Privacy Policy · PushGate
Last updated: 10 September 2026
Unofficial English translation for your convenience. The German version (Datenschutzerklärung) is the legally binding version; in case of any discrepancy between the language versions, the German version prevails (§ 14).
1. Controller
Raphael Stedler
c/o Autorenglück #65419
Albert-Einstein-Str. 47
02977 Hoyerswerda, Germany
Email: contact@pushgate.app
(see Legal Notice)
2. Principle
PushGate is built to minimize data collection: there is no user account and no sign-in. Camera footage and the motion data derived from it never leave the device, that promise holds without exception and without any consent proviso (section 3.5).
Your block list, your training sets, your statistics and your settings are held in your device's app storage (sections 3.1 to 3.6). Beyond that, we process data in two cases:
- Subscription (section 3.7), needed so the app knows whether you have paid. Handled by Apple or Google, with no service provider in between.
- Product analytics and subscription measurement (section 3.8), only with your consent.
We ask about the second case during onboarding, after the age check and with nothing pre-selected. You can withdraw at any time (Profile → Privacy). The app works fully if you decline, no feature depends on your consent (Art. 7 (4) GDPR).
Advertising identifiers (IDFA, Advertising ID) are not used, and no cross-app tracking takes place.
3. What data is processed
Sections 3.1 through 3.6 describe data that is processed and stored on your device, including subsections 3.3a and 3.6a, which are covered wherever this policy writes "3.1 to 3.6". It is not transmitted to us and not to any third party, with one exception that requires your consent: individual figures derived from 3.2 and 3.4, named explicitly in section 3.8, are sent out if you have consented to product analytics. Nothing from 3.3a is ever sent out, not even with consent. The underlying records themselves always stay local.
3.1 Gate settings and blocked targets (local)
The number of repetitions you set as a prerequisite, how long a grant lasts, and which apps/domains/categories you block. On Android as a package name (e.g. the name of a social media app); on iOS, for technical reasons, as an identifier managed by the system that the app cannot read.
3.2 Sessions (completed training sets, local)
Per completed attempt: start and end time, number of repetitions achieved, target count, whether the target was reached, day. No camera footage, no raw motion data, only these numbers and timestamps.
With consent under section 3.8, one event per completed set is sent out (repetitions, target, duration). The list of sessions itself stays local.
3.3 Override events (local)
If you open a blocked app via an exception function without training, this is logged with a timestamp and the app concerned, for your own history view, not for advertising purposes, and only on the device.
3.3a Time spent in blocked apps (daily total, local)
PushGate counts how long you spent, in total on a given calendar day, in the apps you blocked yourself. The value exists solely to display your own progress inside the app (your "aura" grows with the repetitions you complete and shrinks with this time).
What is stored is one total per day across all blocked apps combined, no per-app breakdown, no timestamps, no sessions. The last 21 days are kept; older days are overwritten.
The value does not leave your device, not even with your consent under section 3.8. It is part of neither an event nor any analysis.
How it is produced differs by operating system, and that is a technical constraint:
- Android: from the time a blocked app spent in the foreground, measured by the accessibility service (see section 3.6), and only during a window you unlocked yourself.
- iOS: Apple's framework tells the app no usage duration and no app names. It only reports that the selection you chose has crossed a given time threshold (in steps of 15 minutes). The total is therefore a lower bound in steps, not an exact time.
Counting happens only while blocking is switched on. If you switch it off, counting stops.
3.4 Challenges, achievements, and onboarding answers (local)
Progress on challenges, confirmations of achievements earned, and the answers you give during onboarding (such as usage motives and goals). The onboarding answers merely drive the app's default settings.
The chosen answer value itself never leaves the device, not even with consent. What goes to product analytics (section 3.8) is only which question was answered and whether it was single or multiple choice, not what you answered. That is a deliberate restriction: statements about fitness goals and motives come close to Art. 9 GDPR, and they are not needed to measure the funnel.
For the age check during onboarding you enter a date of birth. It is not stored: the app immediately derives only the outcome (use and/or subscription permitted or not) and discards the date.
