Pushtank

Privacy Policy

Last updated: 5 October 2026.

The French version is the one that binds. This English text is provided for convenience only; where the two disagree, the French prevails.

Pushtank is an app blocker that makes screen time cost effort. This document says what the product knows about you, what it keeps, who it passes it to and for how long. It is written from the code, not from what we would like to be able to say.

Data controller: Biga Studio, a French société par actions simplifiée with share capital of €1,000, registered with the Paris trade register under number 918 273 645, with its registered office at 12 rue de la Paix, 75002 Paris, France. Pushtank is a trademark of Biga Studio.

Contact: hello@bigastudio.com. The same address for a question, a complaint, or to exercise your rights.

There is no account

Nothing asks for your name, your email address or your phone number. On first launch the device receives a profile identifier from the server — a random number — and a token proving it is that device. Both stay on the phone. That is everything tying you to your data.

The identifier is stable and follows you for as long as the app is installed. The law calls that pseudonymous personal data: we do not know who you are, but everything below is attached to the same identifier, and therefore to the same person. We will not pretend otherwise.

What the server receives and keeps

• Your pseudonym. The device assembles one from a word list on first launch. You can change it, and it is a free-text field: if you put your real name in it, your real name is what the server keeps and what your opponent sees.
• Your sessions. For each set: the exercise, the repetitions claimed, the ones accepted, the seconds earned, the integrity verdict and your own calendar date. This history has no expiry.
• Your tank. Every ledger entry — earned, won, granted, borrowed, repaid, discarded — with its duration and timestamp.
• What you declare during onboarding: the time you think you spend in the apps you are blocking, your daily and weekly goals, your main exercise and the rates you set yourself.
• Your use of blocked apps, by the hour. For each hour: how many foreground seconds were spent in each group and what it cost the tank, with your local date and hour and your time-zone offset. That offset reveals approximately where you are, and when you travel.
• Your duels: both sides' identifiers and pseudonyms, the repetitions, the stakes and the timestamps.
• Your purchases: the store's transaction identifier, the plan and the dates. See below for what this does not contain.
• Your reminders: a time of day and three switches. No notification token is stored: your phone rings them, the server does not call it.
• Your device: a fingerprint of the token, and the platform. The token itself is never stored — only its fingerprint — so nobody, us included, can reconstruct it.

What the server never receives: the name, identifier or icon of any app you block, nor the names of the groups you compose. It sees opaque identifiers only, and a test checks this on every build. It also receives no email address, no name, no photograph, no location, no health data and no advertising identifier.

What is sent without being kept

When you finish a set, the device sends the detection detail — up to two thousand events: detector confidence, the interval between repetitions, vertical acceleration, the measured range of motion, hold stability, the system's step count. The server uses them to judge the set and then does not write them down. Only the verdict is kept.

What stays on your phone

• Camera images, when it is counting your repetitions. They are analysed on the device, never saved, and never leave it.
• Your avatar, if you pick one. The photograph does not leave the device.
• The minute-by-minute detail of your tank. The server receives a summary.
• Your app selection, which iOS keeps in a form the app itself cannot read.

None of it syncs, and we keep no backup of it: nothing passes from one phone to another through us. A reinstall onto an empty phone therefore starts from nothing, and only the purchase comes back, through the App Store.

Your iPhone's own backup, however, carries all of it. This data lives in the app like any other, with no special exclusion: an iCloud restore or a device-to-device transfer gives you back your tank, your history and your settings. That is your backup, with Apple — not ours.

Duels

Your opponent sees your pseudonym, your repetitions and your stake.

Who can read a duel. The two people in it, and nobody else. A challenge still waiting for an answer can also be read with its six-character code — which is exactly what that code is for, since whoever takes the challenge up is not in it yet — and it then shows the challenge as it stands to be taken up: the pseudonym, the repetition count, the stake, the exercise, and the profile identifier of whoever opened it. Once the duel has been played or has expired, the code gives nothing.

