Privacy Policy

Last updated: 18 October 2026 · Effective from 20 September 2026

This policy explains what personal data Flexxit collects, why, and what your rights are. The data controller is EXISOSYS P.C. (Private Company, Ι.Κ.Ε.), 25is Martiou 5, 58200 Edessa, Greece, General Commercial Registry (G.E.MI.) no. 167579447000, VAT no. EL801984137, Tax Office of Edessa ("Flexxit", "we"). Contact: [email protected].

1. What we collect

Things you give us

• Account: email address, username, password (stored only as a salted hash by our authentication provider).
• Phone verification: a mobile phone number you verify once by SMS code when you join. We use it only to confirm you are a real person and to keep the leaderboard fair. Your number is held by our authentication provider (Supabase) so we can verify you and let you sign in and manage it; in your profile we additionally keep only the country it belongs to and a one-way cryptographic hash, which lets us stop one number registering many accounts. Your phone number is never shown to other users; the country is (see section 3) unless you switch "Show my country" off.
• Push notifications: if you allow them, we keep a notification token for each device you use, issued by Apple or Google through Expo, together with the device's platform and the language the app is set to, so that a notification reaches that device in your language. The token is removed when you sign out on that device, and when Apple or Google tell us it is no longer valid.
• Profile: profile photo, bio, language, appearance and notification preferences, privacy settings (private account, who can message or comment, which statistics are shown).
• Content: the videos you upload, their thumbnails, titles, descriptions and hashtags; comments; direct messages; category suggestions.
• Feedback: anything you send through "Suggest an improvement or report a bug", your app rating, and the app version and platform attached to it; emails you send to support.

Things generated by using Flexxit

• Ratings and social graph: the star ratings you give, who you follow, follow requests, who you block.
• Viewing activity: for each flexx you watch, how long you watched, whether you finished it and from which feed you reached it. We use this to rank the For You feed and to show creators aggregate view counts.
• Honours: the Flexxer of the Month titles and Legacy seats you earn: the month or seat number, whether it is the worldwide or a country's list, and the flexx that earned it. They are a permanent record kept for as long as your account exists.
• Install measurement (phones only, and only if you allow it): when you first sign in on a phone, the app asks whether it may report that Flexxit was installed on that phone and reached a sign-up, a first flexx and a first rating, so that we can see which of our adverts bring new flexxers. If you say yes, AppsFlyer, our measurement partner, which processes this on our behalf, receives those four moments, the phone's advertising identifier where the operating system allows it (on iOS only after its own "allow tracking" prompt), the technical details every app on that phone sends (device model, operating system, app version, IP address) and your consent signal, and tells the advertising network whose advert brought you here (Meta, TikTok or Google) that its advert led to an install. Neither AppsFlyer nor the networks receive your name, email address, phone number, username, your flexxes, your ratings or what you watch. If you say no, nothing is sent and nothing is stored for this purpose. You can change your answer any time in Settings → Privacy → "Share install stats for our ads".
• Moderation records: reports you make or that are made about you, appeals, moderation decisions and account suspensions.
• Technical data: IP address, device type, operating system and request logs, processed by our hosting providers to run and secure the Service.

We do not collect precise location, contacts, advertising identifiers or payment data, and we do not use advertising or analytics trackers.

2. Why we use it and on what legal basis

• To provide the Service (performance of our contract with you): accounts, uploading and playing videos, ratings, rankings, comments, chat, notifications, search.
• To keep Flexxit safe and fair (our legitimate interest and, where applicable, legal obligation): reviewing flexxes before publication, handling reports and appeals, detecting rating manipulation, enforcing suspensions, securing our systems. Every flexx is checked by an automated content-safety tool before it is published; that check can approve a flexx, hold it for one of our moderators, or refuse it. A refusal is never final: you can appeal it in the app and a person reviews it. After that check, a second automated tool (a Google model, see section 4) looks at the flexx to say which category it belongs to: it can place the flexx in the category that fits it best, in which case you are told, or hold it for one of our moderators when it does not look like a skill being performed. It never refuses a flexx on its own, and it is not used for anything else.
• To personalise the For You feed (legitimate interest): ranking uses your ratings, viewing activity and the categories you engage with. You can always switch to the chronological Following feed.
• To improve Flexxit (legitimate interest): aggregate statistics such as daily active users, completion rates and app ratings. These are not used to profile individuals.
• To communicate with you (contract and legitimate interest): in-app and push notifications, which you can switch off per type in Settings (and altogether in your device's settings), service emails about your account (confirming your address, resetting your password, confirming that your account was deleted), and replies to your feedback and support requests.

3. What other users can see

Your username, profile photo, bio, emblem, badges, approved flexxes, their average rating and view count, and your position in rankings are visible to other users. Your fans and following lists and your profile statistics (flexxes, votes received, best rank, Inner Circle rank, streak) are visible by default; you can hide each of them in Settings → Privacy. If you make your account private, only fans you approve see your flexxes and statistics, and you are left out of the public Hall of Fame. The country of your verified phone number places you in that country's rankings, Flexxer of the Month titles and Legacy list, which anyone can browse; it is not shown next to your name. Switch "Show my country" off in Settings → Privacy to appear in the worldwide lists only. A country title or Legacy seat you already hold stays listed as taken, without your name, until you switch it on again. Direct messages are visible only to the participants.