3.5 Camera and motion data: covered separately because it is particularly sensitive (local)
To count repetitions, the app uses the front-facing camera and a pose detection model (Apple Vision framework on iOS, ML Kit Pose Detection with a model bundled in the app package on Android). This processing takes place exclusively locally on your device. Neither camera footage nor raw data derived from it (joint positions or similar) is stored or transmitted to our servers or to third parties. Only the numbers listed in section 3.2 are produced.
3.6 Accessibility service (Android only, local)
To detect when a blocked app comes to the foreground, the Android version uses an accessibility service. It reads only the package name of the app currently in the foreground from window change events, no screen content, no text input, no screenshots. The information is evaluated locally only, in order to show the gate, and does not leave the device.
On iOS, Apple's Family Controls / Screen Time framework is used instead, which for technical reasons does not permit app detection outside Apple's own sandbox.
3.6a Screen time projection during onboarding (iOS only, local)
If you grant the Screen Time permission during onboarding, PushGate shows you a one-off projection of your device usage: how many days per year and how many years of your life the last seven days add up to.
These figures are not produced inside the app. Apple's framework hands
the usage data only to a separate system extension (DeviceActivityReport)
that draws the screen, the app itself never sees the usage duration nor the names of the
apps used. That extension has no shared storage with the app and no
network access. The figures are not stored, are not included in any event, and do not
leave the device.
PushGate additionally uses a second, separate system extension responsible solely for blocking: it learns that a time threshold was crossed and puts the block back in force. Only that one has shared storage with the app, and this is the route by which the daily total in section 3.3a comes about. It, too, learns no app names and no usage duration, only that a threshold was crossed, and it, too, has no network access.
Without the permission the screen is skipped entirely.
3.7 Purchase/subscription data: the only outbound data flow
Purchases are handled entirely through Apple's App Store or Google Play. We receive neither payment-method nor billing data. There is no service provider between the app and the platform: the app talks to the operating system's own purchase handling (Apple StoreKit, Google Play Billing) directly.
Whether a subscription is active ("yes/no") is what the platform tells the app, and the app stores it on the device only. We do not receive that answer; there is no identifier under which we could hold it, and no PushGate account. The subscription is tied solely to the platform identity (Apple ID or Google account). On a new device it is reactivated via "Restore purchases"; the platform performs that matching, not we.
The statement that there is no service provider between the app and the platform remains correct even with RevenueCat, the service named in section 3.8: the purchase still goes directly through StoreKit or Play Billing, and the "subscription active yes/no" answer that unlocking depends on comes from the operating system. RevenueCat observes completed purchases after the fact, for measurement, it decides nothing and is not necessary for providing the paid service. That is precisely why it appears in 3.8 rather than here, and precisely why it depends on your consent.
3.8 Product analytics and subscription measurement: only with your consent
If you consent, we send events about how the app is used, so we can see where people drop out of onboarding, whether a change makes the app better, and how many trials convert into a paid subscription.
What is sent:
- event name and timestamp (e.g. "onboarding step shown", "gate cleared", "trial started"),
- which onboarding question was answered and whether it was single or multiple choice, not the chosen value (section 3.4),
- counts for a completed set: repetitions, target, duration,
- the age band as a category ("16–17", "18+"), never a date of birth,
- for a purchase: product identifier, amount and currency, length of any trial,
- the installation ID (a random identifier created only once you consent, see section 8),
- technical context: app version, operating system and version, device model, language, truncated IP address.
What is explicitly not sent: no camera footage, no motion data, no names of the apps or domains you block, no time spent in blocked apps (the daily total from section 3.3a and the "aura" display derived from it stay local), no onboarding answer values, no free text, no advertising identifier, no email address, no name. This is not merely a promise: before sending, the app filters events against a fixed allow list of permitted field names, anything not on it cannot go out.
Recipients:
| Provider | Role | For what |
|---|---|---|
| PostHog, Inc., 2261 Market St. #4008, San Francisco, CA 94114, USA | processor (Art. 28 GDPR) | product analytics. Stored on the EU instance (data centre Frankfurt am Main) |
| RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA | processor (Art. 28 GDPR) | subscription measurement: conversion from trial to paid, renewal, cancellation, refund |
RevenueCat learns your subscription history from Apple or Google. It is the only measurement that still yields data when the app is closed, otherwise it would be impossible to tell whether a trial converts. RevenueCat receives no advertising identifier and no usage data from sections 3.1 through 3.6a.
