Trust & Security
Last updated: 10 October 2026
Pushi is operated by Phillip Stuart from Vienna, Austria (see the Legal notice) and is the data controller for the personal data of everyone who uses the app, the website, and the organisation portal. Account, challenge, and activity data is hosted in the European Union. This page summarises where that data lives, how it is protected, and which providers help us run the service. The full detail is in our Privacy Policy.
Where your data lives
Account, challenge, and activity data is stored in Supabase's EU region in Ireland. The organisation portal's server code runs in Dublin, Ireland. This website and all email we send are hosted by easyname in Austria, and our website analytics are hosted in Umami's EU region in Germany.
Personal data is not transferred outside the European Economic Area (EEA) in the normal course of operating the service, except to the sub-processors named below, each of which receives only the limited data listed and under the safeguard shown.
Security
- Data is encrypted in transit (TLS) and encrypted at rest by our database provider.
- Row-level security is enabled on every table in our database, so a signed-in user can only reach the rows they are entitled to see.
- Access to production systems is limited to named individuals.
- Card details for organisation payments are entered on Stripe's payment page and are never stored by Pushi.
- Raw heart rate, and the age, sex, height, and weight used to calculate your Move goal, are processed on your device and never uploaded.
- Pushi only reads health data. It never writes to Apple HealthKit or Google Health Connect.
Sub-processors
These providers process personal data on our behalf in order to run Pushi.
| Provider | Purpose | Data location | Transfer safeguard |
|---|---|---|---|
| Supabase | Database and backend | EU (Ireland) | Not required |
| Vercel | Portal hosting and cookieless portal analytics | EU (Dublin) for the portal; aggregated analytics and hosting logs in the USA | EU–US Data Privacy Framework |
| easyname | Website hosting and all email we send | EU (Austria) | Not required |
| Stripe | Organisation payments | EU (Ireland) and USA | EU–US Data Privacy Framework |
| Apple (APNs) | iOS push notifications | USA | EU–US Data Privacy Framework |
| Google (FCM) | Android push notifications | USA | EU–US Data Privacy Framework |
| Umami | Website analytics (cookieless) | EU (Germany) | EU Standard Contractual Clauses in Umami's data processing agreement |
| Anthropic | AI Activity Suggestions (opt-in only, no identifiers) | USA | EU–US Data Privacy Framework |
Apple HealthKit and Google Health Connect run on your device: Pushi reads activity data from them with your permission, and they are not sub-processors. A few other services receive data under your own relationship with them rather than on our behalf, such as Sign in with Apple and Google Sign-In, the App Store and Google Play for Pushi Pro, and Apple Maps and Google Maps for workout routes. They are described in section 6 of the Privacy Policy.
For organisations
On request we provide our data protection impact assessment, a fuller description of our security measures, and answers to your security questionnaire. Members consent to Pushi's processing of their data in the app, and separately acknowledge your access to their challenge activity when they join your challenge, so you do not need to obtain separate consents from your members for Pushi's processing. The details are in section 6 of the portal terms.
Contact
For privacy questions and document requests, contact us at hello@pushi.fitness.