Privacy policy

1. Scope and controller. This Privacy Policy explains how GOPUSH collects, uses, discloses, stores and protects personal information when you use the GOPUSH app, website and related services (the "Service"). The data controller or business responsible for this information is the person or legal entity identified as the seller or developer on the GOPUSH App Store product page (the "Operator," "GOPUSH," "we," "us," or "our").

2. Read this before using GOPUSH. Fitness, body measurement and progress photo information can be sensitive. You choose whether to create an account, publish content, enable notifications, use the camera, select media, enter optional measurements or add progress photos. Some core account and workout information is required to provide requested features. If you do not agree with this Policy, do not use the Service.

3. Account and identity information we collect. We collect an internal account identifier, email address, authentication provider, username, display name, password credentials processed by Supabase Auth, sign-in tokens from Apple or Google, profile bio, link, avatar, account status and onboarding completion status. Apple may provide a relay email address. We do not receive your Apple or Google password.

4. Onboarding and fitness information. Depending on the choices you make, we collect date of birth, gender, height, bodyweight, preferred units, goals, motivation, training experience, body type, cardio preference, muscle focus, workout location, available equipment, preferred schedule and duration, injuries or limitations, best lift information and answers about what has affected your goals. We use these answers to configure the Service and create or recommend training content.

5. Workout and program information. We collect workouts, dates, duration, exercises, sets, repetitions, loads, completion status, notes, media attachments, records, custom exercises, routines, programs, schedules, saved programs, program enrollments, ratings and related training history. We also generate statistics, charts, body maps, volume calculations, progression targets, reports, achievements and similar inferences from that information.

6. Measurements and progress information. We collect bodyweight entries, weight goals, dates, custom measurement names, and measurements such as waist, chest, arms, hips, thighs, neck, shoulders, calves, forearms, body fat, height and lean body mass when you enter them. We collect progress photo files, file identifiers, dates and associated bodyweight when you add them.

7. Important clarification about progress photos. Progress photos are private to your account and are not automatically posted to the social feed. In the current Service, however, they are not device-only. Their records are synchronized through Supabase, and their image files are uploaded to private Cloudflare R2 object storage so they can be restored or synchronized. Copies also remain in the app's storage on your device. Calling these photos "private" means they are access-controlled and not socially published. It does not mean they never leave the device.

8. Social and User Content information. We collect profile information, public workout posts, workout photos and videos, routines, programs, artwork, comments, likes, follows, saves, ratings, shares, reports, blocks and related timestamps. Reports may include the reporter's username, reason, note, the reported account, reported text, and a temporary link to reported media. Search requests are sent to our backend to return matching profiles. Recent-search history may be stored locally on your device.

9. Subscription information. Apple processes purchases and payment credentials. We may receive product identifier, purchase or entitlement status, expiration date, renewal status and transaction verification information needed to unlock paid features and prevent fraud. We do not collect or store your full payment card number.

10. Device, network and log information. We and our service providers may automatically process IP address, device and app identifiers, device model, operating system, app version, language, timezone, country inferred from network information, push subscription identifier, notification permission and interaction status, request timestamps, error and diagnostic information, and basic server access logs. We use this information to deliver, secure, troubleshoot and maintain the Service.

11. Notifications. GOPUSH uses Apple Push Notification service and OneSignal for remote notifications. The OneSignal SDK initializes when the app starts and may create a OneSignal user identifier and device-level subscription identifier and process device, network, session and notification information. If you sign in, GOPUSH associates your internal account identifier with OneSignal so notifications reach the correct account. Notification permission controls whether iOS displays alerts, but it may not by itself delete identifiers already processed by OneSignal. Training reminders may be scheduled locally on your device from your workout schedule.

12. Camera and photo selection. If you allow camera access, the app receives images you capture for progress photos, avatars or workout posts. Apple's system photo picker gives the app only the photos or videos you select and does not require broad access to your library. Media selected for avatars, artwork, public posts or private progress tracking is processed according to the feature you chose. We do not collect precise location, contacts or HealthKit data in the current version of the Service.

13. Website information. The GOPUSH website does not intentionally use advertising trackers or cross-site behavioral advertising cookies as of the date above. The website host and backend may still process ordinary request logs, including IP address, browser type, requested page, timestamps and security information. Public share pages request limited preview information from Supabase. The website contact form does not transmit a message unless an active submission endpoint is displayed and configured.

14. Sources of information. We collect information directly from you; automatically from the app, website and device; from Apple or Google when you sign in; from Apple when you purchase; from other users when they interact with, mention, follow, like, comment on, block or report an account or content; and from service providers that operate the Service.