Legal basis: Art. 6 (1)(a) GDPR (consent) and § 25 (1) TDDDG for storing and reading the installation ID on your device.
We deliberately do not rely on legitimate interests (Art. 6 (1)(f)): § 25 TDDDG provides no balancing test for access to your device in the first place. And we deliberately do not rely on contractual necessity (Art. 6 (1)(b)) for the RevenueCat part, even though it concerns your subscription: unlocking works without RevenueCat, it depends on the operating system's answer (section 3.7). A service that is not necessary to provide the service cannot be presented as necessary.
Retention: events at PostHog are retained for 12 months; that is the retention period of the plan we use. The provider deletes them afterwards without committing to a fixed point in time, so we cannot promise a to-the-day deletion deadline. If you want deletion sooner, or with certainty, the deletion request under section 8 is the reliable route; we act on it using your installation ID. RevenueCat keeps the installation ID and subscription history for as long as we use the service for measurement; on request under section 8 we delete the corresponding record earlier.
Withdrawal: at any time under Profile → Privacy, using the same switch you used to consent. Withdrawal takes effect immediately: from that moment no further events are sent, and the installation ID is deleted on your device. The lawfulness of processing carried out until then remains unaffected (Art. 7 (3) GDPR). To delete events already transmitted, see section 8.
If you decline: The app continues to keep an event log, but exclusively on the device (ring buffer with automatic rotation, section 10). It is not transmitted, and it is not sent retroactively if you consent later, consent does not work backwards.
4. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Gate settings, blocked targets, sessions (local) | Core app functionality | Art. 6 (1)(b) GDPR |
| Override events, achievements, challenges, onboarding answers (local) | Contractual function / statistics for yourself | Art. 6 (1)(b) GDPR |
| Camera/pose processing (local, transient) | Counting repetitions | Art. 6 (1)(b) GDPR |
| Subscription status (local, from the platform's answer) | Unlocking the app | Art. 6 (1)(b) GDPR; § 25 (2) no. 2 TDDDG for storage on the device |
| Product analytics and subscription measurement (section 3.8) | Improving the app, measuring subscription conversion | Art. 6 (1)(a) GDPR (consent); § 25 (1) TDDDG |
| Server logs of the website (section 13) | Secure provision | Art. 6 (1)(f) GDPR |
| Android waitlist (section 13) | Notify you once when the app appears on Google Play | Art. 6 (1)(a) GDPR |
To use the app you do not have to provide any personal data, no email address, no password, no name. There is no registration. No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place; which apps are blocked and how many repetitions are required is determined solely by you.
Special categories of personal data (Art. 9 GDPR): no physiological measurements, no camera or raw motion data, and no information about illnesses is stored. Repetition counts and timestamps as well as the blocking settings you choose are stored locally; in our assessment these are not health data within the meaning of Art. 9 GDPR, because they say nothing about your state of health. Since this data does not leave the device, no processing by us takes place in any case.
5. Recipients and processors
We operate no backend of our own that receives app data. Recipients exist in connection with the subscription and, only with your consent, for measurement:
| Provider | Role under data protection law | What they receive | Basis |
|---|---|---|---|
| Apple (App Store) | independent controller | purchase data | their own privacy policy |
| Google (Play Store) | independent controller | purchase data | their own privacy policy |
| PostHog, Inc. | processor (Art. 28) | events per section 3.8, installation ID, truncated IP | DPA under Art. 28 GDPR |
| RevenueCat, Inc. | processor (Art. 28) | installation ID, purchase receipt and subscription history per section 3.8 | DPA under Art. 28 GDPR |
| Hetzner Online GmbH | processor (Art. 28) | website server logs and Android waitlist (section 13) | standard DPA under Art. 28 GDPR |
Apple and Google act on their own responsibility under their own privacy policies, not on our instructions. A data processing agreement under Art. 28 GDPR is neither intended nor possible for this relationship.
For the data listed in sections 3.1 through 3.6 there is no recipient, apart from the consent-dependent exception for individual figures from 3.2 and 3.4 that section 3.8 names explicitly. Camera footage and motion data have no recipient under any circumstances.
Without consent, PostHog and RevenueCat remain entirely unused: the app does not even configure them, they are not merely muted.
