Privacy Policy
What World Pushups collects, why, and what it never does.
Overview
World Pushups doesn't have user accounts — there's no sign-up, no profile, and no personal information to manage. This page explains the small amount of data the app does handle: an anonymous cookie that prevents abuse, a hashed IP address used only for rate-limiting, and the country you choose to support each day.
What we collect
Completing a day's mission stores a single record with the following fields:
Country code
The country you choose to support — the only thing you actively enter. Choosing a country is a show of support, not a claim of residency or nationality; we don't ask for or verify either.
Rep count
The day's push-up target, computed by the server and identical for everyone worldwide that day — not something you type in.
Submission timestamp and UTC date
When a mission was marked complete.
Cookie token hash
A one-way hash of your anonymous cookie — see Cookies below.
IP hash
A one-way hash of your IP address, used only to limit submissions per day.
We never collect a name, email address, or any free-text input, and there are no accounts of any kind.
Cookies
World Pushups sets exactly one cookie of its own: pn_token.
The cookie is a random 32-byte value, base64-encoded, with nothing meaningful encoded inside it. It's marked HttpOnly, Secure, and SameSite=Lax, and expires after 365 days.
Its purpose is to let the server recognize "one completion per cookie per UTC day" and count roughly how many distinct people contributed to a country's total — both without needing an account. The server stores only a SHA-256 hash of this token; the raw token itself is never saved and can't be recovered from the database.
Analytics & third parties
Microsoft Clarity — client-side analytics (session recordings and heatmaps) that sets its own cookies. It only loads if you accept cookies in the banner shown across the site; if you reject it, or haven't decided yet, Clarity never loads.
Azure Application Insights — server-side monitoring for the API (requests, errors, performance). This runs on Azure's infrastructure, not in your browser, and doesn't rely on a cookie. Azure's own telemetry platform may, at the infrastructure level, capture client IP addresses in Microsoft's own logs by default — that's a property of the hosting platform rather than something this app's code does or controls.
World Pushups runs entirely on Microsoft Azure — Azure Static Web Apps (hosting), Azure Functions (the API), and Azure SQL (the database), alongside Application Insights and Clarity above.
Local storage
Separate from cookies, the app stores a few small preferences directly in your browser's local storage. None of this is ever sent to the server — it's read only by your own browser.
pn_personal_stats
Your personal streak and missions-completed count, tracked locally only — the server has no record of it.
pn_ranking_view
Which leaderboard view (today, week, month, all-time) you last had open.
pn_cookie_consent
Whether you've accepted or rejected the analytics cookie banner.
pn_pushmission_dismissed_date
Whether you've dismissed the PushMission suggestion shown after completing today's mission, so it stays hidden for the rest of the day.
Data retention & removal
Submissions and country totals are kept indefinitely as part of the running leaderboard — there's no per-user data to delete because none of it is tied to an identifiable person. If you'd like a fresh, unlinked cookie, clearing pn_token from your browser (or simply waiting out its 365-day expiry) means the next mission you complete starts a new one.
Contact
Questions about this policy? Visit the Contact page.
Join the world's daily push-up mission.
Do today's push-ups