This Privacy Policy explains how PushWars ("we", "us", "our") collects, uses, and protects personal data when you use the PushWars iOS application and related services (the "Service").
The data controller (and, for California purposes, the business) is Triple R Ventures Ltd, registered in the United Kingdom, number 16984900, contact address Unit 6, Honeyholes Lane, Dunholme, Lincoln, LN23SU, United Kingdom.
Privacy contact: [email protected]
We are a small operation and do not carry out large-scale processing of special-category data, so we are not required to appoint a Data Protection Officer; the privacy contact above handles all data-protection matters. We comply with the EU GDPR and UK GDPR (and the UK Data Protection Act 2018) for EEA and UK users, and the California Consumer Privacy Act, as amended by the CPRA (CCPA), for California residents. This policy is privacy-by-design and data-minimizing: we collect only what we need to run the product, never "just in case."
PushWars's games are controlled by your push-ups, tracked through your device's camera. This is the most sensitive-seeming part of the product, so we're explicit about exactly what happens to that data:
| Category | Examples | Source |
|---|---|---|
| Account / contact | Email address, display name, authentication identifiers, sign-in events | You, via our sign-in provider (Apple / Google / email) |
| Fitness / gameplay data | Rep counts, session duration, workout activity, streaks, XP, tier, per-game level progress, high scores | Generated by the on-device detection engine described in §2 |
| Avatar / customization | Your selected avatar presets, outfit, and gear choices | You, in the Character customizer |
| Leaderboard data | Display name, tier, rank, score — visible to other users of the Service | Generated from your gameplay |
| Subscription data | Subscription status, plan, entitlement state, purchase receipts | Apple, via our subscription-management provider — we never see or store your card details |
| Device & diagnostics | App version, device/OS info, product-interaction events | Automatically, via the app and our product-analytics provider |
| Install / marketing attribution | Which marketing source or campaign led to your install, your device's vendor identifier (IDFV), limited device/network signals used for that measurement, and — only if you allow tracking — Apple's advertising identifier (IDFA) | Automatically at install, via our attribution providers — see §6 |
| Support & security | Your email address and message if you contact support or ask to be notified at launch; and the IP address and approximate country of such requests, used to rate-limit, prevent spam and abuse, and keep the Service secure | You (email & message); automatically (IP & country) |
We do not collect precise GPS location, your contacts, or health/medical data. We do not ask for or store your payment-card number.
Advertising identifier and the tracking prompt. PushWars shows Apple's App Tracking Transparency (ATT) prompt. Your answer decides what happens next, and nothing advertising-related starts until you have answered:
You can change your mind at any time in iOS Settings → Privacy & Security → Tracking. Turning it off stops IDFA collection from that point on.
Not included in this version of PushWars. An earlier build had a push-up alarm and an app-blocking feature; both were removed before release. The app ships no Screen Time (Family Controls) entitlement and requests no alarm or notification permissions, so there is nothing here for us to collect.
If either feature returns in a future version, this section will describe it before it ships. As designed, the alarm schedule and blocked-app selections would be stored only on your device using Apple's own frameworks and would never reach our servers.
| Purpose | Data used | Lawful basis (GDPR) |
|---|---|---|
| Create and run your account; deliver the subscription you bought | Account, subscription | Contract (Art. 6(1)(b)) |
| Track your progress, XP, tier, and unlocks | Fitness/gameplay data | Contract |
| Run leaderboards | Display name, tier, score | Contract |
| Keep the Service secure, prevent cheating and abuse | Usage, device, identifiers | Legitimate interests (Art. 6(1)(f)) |
| Product analytics to improve the app | Interaction events, app version, device/OS info | Legitimate interests |
| Measure which marketing source led to your install, and which campaigns work | Install/device identifiers (IDFV), campaign data, conversion milestones (e.g. that a registration or subscription happened) | Legitimate interests (Art. 6(1)(f)) |
| Cross-company advertising measurement using the advertising identifier | Apple's advertising identifier (IDFA), campaign and conversion data | Consent (Art. 6(1)(a)) — given through Apple's ATT prompt, withdrawable at any time in iOS Settings → Privacy & Security → Tracking |
| Send service emails (e.g. account confirmations) | Email address | Contract / Legal obligation |
We do not carry out automated decision-making producing legal or similarly significant effects on you (Art. 22). Automated anti-cheat checks may temporarily hold a leaderboard entry pending manual review, but never take a lasting action without human review.
