GO Push IT · Your data

Privacy policy

Effective from 28 October 2026 · covers the app and the web panel

1. Controller and contact

For GO Push IT app and privacy questions, contact [email protected]. This policy covers the app and gopushit.com website.

2. Data we process and why

• Account and profile: email address, authentication data, account ID, display name, profile photo, date of birth and height. These support sign-in, your profile and training features.
• Training and activity: plans, exercises, sets, weights, repetitions, duration, records, body measurements and activity history. We use these to log workouts, calculate statistics and show progress.
• Social features: crews, friendships, events, posts, comments, reactions, messages, photos and videos you add. These support communication and shared training. Content shared with your crew or message recipients is visible to them; do not treat it as a private notebook.
• Location: with permission, we record your GPS route, time and distance during an activity you start. Tracking may continue with the screen off during that active session. Maps load from OpenStreetMap, which receives your IP address and requests for map areas.
• Notifications: device tokens and notification preferences to deliver push notifications through Firebase Cloud Messaging.
• Optional app statistics: only with your consent — interface events, a pseudonymous app-instance identifier and technical information via Google Analytics for Firebase (section 9). No workout results, health information, messages, email address or account identifier.
• Voice, camera and files: when you use the corresponding features and grant permission. Speech recognition uses your device's system service; depending on the system and settings, its provider may process the audio. Photos and videos you send are uploaded to the app's storage.
• Web panel: the same account data as in the app. On the website you can view and change it: workouts and sets, plans, profile, body weight, chat messages and shared events. Changes are saved in the same database and appear in the app.
• Technical data: information required for connections and security, such as IP addresses and provider logs. The app also keeps a local cache and a queue of changes awaiting synchronisation.

3. Health Connect and health data

With your consent, the app reads selected data: weight, body fat percentage, lean body mass, steps, active calories, heart rate and resting heart rate, HRV, and sleep duration and stages. Apple Health / HealthKit provides the corresponding integration on iOS where that version is used.

The integration supports body measurements, activity and recovery information. The integration code requests read access, not write access to Health Connect. Daily summaries of selected data are synchronised with your account in the Supabase database — this data does not stay only on your phone. We do not sell it or use it for advertising.

The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.

You can revoke access in Health Connect or your system settings. Revoking permission stops future reads but does not delete data already synchronised. To request its deletion, email [email protected]. We do not delete source data recorded by other apps in Health Connect / Apple Health.

4. Legal bases

We rely on performance of the service contract for your account and the features you use (GDPR Article 6(1)(b)). Optional health data processing requires your explicit consent (Article 9(2)(a), together with Article 6(1)(a)). We rely on legitimate interests for security and legal claims (Article 6(1)(f)) and legal obligations where applicable (Article 6(1)(c)). Optional app statistics (section 9) rely on your consent (Article 6(1)(a)). A system permission does not replace the information and consent required by law.

5. Recipients and service providers

• Supabase: authentication, database, synchronisation and app file storage. The project runs in the Central EU (Frankfurt, eu-central-1) region. The data processing addendum is with Supabase Pte. Ltd. (Singapore); transfers outside the EEA are covered by the EU Standard Contractual Clauses (Module Two). Subprocessor list: supabase.com.
• Google / Firebase Cloud Messaging: push delivery; this does not mean Google receives your full workout history.
• Google / Google Analytics for Firebase: optional app statistics, only with your consent (section 9).
• Cloudflare: gopushit.com hosting, domain DNS and cookieless visit statistics (section 8).
• OpenStreetMap: map display and map tile requests.
• Your system speech-recognition provider: when you use voice input, depending on device and configuration.
• Namecheap: domain registration and forwarding of email sent to our contact address; Google / Gmail: the mailbox where we receive that correspondence.
• Other users with whom you share content, and authorised public bodies where required by law.

Providers may also process data outside the EEA. This happens under their data processing agreements and the mechanisms provided for in the GDPR, in particular the EU Standard Contractual Clauses. We do not claim that all data stays in the EU.

6. Retention

We retain account data, workout history and synchronised measurements while you use your account, until you request deletion of the data or account. We complete deletion requests within 30 days of receipt. If we need to verify that the account belongs to you, we will contact you. We never ask for your password.

A legal obligation or the establishment, exercise or defence of legal claims may require us to retain a limited amount of data. We will explain the reason, scope and retention period. Deleting an account does not remove copies other users have independently saved outside the app.