15. How we use information. We use personal information to create and authenticate accounts; synchronize data across devices; save and restore workouts and media; provide logs, plans, recommendations, progression targets, measurements, reports and statistics; operate profiles, feeds, follows, likes, comments, sharing, ratings, reports and blocks; process subscriptions; send notifications and service communications; provide support; personalize settings and content; maintain, debug and secure the Service; detect fraud, abuse and policy violations; enforce our Terms; comply with law; and establish, exercise or defend legal claims.

16. Health and fitness data. We use fitness and body information to provide features directly requested by you, such as training history, generated programs, progression suggestions, measurements and progress views. We do not use this information for third-party advertising, insurance decisions or data-broker products. GOPUSH is not a healthcare provider or a service covered by HIPAA merely because it processes fitness information. Do not use GOPUSH as the sole repository for medical records.

17. Public information and visibility. Your username, display name, bio, link, avatar, follower and following counts, workout count and public social activity may be visible to other users. Public workouts can expose workout details, text and attached media to signed-in users. Public programs and shared routines can expose their content and artwork. Public web pages may show a limited profile, workout, routine or program preview without requiring sign-in. Private workouts, measurements and progress photos are not intentionally exposed through public pages or social feeds.

18. No sale or behavioral advertising. We do not sell personal information, health or fitness information, or User Content. We do not share personal information for cross-context behavioral advertising and do not use it to serve third-party targeted advertisements. We have not sold or shared personal information for those purposes in the preceding 12 months. If this practice changes, we will update this Policy and provide any legally required controls before the change applies.

19. Supabase. We use Supabase for authentication, database storage, synchronization, server functions and some legacy object storage. Supabase processes account, profile, fitness, social, moderation and technical information on our behalf. Its privacy information is available at supabase.com/privacy.

20. Cloudflare. We use Cloudflare R2 to store user media, including avatars, workout attachments, artwork and progress photos, and use Cloudflare infrastructure to deliver media. Buckets are private unless a controlled access path authorizes a request. Cloudflare may process object data, IP addresses and request metadata. Its privacy information is available at cloudflare.com/privacypolicy.

21. OneSignal. We use OneSignal to create and manage push subscriptions and deliver remote notifications. OneSignal may process our internal account identifier, OneSignal identifiers, push token, IP address where collected, country, timezone, device information, app activity and notification interactions. Its privacy information is available at onesignal.com/privacy_policy.

22. Apple and Google. Apple processes App Store downloads, purchases, subscriptions, refunds, device notifications, Sign in with Apple and system permission flows. Google processes Google Sign-In if you select it. Their independent handling is governed by their policies at apple.com/legal/privacy and policies.google.com/privacy.

23. Automated content moderation using OpenAI. GOPUSH has no user-facing generative AI feature, but it does use OpenAI's moderation API as a safety processor. When you publish or update public content, share certain content, or set an avatar, GOPUSH may send visible text and reduced-size images to OpenAI for classification. For a video, GOPUSH sends sampled still frames, not the complete video file. This can include workout titles, descriptions, exercise notes, comments, program or routine text, avatars, artwork and post images. Progress photos that you do not publish are not sent to OpenAI for moderation. OpenAI states that API data is not used to train its models by default and may be retained for abuse monitoring as described at openai.com/enterprise-privacy.

24. Moderation results and decisions. We store moderation status, detected categories, scores or related audit information, warning history and publishing restrictions. An automated result may remove a post or comment, unpublish a routine or program, remove an avatar, issue a warning or temporarily restrict publishing. Automated systems can make mistakes. A user may ask for human reconsideration through the support contact on the GOPUSH App Store product page.

25. User reports and Telegram. When a user reports content or an account, the report is stored in Supabase. To support timely human review, GOPUSH may send a moderation card through the Telegram Bot API to a restricted administrator chat. The card can include reporter and author usernames, report reason and note, relevant profile or content text, moderation status, and a temporary signed link to the first reported photo or video. Telegram processes this information under its policy at telegram.org/privacy. Do not include unnecessary sensitive information in a report note.

26. Website hosting and other processors. We use Vercel to host the website and may use content delivery, security, email, support, professional advisory and infrastructure providers as reasonably necessary. Providers receive only the information needed for their role and are subject to contractual or legal confidentiality and security obligations where required. A provider may independently process information under its own policy when you interact directly with it.

27. Legal, safety and business disclosures. We may disclose information when we reasonably believe disclosure is necessary to comply with law, legal process or lawful requests; protect a person from harm; investigate fraud, security incidents or Terms violations; enforce agreements; protect rights and property; or establish, exercise or defend claims. We may share information in connection with a merger, financing, acquisition, reorganization, bankruptcy or sale of all or part of the business, subject to applicable law and appropriate confidentiality protections.

28. International processing. The Operator and service providers may process information in countries other than yours, including the United States and locations where they or their infrastructure operate. Those countries may have different data protection laws. Where required, we use an approved transfer mechanism or other lawful safeguard. Storage location can depend on the configured Supabase region, Cloudflare bucket location, provider routing and backup systems.

