Last updated 20 August 2026 · Version 2026-08-20
This explains exactly what VEXIUM collects, why, who else sees it, and what you can do about it. It describes what the app actually does — not what would be convenient to say.
VEXIUM ("we", "us") is the controller of the personal data described here.
Contact: support@vexiumapp.com
Established in: Spain
| Data | Why | Basis |
|---|---|---|
| Email address and password | To create and secure your account | Contract |
| Username | How other athletes see and find you. Public. | Contract |
| Gender | Chooses which body your cosmetic skin renders on. Public. | Contract |
| Body weight | Sets your weight class for ranking. Public — shown on leaderboards and profiles. | Contract |
| Country (optional) | Shown on your profile. You may leave it blank. | Contract |
If you sign in with Apple or Google, we receive your email address and, on the first sign-in only, your name — which we offer as a suggested username. We do not receive your password.
| Data | Why | Basis |
|---|---|---|
| Lift videos | So a reviewer can confirm the lift is real. Recorded without audio. | Contract |
| Identity photo (one selfie) | So a reviewer can confirm the athlete in the video is you. Never shown to other users. | Contract |
| Lift records — exercise, weight, reps, date | Rankings, personal records, progress | Contract |
| Derived stats — training volume, streaks, season level, rank | Progression and leaderboards. Public. | Contract |
| Data | Why | Basis |
|---|---|---|
| Friends, duels and stakes | To run challenges between athletes | Contract |
| Comments and likes | Public interaction on verified lifts | Contract |
| Direct messages | Private one-to-one chat. Not read by us unless reported. | Contract |
| Reports and blocks | Safety, and our legal obligation to moderate user content | Legitimate interests; legal obligation |
| Data | Why | Basis |
|---|---|---|
| Shakes and VEX Coin balances | To run the in-app economy | Contract |
| Purchase and spend history | Record of what you bought and owe | Contract; legal obligation (tax records) |
| Data | Why | Basis |
|---|---|---|
| Push notification token | To tell you a lift was verified or a duel ended. Only if you allow notifications. | Consent (device permission) |
| Device language | To show the app in your language | Contract |
| Cached app data on your phone | Speed and offline resilience. Stays on your device. | Contract |
This is the part worth reading twice before you record your first lift.
A verified lift is public within VEXIUM by design — the leaderboard is the product. There is currently no way to make a verified lift private. If you would rather a particular lift were not visible, do not submit it for verification.
| Who | What they handle | Where |
|---|---|---|
| Supabase | Database, accounts, file storage, server functions — everything above | EU — Frankfurt, Germany |
| Resend | Account emails (confirmation, password reset) | EU (eu-west-1) |
| Our lift reviewers | Your lift video and identity photo, to verify the lift | Contracted individuals |
| Discord | Notifies reviewers that a lift is waiting, via time-limited links | United States |
| Expo, Apple, Google | Delivery of push notifications to your device | United States |
| Apple, Google | Sign-in, if you choose to use it | United States |
Your account, your lifts, your videos and your identity photo are stored in the European Union — in Frankfurt, Germany — and account email is sent from within the EU. They do not leave it.
Three things do cross to the United States, and only these: the short-lived links that tell a reviewer a lift is waiting (Discord), the delivery of push notifications to your phone (Expo, Apple, Google), and the sign-in exchange if you choose Apple or Google. Those transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
When you submit a lift, a notification is posted to a private channel that only our reviewers can read. It contains links to your video and identity photo — not the files themselves — and those links stop working after one hour. The notification is deleted automatically once a reviewer reaches a verdict. Reviewers view the files in a dashboard that requires them to sign in.
We keep your data for as long as your account exists. Delete your account and it is removed — profile, lifts, videos, identity photo, messages, balances and history.
Two things survive, and you should know which: records we are legally required to retain, such as transaction records for tax purposes; and safety reports made about content, which we keep so that a person cannot erase evidence of abuse by deleting their account. Messages you sent to another person are deleted from both sides.
If you are in the UK or EU, you have the right to:
For access or portability, email support@vexiumapp.com and we will respond within one month. These are handled manually today; there is no self-service export button yet.
If you think we have handled your data badly, please tell us first — but you have the right to complain to your national data protection authority regardless. Ours is the Spanish Agencia Española de Protección de Datos (AEPD, aepd.es), and you may complain to the authority in your own country instead.
No system is perfect. If you find a security problem, please report it to support@vexiumapp.com — we would much rather hear it from you.
VEXIUM is for people aged 13 and over. We do not knowingly collect data from anyone younger. If you believe a child under 13 has an account, email us and we will remove it.
None. Every lift verification is a decision made by a person. No profiling or automated decision-making produces legal or similarly significant effects for you.
If we change this policy materially we will tell you in the app before the change takes effect. The version and date at the top always tell you which one you are reading.
VEXIUM