We never sell your personal data. We do send Meta a limited set of app events so we can measure and optimize our advertising — described in full in §6. Because Meta may use those events to improve ad delivery on its own platforms, we do not claim they fall outside California's definition of "sharing" for cross-context behavioral advertising; we treat them as in scope and give you an opt-out (§9). If you allowed tracking at the ATT prompt, Apple's advertising identifier (IDFA) may also be involved; if you declined, it is not.
We share data only with the categories of service providers needed to run the Service. Each is bound by a data-processing agreement and processes data only on our instructions. We don't publish the specific names of every processor here — that's not required by GDPR or CCPA, which both require disclosure by category and purpose, not by vendor name — but we can tell you exactly who holds your data if you make a formal access request (§9).
| Category of recipient | Purpose | Data shared |
|---|---|---|
| Authentication provider | Sign-in and account security | Email, display name, sign-in events |
| Cloud hosting & database providers | Running the backend, storing your account and progress | All structured account/gameplay data in §3 |
| Subscription-management provider | Processing your subscription via Apple's In-App Purchase | User ID, subscription state, receipts |
| Product analytics provider | Understanding how the app is used, improving it | User ID, event/device data |
| Meta Platforms, Inc. | Measuring and optimizing our advertising on Meta's platforms — see the note below this table | App install/session and purchase events and a short list of conversion milestones; Apple's advertising identifier (IDFA) only if you allowed tracking — never your email, name, account identifier, camera data, or body/pose data |
| Marketing-attribution provider | Measuring which install/marketing source brought you to the app, so we know which campaigns are worth running | IDFV, campaign/install data, and a small set of conversion milestones (registration, subscription, tutorial completion); IDFA only if you allowed tracking — never your email, name, account identifier, camera data, or body/pose data |
| Apple Inc. | App Store distribution, In-App Purchase, Sign in with Apple, the on-device frameworks described in §2 and §4 | Standard App Store data; on-device data never reaches Apple through us |
How our attribution works, and what your ATT answer changes. To know which adverts and channels actually bring people to PushWars, we use a mobile-measurement provider. It always uses your device's vendor identifier (IDFV — specific to us, and unusable to follow you into other companies' apps) together with Apple's privacy-preserving SKAdNetwork mechanism, which reports campaign performance in aggregate rather than identifying you. If you allow tracking at the ATT prompt, it may additionally use Apple's advertising identifier (IDFA), which is shared across companies and is what makes this "tracking". If you decline or your device restricts tracking, no IDFA is collected, and we put the provider into its limited-data mode, which disables cross-company data sharing. No email address, no display name, no account identifier, and nothing whatsoever from the camera pipeline described in §2 is ever sent to either recipient.
What Meta receives, precisely. The app includes Meta's measurement SDK so we can tell which Meta adverts work. It sends two kinds of event, and we would rather spell both out than imply the list is shorter than it is:
None of it is attached to your email, display name, or your PushWars account identifier — we deliberately do not give Meta or our attribution provider an account identity. Whether Meta's SDK may use Apple's advertising identifier follows your ATT answer: allowed means it may collect the IDFA, declined means it may not, and we mirror that setting on every app launch rather than caching an old answer. Meta receives these events for measurement and for its Aggregated Event Measurement, and may use them to improve ad delivery on its own platforms — so we treat this as "sharing" under California law rather than arguing it is not (§5, §9). If you would prefer we stop sending them for your account, email [email protected] and we will action it.
We may also disclose data where required by law, to enforce our Terms, to protect rights and safety, or in a business reorganization, merger, or sale (with your data kept protected).
Still absent: we do not use any AI/LLM provider to process your data, and we never sell your data. The iOS app itself ships no crash-reporting SDK. Our backend does use a third-party error-monitoring service to capture server-side errors, which can include an account identifier and the technical details of a failed request; it never receives camera or body/pose data.