The app database has no backups, so deleted data does not remain in our copies. The database provider keeps technical logs for 1 day. We keep correspondence for up to 12 months after the last message. We keep confirmation that a GDPR or account-deletion request was completed (date and scope, without workout data) for 3 years, in case of claims or inspections.

7. Your rights and account deletion

You may request access, correction, erasure, restriction of processing and, where applicable, portability, and object to processing. You may withdraw consent at any time without affecting the lawfulness of previous processing. You may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).

Send requests to [email protected]. See GO Push IT account and data deletion. In the app version released on Google Play you can delete your account yourself: Settings → Delete account. You can download your own data in the web panel (Account → CSV export) or in the app (Excel export).

8. Website

This website uses no cookies, advertising scripts or externally hosted fonts. Fonts, images and styles are served from the same domain. The website is served by Cloudflare (hosting and content delivery network), which processes connection data on every visit, such as your IP address and browser headers, to deliver the site and protect it from abuse. We count visits with Cloudflare Web Analytics, without cookies and without storing anything in your browser. We only see aggregate statistics, such as page views, the referring page, country, device and browser type, and page load time; we do not link them to your app account. The legal basis is our legitimate interest (Article 6(1)(f) GDPR): keeping the site working well and knowing which content is useful. The provider is Cloudflare, Inc. (USA); data may be processed outside the EEA under Cloudflare’s data processing terms, including the EU standard contractual clauses. Selecting an email link opens your email application; the website does not send a message itself.

The web panel connects to the same Supabase project as the app: for sign-in (accounts are created in the app) and reading and saving your account data, with the same permissions as the app — you only see and change what you can access in the app. The authentication session is kept in browser-tab session storage (sessionStorage) and disappears when you close the tab. Passwords are not saved in website files or logs. Logging out on the website ends only its own session, not the app’s. Chat on the website updates through a WebSocket connection to Supabase Realtime. CSV export files are created in your browser.

9. Optional app statistics (Google Analytics for Firebase)

With your freely given consent, we use Google Analytics for Firebase to understand general app use and improve the interface. The legal basis for processing personal data for this purpose is consent, Article 6(1)(a) GDPR. This choice is separate from creating an account and enabling app features. Refusing does not limit your account or workouts. Measurement runs only in the Android app installed from Google Play, and only after you consent.

Our events cover the start of measurement, attempts and successful sign-ups and logins (by email or with a Google account), password reset requests and completions, and visits to selected basic screens: home, sign-in, registration, password reset, settings, plan and exercise library. We do not add your email address, name, account identifier or its hash, passwords, tokens, health information, workout results, GPS location, messages or other content you enter to these event parameters. Other screens — including workout, health, chat and body measurement screens — are not measured, nor are workout completion or GPS activity.

Google’s SDK also processes a pseudonymous app-instance identifier and technical and usage information, such as app version, operating system, sessions and engagement; it may derive approximate location from an IP address. These data are not fully anonymous. We do not link the identifier to your account, set a User-ID or add our own tracking identifier. The property is not linked to Google Ads or Google Ad Manager and Google Signals is turned off, so we do not use these statistics for advertising; advertising identifier collection is disabled.

You may refuse or withdraw consent at any time with the “Optional statistics” button on the sign-in and registration screens and in app Settings. We store your choice locally for this installation. Signing out or switching accounts turns measurement off, and it stays off until you choose “Allow” again. Withdrawal stops further measurement and clears the local measurement state on your phone, but cannot undo transmissions already made and does not by itself erase historical data held by the provider. It does not affect the lawfulness of processing previously based on valid consent. The gopushit.com website and web panel do not use these app statistics; website visit statistics are described in section 8.

In GA4 we keep event-level data for 2 months and user-level data for 14 months. Each new activity in the app with measurement turned on restarts the retention period for user-level data. Deletion follows the provider’s processing cycles, while standard aggregated reports have separate retention rules.

Under the Polish terms, the Google Analytics provider is Google Ireland Limited. Processing may involve entities and infrastructure outside the EEA; we do not promise storage exclusively in Poland or the EU. Information about applicable safeguards, recipients and subprocessors is provided according to the relevant agreements. See Google’s privacy policy.

The rights described in section 7 also apply to these data. Because statistics are not linked to accounts, an email address alone may not identify a statistical record; we do not create such a link solely for analytics. Contact: [email protected].

10. Policy updates

The current version is available at this address with its update date. We will communicate material app-related changes as appropriate.