4. Who we share data with

We do not sell personal data. We share it only with providers that process it on our behalf under data processing agreements:

• Supabase (database, authentication, file storage; hosted in the EU, Ireland).
• Cloudflare (video transcoding, storage and delivery: the playback copies of approved flexxes are kept in Cloudflare R2 in the European Union, and older ones in Cloudflare Stream until they are moved; DNS, website hosting, bot protection (Turnstile) and support email routing; a global network with EU data protection safeguards).
• Twilio (sends the one-time SMS code that verifies your phone number).
• Sightengine (automated content-safety analysis of every uploaded video, including whether a minor appears together with sexual content. Sightengine receives a link to the video file that expires after 30 minutes; it does not receive your name, username, email address or phone number. Based in France, in the European Union; its infrastructure providers include companies in the United States, under the standard contractual clauses included in its data processing terms.)
• Google Cloud (Vertex AI: after the content-safety check, a Gemini model looks at every uploaded video to say which category it belongs to and whether it shows a skill being performed. Google receives a copy of the video for the duration of that check (for a very large file, a link that expires after 30 minutes instead) and the list of category names; it does not receive your name, username, email address or phone number, and the video is not used to train its models. Processed in the European Union (Google's EU multi-region endpoint), under the Google Cloud Data Processing Addendum.)
• Expo (delivers push notifications to your device through Apple's and Google's notification services. It receives your device's notification token and the text of the notification (for a chat message, the sender's username and the message itself). Based in the United States.)
• Resend (sends our service emails; it receives your email address and the content of the email. Based in the United States.)
• AppsFlyer (install measurement for our adverts, only on a phone where you allowed it, see section 1 and the paragraph below this list; its servers for our account are in the European Union).
• Sentry (error reporting, hosted in the EU: when the app or our servers hit a fault we receive a technical report: the error, the screen it happened on, the app version, device and operating system, and a pseudonymous account identifier. Email addresses, phone numbers and the contents of messages, comments or videos are removed before a report is sent, and no screen recordings are made.)
• Apple and Google receive data as app-store operators, and deliver push notifications to your device, under their own policies, not on our behalf.

AppsFlyer (AppsFlyer Ltd.) is on the list above only for the install measurement you allow (section 1): it processes the install, the three moments and the identifiers described there on our behalf, under its data processing terms. Through it, the advertising network whose advert brought you to Flexxit, Meta (Meta Platforms Ireland Limited), TikTok (TikTok Technology Limited) or Google (Google Ireland Limited), learns that its advert led to an install and to those moments, and uses that under its own terms and privacy policy, as an independent controller, to attribute and measure our adverts, not on our behalf. The networks receive nothing about you from us otherwise, and nothing at all from the web app.

If the automated check or a moderator finds apparent child sexual abuse material, we preserve it and report it to the competent authorities, as the law requires. We may also disclose data when the law requires it, to protect the rights and safety of users, or as part of a merger or sale of the Service, in which case this policy continues to apply.

5. International transfers

Your data is stored in the European Union (Supabase in Ireland, Cloudflare R2's EU jurisdiction for the playback copies of approved flexxes, Sentry's EU region, Google Cloud's EU region for the category classification). Video delivery uses Cloudflare's global network so that flexxes play quickly wherever the viewer is; Cloudflare is bound by standard contractual clauses and equivalent safeguards for any transfer outside the EU. Expo, Resend and Twilio are based in the United States and process the limited data described in section 4 there; those transfers rely on the standard contractual clauses included in each provider's data processing terms, or an equivalent lawful transfer mechanism. Install measurement data you have allowed is processed by AppsFlyer in the European Union, and the advertising network it informs (Meta, TikTok or Google, section 4) receives it through its EU entity and may transfer it to its parent in the United States or elsewhere under the EU-US Data Privacy Framework and standard contractual clauses, as described in that network's privacy policy.

6. How long we keep it

• Account, profile, content, ratings, social graph and viewing activity: for as long as your account exists.
• When you delete your account, everything above is deleted immediately from our live systems and disappears from backups within 30 days.
• Moderation records may be kept for up to 12 months after deletion where needed to prevent abuse or to meet legal obligations, in a form no longer linked to your profile.
• Support emails are kept for as long as needed to handle your request and for up to 24 months afterwards.

7. Your rights

Under the GDPR you can ask us to access, correct, delete or export your data, to restrict or object to certain processing, and you can withdraw any consent you have given. Most of this you can do yourself: edit your profile in the app, change settings, and delete your account from Settings → Delete account. For anything else email [email protected] (requests about your data go to that address; general questions can still go to [email protected]); we answer within one month. You also have the right to complain to a supervisory authority, in Greece the Hellenic Data Protection Authority (dpa.gr).

8. Children

Flexxit is not for anyone under 16. We do not knowingly collect data from children under 16; if you believe a child has an account, tell us and we will delete it.

9. Security

Data is encrypted in transit and at rest. Access to the database is restricted by row-level security so that each user can only read what they are entitled to, and moderators only what their role allows. Videos that have not passed review are never publicly accessible.

10. Cookies and local storage

The app and the web app store your session and preferences on your device. This website uses no cookies.

11. Changes

We will post any changes here and, if they are significant, tell you in the app before they take effect.