Some service providers are located in the United States. Where we transfer personal data outside the UK/EEA, we rely on appropriate safeguards — principally the EU Standard Contractual Clauses and the UK International Data Transfer Addendum — together with each provider's data-processing agreement.
| Data | Retention |
|---|---|
| Camera frames / pose data | Never stored — zero retention, by architecture |
| Active account | While your account exists, deleted within 30 days of a deletion request |
| Account created but never subscribed | Purged after 30 days |
| Lapsed subscription | Purged 180 days after it lapses |
| Individual workout/session records | 24 months, then aggregated into rollups (your lifetime totals are preserved regardless) |
| Progression, XP, inventory, lifetime totals | Life of the account |
| Leaderboard entries | Life of the account; removed on deletion |
| Analytics events | 12 months |
| Attribution / install-source records | 12 months |
| Advertising-measurement events shared with Meta (§6) | Held by Meta under its own retention policy; we hold no copy |
| Backups | 30 days |
| Support & launch-notify correspondence | Up to 24 months, then deleted; launch-notify emails are deleted once we've sent the single launch notice or on request |
We do not discriminate against you for exercising these rights.
You have the right to know/access, delete, and correct your personal information, to opt out of the "sale" or "sharing" of it, and to limit the use of sensitive personal information. We do not sell your personal information, and we have never accepted money for it.
On "sharing": our mobile-measurement provider (§6) acts as our service provider for measuring install sources. If you allowed tracking at the ATT prompt it also receives Apple's advertising identifier; declining stops that and puts the provider into limited-data mode. You can withdraw at any time in iOS Settings → Privacy & Security → Tracking, which is also the fastest way to opt out of cross-context behavioral advertising. Meta, however, receives the app events listed in §6 and may use them to improve ad delivery on its own platforms. We do not rely on a narrow reading to put that outside CPRA's definition of "sharing" for cross-context behavioral advertising — we treat it as sharing and honour opt-outs. To opt out, email [email protected] with the account's email address and we will stop sending events for your account. We do not knowingly share the personal information of anyone under 16.
You may also exercise your other rights via the in-app tools above or the same address. An authorized agent may submit a request with proof of authorization. We will not discriminate against you for exercising these rights.
When you choose Delete Account, we:
Deletion is permanent and cannot be undone. Records we must keep for legal/tax reasons, and rolling backups, age out per §8.
We follow a privacy-by-design, minimum-data approach: per-request authentication, service-layer user isolation (every query is scoped to your account), encryption in transit, edge-level rate-limiting and bot protection, server-side-only secrets, and least-privilege access. No system is perfectly secure, but we work to protect your data and will notify you and the relevant regulator of a personal-data breach where the law requires.
The Service is for ages 13+, matching Apple's own App Store account minimum. We do not knowingly collect data from anyone under 13. If you believe someone under 13 has given us personal data, contact [email protected] and we will delete it. Users under the digital-consent age set by their country's law (which varies, and within the EU can be as high as 16 depending on member state) must have a parent or guardian's permission to use the Service.
The iOS app does not use cookies. It does show Apple's App Tracking Transparency prompt, and whether PushWars tracks you across other companies' apps depends entirely on your answer. Allow, and Apple's advertising identifier (IDFA) may be used by our attribution provider and by Meta for advertising measurement. Decline (or leave tracking off at the device level) and no IDFA is collected: install measurement (§6) then runs only on an identifier specific to us plus Apple's aggregate SKAdNetwork reporting, and our provider is switched into limited-data mode. You can change the answer at any time in iOS Settings → Privacy & Security → Tracking. Any future marketing website that uses non-essential cookies will present a consent banner for EU/UK visitors.
We may update this policy from time to time. If a change is material we will notify you (in-app or by email). The "Last updated" date shows the latest version. Continuing to use the Service after a change takes effect means you accept the updated policy.
Email: [email protected]
Postal: Unit 6, Honeyholes Lane, Dunholme, Lincoln, LN23SU, United Kingdom
You also have the right to complain to your data-protection authority (in the UK, the ICO at ico.org.uk/make-a-complaint).