and appeals: see How long we keep data.

Security and device information

A key that lets our server check that requests come from a genuine copy of the app on your iPhone (Apple's App Attest), and its registration. For each sign-in, the IP address and the device's user agent, which you can see in Settings → Signed-in devices. A security log of account and workout actions, such as sign-ins, uploads, privacy changes and moderation decisions, with the IP address. Our server's request logs, which also record IP addresses.

Why

To keep accounts secure, prevent cheating and abuse, and keep a reliable record of decisions.

Legal basis

Legitimate interests in security and fraud prevention; legal obligation where the law requires records.

Kept

See How long we keep data.

Messages to us

If you email us, your email address and what you write.

Why

To answer you and handle your requests.

Legal basis

Legitimate interests in answering you; legal obligation for privacy requests.

Kept

As long as we need them to help you and, for privacy requests, as long as the law requires a record.

What we don't collect

We don't collect your location, the contacts on your phone, photos or videos from your library (apart from a profile photo you pick), audio, health records or payment details. When you search for a username, we answer and don't keep the search. Body pose detection runs on your iPhone to count your reps; we don't use face recognition or identify anyone from their body. The app contains no analytics, advertising or tracking code.

How competition sets are checked

Your iPhone counts your push-ups with its camera, on your iPhone. Before counting starts in a competition set, a quick live check asks you to make a few random moves (for example “Raise your right hand above your head”), and during the set the app asks once to hold at the top for 2 seconds.

After you submit the set, our server checks that it comes from a genuine copy of the app (App Attest), and that the video is complete and unaltered and matches the set: its length and timing, frozen or repeated frames, and signs of a video replayed from a screen. If everything agrees, the count your iPhone made goes on the leaderboard. If something doesn't, for example the hold was missed, a moderator decides. The server rejects a set by itself only when its video can't be used, for example because it isn't the video your iPhone recorded or can't be read.

Moderators may watch the video of any submitted set while it's kept, for example to spot-check the leaderboards or when you appeal, and they can reject a set that breaks the rules. Every time a moderator opens a video, it's logged. Moderators see the set's details, the video and your account details, such as your username and email address. If one of your sets is rejected, you can appeal once in the app, and a moderator looks at it again.

What other people see

Other signed-in players can see your username, your profile photo once a moderator has approved it, your country's flag if you show it, and on the leaderboards your place, your verified totals and best sets, when you reached them, and how many of your push-ups are still waiting for verification. They never see your email address, your videos or the details of your sets.

You choose who sees what in Settings → Privacy:

• Who can see my profile: Everyone, or Friends only. With Friends only, only your friends can find you in search or see your profile photo; others can still send you a friend request if they know your exact username.
• Leaderboards: Everyone, Friends only, or Hidden. You always see your own place.
• Show my country: on or off.

New accounts start with Everyone, with your country shown if you chose one. Leaderboards and search are only for signed-in players. If you block someone, you won't see them on leaderboards, in search or as a profile, they can't find you in search, and neither of you can send the other a friend request.

Who we share data with

We share personal data only with these service providers, which help us run PushUp Arena, and only as much as they need:

• Cloudflare, Inc. (United States) runs our domain's DNS and the encrypted tunnel that carries all app traffic to our server, hosts this website, and forwards email sent to our support address. Everything the app sends and receives, including your IP address, passes through Cloudflare's network.
• Resend (United States) sends our password-reset emails. It receives your email address and the email.
• Apple provides Sign in with Apple and App Attest. With Sign in with Apple, Apple shares an identifier and, if you choose, your email address, and when you delete your account we ask Apple to end the app's access to your Apple Account. With App Attest, your iPhone and Apple confirm that the app is genuine. Apple's own privacy policy covers what Apple does.
• A cloud storage provider keeps our encrypted database backups for 14 days. They're encrypted before they leave our server.

These providers may use your data only to provide their services to us, and must protect it at least as well as this policy describes.

Our moderators, people Tinfit LLC authorises to review sets and reports, see what's described under How competition sets are checked.

We disclose personal data to authorities or others only when the law requires it, or when it's needed to protect someone's safety or to establish or defend legal claims. If Tinfit LLC takes part in a merger, an acquisition or a sale of its assets, your data may be transferred as part of it, and this policy keeps applying to it.

We don't sell your personal data, share it for advertising, or let anyone track you through PushUp Arena.

Where your data is processed

Tinfit LLC is in the United States, and our server, with the database and the encrypted videos, runs on a computer Tinfit LLC operates there. If you use PushUp Arena from another country, your data is transferred to the United States, where data protection law may differ from your country's. Our providers may also process it in other countries; Cloudflare, for example, handles connections in data centres around the world. Where the law requires safeguards for these transfers, such as the European Commission's Standard Contractual Clauses, we rely on those in our providers' data processing terms.