Our website (not the app) is hosted on a server operated by us at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data centre in the EU), a processor pursuant to Art. 28 GDPR. It receives only the server logs described in section 13. Hetzner provides the DPA as a standard agreement for click-through conclusion in the Hetzner Cloud console account (account settings → data processing); since both Hetzner and the data centre are located in the EU, no third-country assessment is required for this. The DPA was concluded on 9 September 2026.
6. Transfers to third countries
For the transfer, the following applies per recipient (as reviewed on 8 Sep 2026):
- Google LLC: certified under the EU-US Data Privacy Framework (entry verified on 26 Aug 2026 at dataprivacyframework.gov).
- Apple Inc.: not listed in the Data Privacy Framework registry. Transfers are based on Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Module 2) and/or the Global Cross-Border Privacy Rules (CBPR) System.
Apple and Google act as independent controllers for the payment; the transfer happens between you and the respective platform, not through us. - PostHog, Inc. (USA): event data is stored on the EU instance (data centre Frankfurt am Main). Access from the US is nonetheless not ruled out (support, maintenance, sub-processors). Basis: in its data processing agreement PostHog states that it participates in the EU-US Data Privacy Framework including the UK extension and the Swiss-US Framework (self-certification, statement verified on 8 Sep 2026); the Standard Contractual Clauses (Module 2) from the same agreement apply in addition. - RevenueCat, Inc. (USA): not certified under the Data Privacy Framework (verified on 8 Sep 2026). Transfers based on Standard Contractual Clauses (Module 2, controller to processor) as part of the DPA. RevenueCat names those clauses in its own Data Processing Addendum as the basis for transfers out of the EEA. - Hetzner Online GmbH: Germany, data centre in the EU. No third-country transfer.
We will provide a copy of the applicable safeguards (Standard Contractual Clauses) upon request to the email address given in section 1.
For the data listed in sections 3.1 through 3.6 no transfer takes place outside the consent described in section 3.8, including no third-country transfer. For camera footage and motion data this holds without exception.
7. Retention
The locally stored data (sections 3.1 through 3.6) remains on your device for as long as the app is installed. A shorter period applies to the daily total in section 3.3a: only the last 21 days are kept, and older days are overwritten on the next write. You determine the retention period yourself: uninstalling the app causes the operating system to remove it (section 8). We cannot delete it, because we do not have it.
Purchase receipts and subscription history are held by Apple or Google and subject to their retention periods. The subscription status on your device disappears when you uninstall the app.
For the consent-dependent data in section 3.8, the periods stated there apply (PostHog: 12 months retention, deletion afterwards with no committed point in time; RevenueCat: deletion on request under section 8). They run regardless of whether the app stays installed, a withdrawal stops further collection but does not by itself delete what has already been transmitted. Section 8 is the route for that.
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21), as well as the right to lodge a complaint with a data protection supervisory authority.
Withdrawing your consent (Art. 7 (3) GDPR): where we process data on the basis of your consent (section 3.8), you can withdraw it at any time, in the app under Profile → Privacy, using the same switch you used to give it. Withdrawal is exactly as easy as giving consent and takes effect immediately. The lawfulness of processing carried out until then remains unaffected.
How we can match you (the installation ID): we maintain no account, do not know your name and cannot identify you on our own (Art. 11 (1) GDPR). So that you can still exercise your rights, the app keeps an installation ID, a random identifier under which the events from section 3.8 are held at the recipients. It is created only once you consent and is deleted when you withdraw.
You do not have to write it down yourself: Profile → Privacy → "Request access or deletion" opens a prepared email with the ID already filled in (Art. 11 (2) GDPR). With it we can locate the data, give you access and have it deleted.
Without that ID we cannot process a request, because we have no other way to match you to a record. We must then inform you accordingly under Art. 11 (2) GDPR and decline the request. That is the flip side of maintaining no account.
An honestly stated limit: if you have uninstalled the app or withdrawn consent, the match is lost, for us too. Withdrawal deletes the ID on your device; it deletes nothing that was already transmitted. If you want that gone as well, send the request before you withdraw or uninstall.
For matters concerning the subscription, please contact the platform you purchased through (Apple or Google), or contact us quoting your purchase receipt number.