Who the data goes to

• Cloudflare hosts the server and the database. The data described above is stored in its Western Europe region; the code itself runs at whichever edge is nearest you, where it keeps nothing.
• RevenueCat handles purchases. The app gives it your profile identifier, the identifier your iPhone reserves for this publisher, the proof of purchase issued by the App Store, your phone's model, your language, your App Store's country, the app and system versions — and, at the moment of purchase, the product's price and currency. Its service tells us what was bought.
• Apple takes payment through the App Store.

No payment details ever reach us. No card, no billing address, no identity from your Apple account. Apple collects the money, and none of the payment itself passes through us.

The purchase notice RevenueCat sends our server does, however, carry the price, the currency and the store's country. We keep none of it: the server retains that a purchase happened, when, and until when — and discards the rest unread. RevenueCat does keep them.

There is no analytics tool, no advertising tracker and no crash reporter. The product does emit events describing your progress through onboarding, but they are sent nowhere: they print to a developer's console and vanish in the build you install.

Why, and on what basis

This data exists to make the product work — keeping your tank, settling a duel, knowing what you bought — and for nothing else. It is not sold, not rented, and not passed to any third party other than those named above.

The legal basis is the performance of the contract between us when you use Pushtank, and our legitimate interest in the service being safe and functional.

For how long

This needs to be precise, because it is where policies usually lie.

Nothing is deleted automatically. Your session history, your ledger, your duels, your purchases and your profile stay until you erase them — which is a button, not a request.

Press it before you uninstall. What proves this profile is yours lives in the app; uninstalling takes it away without erasing anything on the server, and you would then have nothing to quote us to find it again.

The one thing that changes with time: after ninety days, the hour-by-hour usage counters are summed into a single per-day total and the hourly rows are dropped. The total stays, and stays attached to your identifier. That is not anonymisation; it is a loss of precision.

Uninstalling the app erases what is on the phone. It erases nothing on the server.

Your rights, and how they work today

You may request access to your data, its correction, its erasure, its portability, a restriction of processing, and you may object to processing. You may also complain to your data protection authority — in France, the CNIL.

Erasure is a button, not a request. "Delete my account", in the profile screen, erases in two taps the profile, the tank, the session history, the settings, the app groups, the avatar and the pseudonym — on the phone and on the server alike. It is immediate: there is no account to recover, so there is no grace period to wait out. This device's token stops opening anything as soon as the server has answered, and the screen returns a receipt itemising what left rather than merely saying "done".

If the server does not answer, because you are offline or it is down, the phone is erased anyway, straight away. The app keeps one thing from it: this profile's identifier and token, to ask the server for the erasure again at every launch, until it accepts. The receipt tells you so. If you uninstall the app before then, that request goes with it, and what the server held stays there, attached to an identifier you no longer have any way to quote to us.

Three things do not leave. The screen names two before the button, and the receipt it returns afterwards recalls the third. Your subscription stays with Apple: Pushtank cannot cancel it and does not, so that coming back one day lands on an empty profile rather than a paywall — the server's copy of it does go with everything else. And a duel already played stays with your opponent, score included, because it is their history as much as yours; what leaves it is the name and identifier of your side. A challenge nobody had taken up is deleted outright.

And the record RevenueCat keeps of your purchases stays with them: your profile identifier, your device's, and the history of what was bought. That is what makes a purchase restorable, and we have no way to delete it from inside the app. Write to us if you want it gone too.

For the other rights — access, correction, portability, objection — write to hello@bigastudio.com.

The other gesture, separate and also free: unlock everything, which lifts the restrictions and keeps your tank.

Children

Pushtank is not aimed at children under 13 and does not seek to collect their data. If you find that a child below that age has given us data, write to us and it will be deleted.

Changes

This document will change as the product changes. The date at the top says when. A change to what is collected or to whom it is passed will be announced in the app before it takes effect.

Terms of Use

Biga Studio, SAS with a share capital of €1,000, RCS Paris 918 273 645 — hello@bigastudio.com