Last updated 5 October 2026 · Version 2026-10-05
This explains exactly what VEXIUM collects, why, who else sees it, and what you can do about it. It describes what the app actually does — not what would be convenient to say.
VEXIUM ("we", "us") is the controller of the personal data described here.
VEXIUM is operated by an individual, not a company, so the controller is a named person and these are their details as registered with Apple.
Controller: Mario Dinel Staicu
Address: Calea Bucuresti nr. 7, bl. U2, sc. 1, ap. 7, 200580 Craiova, Romania
Contact: support@vexiumapp.com
Established in: Romania
| Data | Why | Basis |
|---|---|---|
| Email address and password | To create and secure your account | Contract |
| Username | How other athletes see and find you. Public. | Contract |
| Gender | Chooses which body your cosmetic skin renders on. Public. | Contract |
| Body weight, and the heaviest body weight you have saved | Sets your weight class for ranking (public — shown on leaderboards and profiles). The heaviest weight you have ever saved is kept to decide the class for rank achievements; it is not shown to anyone. | Contract |
| Country (optional) | Shown on your profile. You may leave it blank. | Contract |
If you sign in with Apple or Google, we receive your email address and, on the first sign-in only, your name — which we offer as a suggested username. We do not receive your password.
| Data | Why | Basis |
|---|---|---|
| Lift videos | So a reviewer can confirm the lift is real. Recorded without audio. | Contract |
| Identity photo (one selfie) | So a reviewer can confirm the athlete in the video is you. Never shown to other users. | Contract |
| Lift records — exercise, weight, reps, date | Rankings, personal records, progress | Contract |
| Derived stats — training volume, streaks, season level, rank | Progression and leaderboards. Public. | Contract |
| Data | Why | Basis |
|---|---|---|
| Friends, duels and stakes | To run challenges between athletes | Contract |
| Comments and likes | Public interaction on verified lifts | Contract |
| Direct messages | Private one-to-one chat. Not read by us unless reported. | Contract |
| Reports and blocks | Safety, and our legal obligation to moderate user content | Legitimate interests; legal obligation |
| Data | Why | Basis |
|---|---|---|
| Shakes (available and locked in duels), a history of each change to your Shakes, and VEX Coin balances | To run the in-app economy, set your season level and settle duels | Contract |
| Purchase and spend history | Record of what you bought and owe | Contract; legal obligation (tax records) |
| Data | Why | Basis |
|---|---|---|
| Push notification token | To tell you a lift was verified or a duel ended. Only if you allow notifications. | Consent (device permission) |
| Device language | To show the app in your language | Contract |
| Cached app data on your phone | Speed and offline resilience. Stays on your device. | Contract |
This is the part worth reading twice before you record your first lift.
A verified lift is public within VEXIUM by design — the leaderboard is the product. There is currently no way to make a verified lift private. If you would rather a particular lift were not visible, do not submit it for verification.
| Who | What they handle | Where |
|---|---|---|
| Supabase | Database, accounts, file storage, server functions — everything above | EU — Frankfurt, Germany |
| Resend | Account emails (confirmation, password reset) | EU (eu-west-1) |
| Our lift reviewers | Your lift video and identity photo, to verify the lift | Contracted individuals |
| Discord | Notifies reviewers that a lift is waiting, via time-limited links | United States |
| Expo, Apple, Google | Delivery of push notifications to your device | United States |
| Apple, Google | Sign-in, if you choose to use it | United States |
Your account, your lifts, your videos and your identity photo are stored in the European Union — in Frankfurt, Germany — and account email is sent from within the EU. They do not leave it.
Three things do cross to the United States, and only these: the short-lived links that tell a reviewer a lift is waiting (Discord), the delivery of push notifications to your phone (Expo, Apple, Google), and the sign-in exchange if you choose Apple or Google. Those transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
When you submit a lift, a notification is posted to a private channel that only our reviewers can read. It contains links to your video and identity photo — not the files themselves — and those links stop working after one hour. The notification is deleted automatically once a reviewer reaches a verdict. Reviewers view the files in a dashboard that requires them to sign in.
We keep your data for as long as your account exists. Delete your account and it is removed — profile, lifts, videos, identity photo, messages, balances and history.
Three things survive, and you should know which: records we are legally required to retain, such as transaction records for tax purposes; safety reports made about content, which we keep so that a person cannot erase evidence of abuse by deleting their account; and the ban record described below. Messages you sent to another person are deleted from both sides.
If you delete your account while it is suspended, we keep a one-way cryptographic hash (SHA-256) of your email address and of your Apple or Google sign-in identifier — and nothing else. No name, no account id, no lifts, no videos, no messages. We cannot read your email address back out of it; we can only check whether a new sign-up matches it. Its only purpose is to stop a suspended account from being replaced with a fresh one while the suspension lasts, and it is never shared with anyone.
We keep it only until the suspension would have ended, then delete it. A permanent suspension means we keep it indefinitely. Our legal basis is legitimate interest — enforcing our Terms and keeping the app safe for everyone else — and you can object to it at support@vexiumapp.com.
Being straight with you about what that hash is: it is pseudonymous data, not anonymous. It is not reversible, but anyone who already knows an email address can hash it and check whether it matches. We are counting it as personal data and treating it as such, which is why it is described here rather than left out as a technical detail.
If you are in the UK or EU, you have the right to:
For access or portability, email support@vexiumapp.com and we will respond within one month. These are handled manually today; there is no self-service export button yet.
If you think we have handled your data badly, please tell us first — but you have the right to complain to your national data protection authority regardless. Ours is the Romanian Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, dataprotection.ro), and you may complain to the authority in your own country instead.
No system is perfect. If you find a security problem, please report it to support@vexiumapp.com — we would much rather hear it from you.
VEXIUM is for people aged 13 and over. We do not knowingly collect data from anyone younger. If you believe a child under 13 has an account, email us and we will remove it.
None. Every lift verification is a decision made by a person. No profiling or automated decision-making produces legal or similarly significant effects for you.
If we change this policy materially, the app tells you the next time you open it, with a link to the new text. The version and date at the top always tell you which one you are reading, and the list below records every material change, so you can see what moved without re-reading the whole document. We will not apply a material change retroactively to data we already hold.
VEXIUM