Deleting your local data: uninstall the app. The operating system then removes the app storage in full, including all data listed in sections 3.1 through 3.6. On Android you can also remove it without uninstalling, via Settings → Apps → PushGate → Storage → Clear data.
Right to object (Art. 21 GDPR): insofar as we process personal data on the basis of Art. 6 (1)(f) GDPR (server logs of our website, section 13), you have the right to object at any time, on grounds relating to your particular situation, to such processing. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Competent supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.
9. Minors
The app is intended for persons aged 16 and over. Concluding a paid subscription requires the user to be of legal age or to have the consent of their legal guardians (see Terms § 3). The check is performed via the age prompt during onboarding; the date of birth entered there is not stored (section 3.4).
For consent, Art. 8 GDPR applies in addition: in Germany, a child's consent to processing for analytics purposes is valid without guardian approval only from the age of 16. We implement that as follows:
- The consent dialog appears only after the age check and only if you are 16 or older. Anyone who has not completed or not passed the age check never sees it, and nothing is sent.
- In that case a service is not prepared or muted either: it is not configured at all.
10. Identifiers on your device, tracking, advertising
This section discharges the reservation stated in the previous version: an analytics service has been added, and this is the corresponding update.
Cookies: The app uses no cookies.
Identifiers stored on or read from your device:
| Identifier | Purpose | Consent required? |
|---|---|---|
| Subscription status (tamper-resistant, section 11) | unlocking the paid app | no: § 25 (2) no. 2 TDDDG, strictly necessary for the service you asked for |
| Local event ring buffer | on-device troubleshooting | no, never leaves the device |
| Installation ID (random value) | matching the events in section 3.8 | yes: § 25 (1) TDDDG and Art. 6 (1)(a) GDPR. It is created only once consent is given |
No advertising identifiers. The app reads neither Apple's IDFA nor Google's Advertising ID. On Android it does not even declare the permission required for it.
No cross-app tracking. The events in section 3.8 are not combined with data a third party holds about you from other apps or websites, and they are not passed on for advertising purposes.
No advertising in the app. No ads are served.
Local logs: The app keeps an event ring buffer on the device (automatic rotation). It runs regardless of your decision and leaves the device only as section 3.8 describes. Without consent it stays entirely local, and it is not sent retroactively if you consent later.
Important: as soon as an advertising or attribution service is added, an advertising identifier is read, or a crash reporting service is introduced, this section must be updated again before rollout, then additionally covering the iOS "App Tracking" system prompt, which is a different thing from consent under the GDPR.
11. Data security
The app has no server endpoint of its own. It talks to the following targets only, all over TLS:
- the operating system's payment processing (Apple or Google), always,
- PostHog (EU instance) and RevenueCat, only after consent has been given (section 3.8).
Cleartext HTTP is ruled out in both apps in every build variant; the additional network targets have not changed that. Your usage data is protected by the operating system's app sandbox separation: other apps cannot read it. The subscription status is additionally stored in a tamper-resistant way (iOS: Keychain; Android: signed with a key held in the Android Keystore).
12. Users in the United Kingdom (UK)
The app is not offered in the United Kingdom. It is not available for download or purchase in the UK Apple App Store or on Google Play. We therefore do not designate a representative under Art. 27 UK GDPR. Any visit to this website from the United Kingdom is covered by section 13 (server logs) and does not constitute an offer of the app.
13. Visiting our website
Our website is hosted on a server operated by us at Hetzner Online GmbH (see section 5) in the EU. When you access it, the server processes, as technically necessary, your device's IP address as well as the date and time of the request, the file requested, the user agent, and the referrer URL (server logs). The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in providing the website securely and functionally). Server logs are deleted or anonymized after 14 days at the latest.
The website uses no cookies, no tracking, and loads no content from third-party servers; fonts and media are served locally.
If you join the Android waitlist, we store the email address you enter on the same server, only to notify you once when the app appears on Google Play. The legal basis is Art. 6 (1)(a) GDPR (consent by submitting the form). The address goes to nobody else. You can withdraw consent at any time by writing to contact@pushgate.app; we then delete the entry, and otherwise at the latest once the notification has gone out.
14. Changes to this policy
We will adapt this policy if the processing changes. The date at the top indicates the version currently in effect.
This policy is also available in German. In case of discrepancies between the language versions, the German version prevails.