29. Retention. We retain account and service information while your account is active and as reasonably necessary to provide the Service. We retain particular records longer when needed for security, fraud prevention, dispute resolution, moderation, legal compliance, tax or accounting obligations, or to enforce agreements. Local caches and downloaded exercise media remain on a device until removed by the app, operating system or user.

30. Deletion. You may delete individual content where the app offers that control and may delete your account through Settings. Account deletion is intended to delete or de-identify account data and associated User Content from active systems, including private user media, subject to technical processing time and lawful retention. Residual copies may remain temporarily in backups, logs, fraud prevention records or moderation evidence, and material already copied or shared outside GOPUSH may remain beyond our control. Deleting an account does not cancel an Apple subscription.

31. Security. We use reasonable administrative, technical and organizational safeguards designed to protect information, including authenticated access, database access controls, private object storage, signed media links and encryption provided by our infrastructure vendors. No system is completely secure. We cannot guarantee that information will never be lost, corrupted, intercepted or accessed without authorization. You should use a unique password and protect your device and sign-in accounts.

32. Your choices. You can edit profile fields and settings, choose whether a workout is public, delete certain content, unfollow or block users, decline camera or notification permission, choose specific items through Apple's photo picker, manage notifications in iOS and in-app settings, cancel a subscription through Apple, sign out, and delete your account in Settings. Some features will not work without the information or permission they require.

33. Your privacy rights. Depending on where you live, you may have rights to know or access personal information; obtain a portable copy; correct inaccurate information; delete information; restrict or object to processing; withdraw consent; opt out of sale, sharing or targeted advertising; limit certain uses of sensitive information; and appeal a refusal. You may also complain to your local data protection authority. These rights can be subject to exceptions.

34. Exercising rights. Use in-app Settings for account deletion and available corrections. For access, portability, objections, appeals or other requests, contact the Operator through the current support contact on the GOPUSH App Store product page. We may need to verify that the request belongs to you. An authorized agent must provide proof of authority, and we may still verify the request directly with you. We will not discriminate against you for exercising a privacy right.

35. EEA, United Kingdom and Switzerland. Where these laws apply, we process information to perform our contract with you, including providing accounts, synchronization, requested fitness features, social functions and subscriptions; for legitimate interests in security, support, service improvement, moderation and enforcing rules, balanced against your rights; with consent for optional permissions and sensitive information where consent is required; and to comply with legal obligations or protect legal claims. You may withdraw consent at any time, but withdrawal does not affect earlier lawful processing. You may object to legitimate-interest processing and contact your supervisory authority.

36. Sensitive information. Some jurisdictions may treat body measurements, injuries, progress photos, fitness activity, date of birth, gender or account credentials as sensitive information. We use this information only for the Service purposes described here, security, legal compliance and claims. We do not use sensitive information to infer characteristics for advertising. Where law requires consent for this processing, you provide it by affirmatively choosing to enter or upload the sensitive information after receiving this notice, and you may withdraw it by deleting the information or account and contacting us.

37. California and similar United States privacy laws. In the preceding 12 months, we have collected the categories described above, which may include identifiers; customer records; protected classification information you choose to provide; commercial subscription information; internet or electronic activity; approximate location inferred from IP address; audio, electronic, visual or similar media; professional information if included in a profile; sensitive personal information; and inferences about training. We collect, use, retain and disclose these categories for the business and commercial purposes stated in this Policy and disclose them to the provider categories stated above. We do not sell or share them for cross-context behavioral advertising. Where applicable, residents may exercise rights to know, access, correct, delete, obtain portability, limit certain sensitive-information uses, opt out and appeal as described in Sections 33 and 34.

38. Children. The Service is not directed to children under 16 and they may not create accounts. We do not knowingly collect personal information from a child who does not meet the minimum age. If we learn that we have done so, we may suspend the account and delete the information. A parent or guardian who believes a child provided information should contact the Operator through the support contact on the GOPUSH App Store product page.

39. Automated decision-making. GOPUSH uses rules and algorithms to generate workouts, suggestions, rankings, statistics and moderation classifications. Training outputs are advisory and do not create legal or similarly significant effects. Moderation can affect content visibility and publishing access, as described above, and a user may request human reconsideration. We do not use solely automated processing to make decisions about employment, credit, insurance, housing or similar legal rights.

40. Changes to this Policy. We may update this Policy when data practices, providers, features or laws change. We will post the updated version and revise the date above. If a change materially affects your rights or the way sensitive information is used, we will provide additional notice or seek consent where required.

41. Contact. Privacy questions, rights requests and complaints should be directed to the Operator using the current support contact identified on the GOPUSH App Store product page. The seller or developer identification on that page is the legal identity of the controller for this Policy. For account deletion, the fastest method is Settings, then Delete Account, inside GOPUSH.