Privacy Policy

Last updated: July 1, 2026

ROXSOCIAL ("we", "us", "the app") is a social platform built for the hybrid fitness community. This policy explains what information we collect, how we use it, and the rights you have over it. We've tried to write this in plain English — if anything is unclear, email us at support@roxsocial.app.

1. Who we are

ROXSOCIAL is an independent mobile application for the hybrid fitness community. We are not affiliated with HYROX GmbH, DEKA, Deadly Dozen, Redline, or any other race organizer — we simply provide a social layer on top of the sport. The app is available on iOS via the Apple App Store. Our contact address is support@roxsocial.app.

2. Information we collect

You give us:

• Account info: email address, username, display name, password (hashed by our auth provider).
• Date of birth: collected during onboarding to enforce our 16+ minimum age (aligned with HYROX event requirements) and to gate social features like doubles matching to 18+. We store the DOB itself and a derived age bracket (e.g. 25-29) — never shown to other users.
• Profile info: avatar (optional photo you upload), bio, city, country, division, gym (all optional).
• Race + workout data: race results you log or import, station test times, workouts, simulations, splits.
• Race tags: upcoming events you intend to race, your registration status (with or without HYROX Flex), and your bib number + registered name when you choose to share them for live tracking.
• Doubles partner activity: when you toggle "Looking for a partner" or accept/decline a pairing offer, we log the request, the pairing, and (after the race) a reliability event based on whether the pairing raced together. This feeds your reliability score, visible only to you unless it's flagged for admin review.
• Social activity: posts you publish, comments, high-fives, the people you follow, communities you join, messages you send.

We collect automatically:

• Device info: device model, OS version, app version — used for crash diagnostics.
• Push token: if you grant notification permission, an Expo push token is stored so we can deliver alerts.
• Anonymous usage analytics: aggregated screen views and feature usage. We do not associate this with your identity.

3. How we use it

• To provide the app: show your feed, render your profile, deliver messages, surface race results.
• To send notifications you've opted into (race-day alerts, ticket releases, follow requests, comments).
• To detect and prevent abuse, spam, or violations of our Terms.
• To improve the app based on aggregated usage patterns.

We do not sell your personal data. We do not run advertising networks. We do not share your data for cross-context behavioural advertising.

4. Permissions we request

The iOS app may request the following permissions. Each is optional and explained at the moment we ask:

• Photos: to let you pick an avatar or share a sticker.
• Camera: to scan QR codes for live race tracking.
• Notifications: to deliver race-day alerts, follow requests, and ticket-release reminders.

You can revoke any permission at any time in iOS Settings → ROXSOCIAL.

5. What is visible to others

By default, your username, display name, avatar, bio, race history, station tests, and workout stats are visible to other ROXSOCIAL users. You can edit or remove any of this in the Edit Profile screen.

Your email address is never shown to other users. Your race-tag bib + registered name are only shared with users you have explicitly opted to allow tracking by — see "Live tracking consent" below.

6. Live tracking consent

When you add a race tag and enter your HYROX bib number + the name you registered with, you control who can see them:

• By default, only you can see them.
• You may explicitly grant "live tracking" consent to followers. They will then see your bib + name during the event window and can deep-link to the official MIKA results page.
• Consent can be revoked at any time from the Track Friends screen. We do not expose another user's bib without their consent.

7. Third-party services we use

• Supabase (EU/Asia region) — encrypted database, authentication, and file storage.
• Expo Application Services — push notification delivery and over-the-air updates.
• Apple — App Store distribution, Sign-in-with-Apple authentication.
• HYRESULT.com and HYROX results portal (results.hyrox.com / MIKA) — when you import race results, we fetch publicly-available race data from these services on your behalf.

These services have their own privacy policies. We send them only the data they strictly need to function.

8. Elite athletes / managed profiles

To bootstrap the network we display public race results for prominent hybrid athletes. These are managed profiles, clearly labeled as such, contain no photos, and link to publicly-available results pages (e.g. hyresult.com for HYROX results). If you are one of these athletes and would like your profile removed, email support@roxsocial.app and we will remove it within 7 days. Verified athletes can also claim the profile and gain control over it.

9. Age requirements & minors

ROXSOCIAL requires users to be at least 16 years old, aligned with the minimum competitor age for HYROX events. We collect date of birth during onboarding and hard-block accounts for anyone under 16.

Users aged 16–17 can use ROXSOCIAL for their own profile, race history, workouts, and communities they join, but the following social features are gated to 18+: doubles-partner matching, and initiating direct messages with users they don't mutually follow.

If you believe an underage user has created an account, contact support@roxsocial.app and we will remove the account within 7 days.

10. Data storage and security

Your data is stored on Supabase infrastructure with encryption in transit (TLS) and at rest. Passwords are hashed; we never see your plaintext password. We restrict employee access on a least-privilege basis. No system is perfectly secure, but we follow industry-standard practices and will notify affected users in the event of a data breach.

11. Data retention

We keep your data for as long as your account is active. When you delete your account (see below), we remove your profile, posts, comments, follows, and race records within 30 days. Aggregated anonymous usage statistics may be retained for analytics purposes.

12. How to delete your account

You can delete your account from inside the app:

1. Open the app and tap Settings.
2. Scroll to Delete Account.
3. Confirm the prompt.

This permanently removes your profile, posts, messages, race records, and follows. The deletion is irreversible and completes within 30 days. You can also email support@roxsocial.app from the email address on your account to request deletion.

13. Your rights (GDPR / UK GDPR / CCPA)

Depending on where you live, you may have the right to:

• Access the data we hold about you
• Correct inaccurate information
• Delete your account and data
• Export your data in a machine-readable format
• Object to or restrict processing
• Withdraw consent (e.g. for push notifications)

To exercise any of these rights, email support@roxsocial.app from the email address on your account. We respond within 30 days.

14. Changes to this policy

If we make material changes to this policy, we will notify you in the app or via email at least 7 days before the change takes effect. The "Last updated" date at the top of this page always reflects the current version.

15. Contact

Questions, complaints, or data requests: support@roxsocial.app.