How long we keep data

• Practice: only on your iPhone (the newest 500 workouts), until you delete the app.
• A competition set you haven't submitted: only on your iPhone, until you submit or discard it.
• Competition videos: deleted 24 hours after the set's competition day ends (00:00 UTC), or, if a review or an appeal is still open then, once it's settled. You can delete them sooner.
• Your account, profile photo, friends and blocks: until you remove them or delete your account.
• Reports, appeals and moderators' decisions: while the accounts involved exist, and as below when an account is deleted.
• When you delete your account: your username, email address, sign-in details, country, profile photo, videos, friends, blocks and places on the leaderboards are removed at once, and so is the text of your appeals and of the reports you made. Your workout records, and the moderation records about you (moderators' decisions, reports and appeals), are kept without your profile for 90 days so that past leaderboards and decisions stay fair, then deleted.
• Security log: 2 years (730 days). If you delete your account, your entries lose their IP addresses and personal details at once.
• Sign-in records (IP address and user agent): until a day after the sign-in expires or ends, at most 31 days.
• Server request logs (IP addresses): up to 30 days.
• Password-reset links: valid for 60 minutes, deleted a day after they're used or expire.
• Backups: 14 days, so data you delete is gone from our backups within 14 days.
• Emails to us: see Messages to us.

Your choices and rights

In the app, you can:

• change your username, country and profile photo (your profile, then Edit), and your privacy settings (Settings → Privacy);
• delete all your competition videos from our server: Settings → Your data → Delete my workout videos (sets not verified yet then can't be verified, and a video an open appeal needs is kept until the appeal is decided);
• delete your account: Settings → Your data → Delete account;
• withdraw your consent to recording: Settings → Competition → Withdraw recording consent. The app asks again before your next competition set. Videos you already submitted follow the rules above, and you can delete them;
• discard a competition set you haven't submitted: its video is deleted from your iPhone and nothing is sent;
• report or block another player.

Depending on where you live (for example in the European Union, the United Kingdom or California), you may also have the right to:

• know what personal data we hold about you and get a copy, including in a portable format;
• have it corrected or deleted;
• restrict how we use it, or object to uses based on our legitimate interests;
• withdraw your consent at any time (this doesn't affect what we did before);
• not be treated differently for using these rights.

To use any of these rights, email support@pushuparena.net from the email address of your account. If you use Sign in with Apple with a hidden email address, tell us your username. We may ask for more details to check that the request comes from you. We answer within one month, free of charge. Someone you authorise can also ask for you; we may ask them for proof.

If you're in the European Union or the European Economic Area, you can complain to the data protection authority where you live or work (list of authorities); in the United Kingdom, to the Information Commissioner's Office; in Switzerland, to the Federal Data Protection and Information Commissioner. We'd be grateful for the chance to help first.

Children

PushUp Arena isn't for children. To create an account you must be at least 13, or the minimum age of digital consent in your country if that is higher, and the app asks you to confirm it. We don't knowingly collect personal data from anyone younger. If we learn that an account belongs to someone younger, we delete it. If you think a child has given us personal data, email support@pushuparena.net.

Security

Connections between the app and our server are encrypted (HTTPS), including through Cloudflare's tunnel. Competition videos are stored encrypted (AES-256-GCM) with keys kept apart from them, and only our verification system and moderators can open them. Passwords are stored only as Argon2id hashes. Backups are encrypted. No system is perfectly secure, but we work to protect your data, and if a breach affects it, we'll tell you as the law requires.

California residents

If you live in California, the California Consumer Privacy Act gives you the rights above to know, delete and correct your personal information and not to be treated differently for using them. In the past 12 months we have collected these categories of personal information, from you, your iPhone, Apple and other players (for example their reports), for the purposes described in this policy:

• Identifiers: email address, username, account ID, Sign in with Apple identifier, IP address, App Attest key.
• Internet or other electronic network activity: sign-ins, the security log and request logs.
• Audio, electronic or visual information: competition videos (without sound) and your profile photo.
• Other personal information: workout results and details, your country, friends, blocks, reports, appeals and messages to us.
• Sensitive personal information: your email address and password, used only to sign you in and keep your account secure.

We disclose these categories only to the service providers listed under Who we share data with, for the purposes described there. We don't sell or share your personal information (including for cross-context behavioural advertising), we haven't done so in the past 12 months, and we don't share it with third parties for their direct marketing. How long we keep each category is under How long we keep data. To use your rights, email support@pushuparena.net; we answer within 45 days, and you can use an authorised agent.

Do Not Track

PushUp Arena doesn't track you across other companies' apps or websites, and this website has no analytics or tracking, so there's nothing for a Do Not Track or Global Privacy Control signal to switch off. We treat every visit as if they were on.

This website

This website has no cookies of its own, no analytics, no advertising and no scripts. Cloudflare, which hosts it, processes your IP address and the pages you ask for to deliver them and to protect the site from attacks.

Changes to this policy

We update this policy when PushUp Arena changes, and the effective date at the top shows when it last changed. If a change matters for how we use your data, we'll tell you in the app before it takes effect, and ask for your consent again where it's needed (for example, the app asks you to agree to recording again when what it records changes). When the terms of use change in a way that matters, their version number goes up and the app asks you to accept the new version.

Contact us