Privacy Policy Draft
This policy explains what personal data Flexxit collects, why, and what your rights are. The data controller is [Operator legal name], [address], Greece ("Flexxit", "we"). Contact: [email protected].
1. What we collect
Things you give us
- Account: email address, username, password (stored only as a salted hash by our authentication provider).
- Phone verification: a mobile phone number you verify once by SMS code when you join. We use it only to confirm you are a real person and to keep the leaderboard fair. Your number is held by our authentication provider (Supabase) so we can verify you and let you sign in and manage it; in your profile we additionally keep only the country it belongs to and a one-way cryptographic hash, which lets us stop one number registering many accounts. Your phone number is never shown to other users; the country is (see section 3) unless you switch "Show my country" off.
- Profile: profile photo, bio, language, appearance and notification preferences, privacy settings (private account, who can message or comment, which statistics are shown).
- Content: the videos you upload, their thumbnails, titles, descriptions and hashtags; comments; direct messages; category suggestions.
- Feedback: anything you send through "Suggest an improvement or report a bug", your app rating, and the app version and platform attached to it; emails you send to support.
Things generated by using Flexxit
- Ratings and social graph: the star ratings you give, who you follow, follow requests, who you block.
- Viewing activity: for each flexx you watch, how long you watched, whether you finished it and from which feed you reached it. We use this to rank the For You feed and to show creators aggregate view counts.
- Honours: the Flexxer of the Month titles and Legacy seats you earn — the month or seat number, whether it is the worldwide or a country's list, and the flexx that earned it. They are a permanent record kept for as long as your account exists.
- Moderation records: reports you make or that are made about you, appeals, moderation decisions and account suspensions.
- Technical data: IP address, device type, operating system and request logs, processed by our hosting providers to run and secure the Service.
We do not collect precise location, contacts, advertising identifiers or payment data, and we do not use advertising or analytics trackers.
2. Why we use it and on what legal basis
- To provide the Service (performance of our contract with you): accounts, uploading and playing videos, ratings, rankings, comments, chat, notifications, search.
- To keep Flexxit safe and fair (our legitimate interest and, where applicable, legal obligation): reviewing flexxes before publication, handling reports and appeals, detecting rating manipulation, enforcing suspensions, securing our systems.
- To personalise the For You feed (legitimate interest): ranking uses your ratings, viewing activity and the categories you engage with. You can always switch to the chronological Following feed.
- To improve Flexxit (legitimate interest): aggregate statistics such as daily active users, completion rates and app ratings. These are not used to profile individuals.
- To communicate with you (contract and legitimate interest): in-app notifications, which you can switch off per type in Settings, and replies to your feedback and support requests.
3. What other users can see
Your username, profile photo, bio, emblem, badges, approved flexxes, their average rating and view count, and your position in rankings are visible to other users. Your fans and following lists and your profile statistics (flexxes, votes received, best rank, Inner Circle rank, streak) are visible by default; you can hide each of them in Settings → Privacy. If you make your account private, only fans you approve see your flexxes and statistics, and you are left out of the public Hall of Fame. The country of your verified phone number places you in that country's rankings, Flexxer of the Month titles and Legacy list, which anyone can browse; it is not shown next to your name. Switch "Show my country" off in Settings → Privacy to appear in the worldwide lists only — a country title or Legacy seat you already hold stays listed as taken, without your name, until you switch it on again. Direct messages are visible only to the participants.
4. Who we share data with
We do not sell personal data. We share it only with providers that process it on our behalf under data processing agreements:
- Supabase (database, authentication, file storage; hosted in the EU, Ireland).
- Cloudflare (video transcoding and delivery through Cloudflare Stream, DNS, website hosting, bot protection (Turnstile) and support email routing; a global network with EU data protection safeguards).
- Twilio (sends the one-time SMS code that verifies your phone number).
- Sentry (error reporting, hosted in the EU: when the app or our servers hit a fault we receive a technical report — the error, the screen it happened on, the app version, device and operating system, and a pseudonymous account identifier. Email addresses, phone numbers and the contents of messages, comments or videos are removed before a report is sent, and no screen recordings are made.)
- Apple and Google receive data as app-store operators under their own policies, not on our behalf.
[Add before launch if adopted: automated content-safety analysis of uploaded videos by a specialised provider.] We may also disclose data when the law requires it, to protect the rights and safety of users, or as part of a merger or sale of the Service, in which case this policy continues to apply.
5. International transfers
Your data is stored in the European Union (Supabase in Ireland, Sentry's EU region). Video delivery uses Cloudflare's global network so that flexxes play quickly wherever the viewer is; Cloudflare is bound by standard contractual clauses and equivalent safeguards for any transfer outside the EU.
6. How long we keep it
- Account, profile, content, ratings, social graph and viewing activity: for as long as your account exists.
- When you delete your account, everything above is deleted immediately from our live systems and disappears from backups within 30 days.
- Moderation records may be kept for up to 12 months after deletion where needed to prevent abuse or to meet legal obligations, in a form no longer linked to your profile.
- Support emails are kept for as long as needed to handle your request and for up to 24 months afterwards.
7. Your rights
Under the GDPR you can ask us to access, correct, delete or export your data, to restrict or object to certain processing, and you can withdraw any consent you have given. Most of this you can do yourself: edit your profile in the app, change settings, and delete your account from Settings → Delete account. For anything else email [email protected] (requests about your data go to that address; general questions can still go to [email protected]); we answer within one month. You also have the right to complain to a supervisory authority, in Greece the Hellenic Data Protection Authority (dpa.gr).
8. Children
Flexxit is not for anyone under 16. We do not knowingly collect data from children under 16; if you believe a child has an account, tell us and we will delete it.
9. Security
Data is encrypted in transit and at rest. Access to the database is restricted by row-level security so that each user can only read what they are entitled to, and moderators only what their role allows. Videos that have not passed review are never publicly accessible.
10. Cookies and local storage
The app and the web app store your session and preferences on your device. This website uses no cookies. [Until launch the website is protected by Cloudflare Access, which sets an authentication cookie for authorised reviewers only.]
11. Changes
We will post any changes here and, if they are significant, tell you in the app before they take effect.