Privacy Policy

This Privacy Policy explains how RoxConnect collects, uses and protects personal data when you use the RoxConnect mobile app (iOS and Android) and the website roxconnect.com. RoxConnect helps HYROX athletes find doubles, relay and training partners.

Who we are

The data controller is Alexandre Morgado, sole trader (empresário em nome individual), Rua Francisco Alvo, Edf. Solar Horta, Lote 16, 8500-759 Portimão, Portugal, tax number (NIF) 251833925 (“RoxConnect”, “we”, “us”). You can contact us about privacy at any time at hello@roxconnect.com.

RoxConnect is an independent app. HYROX is a trademark of its respective owner; we are not affiliated with or endorsed by HYROX.

Data we collect in the app

Account data: your name, email address and sign-in method (email, Sign in with Apple or Google). We never receive your Apple or Google password.

Profile data you choose to add: photos, date of birth, gender, country, preferred language, bio, HYROX divisions, run pace, strengths and goals, training preferences, gym affiliation, and the HYROX races you target or have completed. Your HYROX results may be linked from public official results when you add a race.

Location: if you allow it, your approximate location. We store it coarsened to about 1 km and other users only ever see an approximate distance, never your exact position. Location is optional; you can search by race instead.

Messages and activity: messages you send to other athletes and in event chats, training activities you create or join, connections, saved profiles, profile views, and a day-level record of when you were active (no timestamps, IP addresses or devices).

Purchases: if you subscribe to Premium, the store (Apple or Google) processes the payment. We receive the subscription status and product, never your card details.

Device and usage data: device model, operating system and app version, push notification token, in-app events (for example screens opened and features used) and crash reports, used to run, secure and improve the app. Advertising identifier (IDFA / Advertising ID), only if you allow ad measurement.

Data we collect on roxconnect.com

Analytics: we use PostHog in cookieless mode: no cookies or local storage are set and IP addresses are anonymised. We measure page views, clicks on the App Store and Google Play buttons and use of the language suggestion in aggregate.

Language: when you open roxconnect.com, we use the language your browser sends (not your location) to show the homepage in your language. If you choose a language in the language menu or in the language suggestion, we store that choice in a cookie called rc_lang that contains only the language code and expires after one year. If you close the language suggestion, your browser remembers that locally so it doesn’t show again. These are strictly functional preferences; you can delete them at any time in your browser settings.

Race alerts: if you sign up for race alerts, we store your email address, language and the race you are interested in, and send you emails about it. Every email has an unsubscribe link. The form is protected by Cloudflare Turnstile, which checks that the request comes from a human.

Organizer interest: if you fill in the organizer form on the Activities page, we store your email address, the kind of organizer you are, your city, your club or business name (optional) and your language. We use them only to send you a confirmation and to contact you about organizer features — on the basis of your request (consent), which you can withdraw at any time by writing to us or using the unsubscribe link. The form is protected by Cloudflare Turnstile.

Hosting and security logs: our hosting provider processes technical data such as IP address and browser type to deliver the site and protect it against abuse.

How we use your data and why we are allowed to

• To provide the service (account, profile, matching, messaging, activities, Premium) — performance of our contract with you.
• To show you athletes and races nearby — your consent to location access, which you can withdraw in your device settings.
• To send push notifications — your consent in your device settings.
• To send product and race-alert emails — your consent; you can unsubscribe at any time.
• To keep RoxConnect safe (fraud prevention, moderation, security logs) — our legitimate interest in protecting users.
• To understand and improve RoxConnect (analytics, crash reports) — our legitimate interest; we use aggregated or pseudonymised data wherever possible.
• To measure our own advertising (see “Advertising measurement”) — your consent for your advertising identifier and hashed email; our legitimate interest for pseudonymous install, app-event and subscription data.
• To meet legal obligations (for example tax records for purchases).

We do not sell your personal data and we do not show third-party ads in the app. We measure which of our own ads bring athletes to RoxConnect (see “Advertising measurement”).

Advertising measurement

RoxConnect runs ads on Meta (Facebook and Instagram). To know which ads bring people to the app, and to improve those campaigns, we use Appstack, an ad-measurement (attribution) provider. What is shared depends on whether you allow it, as described below.

When we ask. On iPhone, iOS asks whether RoxConnect may track you (App Tracking Transparency) the first time you open the app. On Android, the app asks “Measure ads?” the first time you open it.

What is shared if you allow it.

• Your device’s advertising identifier (IDFA on iPhone, Advertising ID on Android), and basic device and app information (device model, operating system, app version, IP address).
• App events: that you installed the app, created an account and completed onboarding.
• Your subscription and Super like purchases (product, price, date), linked to a pseudonymous app ID, sent through our subscription provider RevenueCat.
• On iPhone only: your email address, in hashed form, so that Meta can match the ad you saw to your account.

What we use it for. Only to measure and improve our own advertising. It is never used to show you ads from other companies inside RoxConnect, and it is never sold.

If you don’t allow it. On Android, the Appstack SDK is not started and no advertising identifier is collected. Our subscription provider RevenueCat still informs Appstack of subscription events, but without any identifier that links them to your device or to an ad. On iPhone, Appstack still receives that the app was installed and the app events above (account created, onboarding completed), and RevenueCat informs Appstack of your subscription events. This is done without your advertising identifier or email, so it can’t be used to follow you across other companies’ apps. On both platforms the app works exactly the same.

Changing your mind. On iPhone: Settings → Privacy & Security → Tracking → RoxConnect. On Android: RoxConnect → Settings → “Measure ads”. You can also reset or delete your advertising identifier in your device settings.

Legal basis (EEA/UK). For your advertising identifier and hashed email: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time as described above. For the pseudonymous install, app-event and subscription data described above: our legitimate interest in measuring our own advertising (Art. 6(1)(f) GDPR). You can object to this at any time by writing to us at hello@roxconnect.com.

What other users can see

Other athletes can see your profile (name, photos, age, country, divisions, preferences, strengths and race history) and an approximate distance to you. They cannot see your email address, exact location or purchases. Public pages on roxconnect.com only show aggregated numbers (for example “28 athletes going”); counts below 3 are never shown.

Service providers

We share data only with providers that process it on our behalf under data-processing agreements:

• Supabase — database, authentication and file storage
• Stream — chat and messaging
• OneSignal — push notifications
• RevenueCat — subscription management (with Apple App Store and Google Play)
• PostHog (EU hosting) — product analytics
• Sentry — crash and error reporting
• Loops — transactional and product emails
• Cloudflare — website hosting, security and Turnstile
• Appstack (Appstack Tech, Inc., USA) — ad measurement (attribution) of our advertising campaigns (see “Advertising measurement”)
• Meta Platforms (Facebook/Instagram Ads) — advertising platform; receives measurement events and, on iPhone and only with your consent, your hashed email. Meta also uses this data as a controller under its own privacy policy (facebook.com/privacy/policy)
• Apple and Google — sign-in, app distribution, payments and maps
• Our backend hosting provider, which runs RoxConnect’s servers

Some providers are located outside the European Economic Area. When data is transferred, we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision. In particular, Appstack processes data in the United States and relies on Standard Contractual Clauses; Meta Platforms Ireland Limited transfers data to Meta Platforms, Inc. in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses.

How long we keep data

• Account and profile data: while your account is active. When you delete your account, personal data is deleted within 30 days and removed from backups within 90 days.
• Day-level activity records: up to 180 days.
• Race-alert emails: until you unsubscribe.
• Purchase records: as long as required by tax law.
• Aggregated, anonymous statistics may be kept because they no longer identify you.

Deleting your account

You can delete your account at any time in the app: Settings → Account → Delete Account. You can also email hello@roxconnect.com with the subject “Delete My Account” from the email address linked to your account; we may ask you to confirm your identity. Account deletion is permanent.

Your rights

Under the GDPR you have the right to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent at any time. To exercise them, email hello@roxconnect.com. You also have the right to lodge a complaint with a supervisory authority; in Portugal this is the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt).

Children

RoxConnect is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, contact hello@roxconnect.com and we will delete it.

Security

We protect your data with industry-standard measures, including encryption in transit, access controls and coarsened location storage. No system is completely secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.

Changes to this policy

We may update this policy. We will post the new version on this page with a new date and, for material changes, notify you in the app or by email.

Contact

Questions about this policy or your data: hello@roxconnect.com