Privacy Policy

This Privacy Policy explains how RoxConnect collects, uses and protects personal data when you use the RoxConnect mobile app (iOS and Android) and the website roxconnect.com. RoxConnect helps HYROX athletes find doubles, relay and training partners.

Who we are

The data controller is Alexandre Morgado, sole trader (empresário em nome individual), Rua Francisco Alvo, Edf. Solar Horta, Lote 16, 8500-759 Portimão, Portugal, tax number (NIF) 251833925 (“RoxConnect”, “we”, “us”). You can contact us about privacy at any time at hello@roxconnect.com.

RoxConnect is an independent app. HYROX is a trademark of its respective owner; we are not affiliated with or endorsed by HYROX.

Data we collect in the app

Account data: your name, email address and sign-in method (email, Sign in with Apple or Google). We never receive your Apple or Google password.

Profile data you choose to add: photos, date of birth, gender, country, preferred language, bio, HYROX divisions, run pace, strengths and goals, training preferences, gym affiliation, and the HYROX races you target or have completed. Your HYROX results may be linked from public official results when you add a race.

Location: if you allow it, your approximate location. We store it coarsened to about 1 km and other users only ever see an approximate distance, never your exact position. Location is optional; you can search by race instead.

Messages and activity: messages you send to other athletes and in event chats, training activities you create or join, connections, saved profiles, profile views, and a day-level record of when you were active (no timestamps, IP addresses or devices).

Purchases: if you subscribe to Premium, the store (Apple or Google) processes the payment. We receive the subscription status and product, never your card details.

Device and usage data: device model, operating system and app version, push notification token, in-app events (for example screens opened and features used) and crash reports, used to run, secure and improve the app.

Data we collect on roxconnect.com

Analytics: we use PostHog in cookieless mode: no cookies or local storage are set and IP addresses are anonymised. We measure page views and clicks on the App Store and Google Play buttons in aggregate.

Race alerts: if you sign up for race alerts, we store your email address, language and the race you are interested in, and send you emails about it. Every email has an unsubscribe link. The form is protected by Cloudflare Turnstile, which checks that the request comes from a human.

Organizer interest: if you fill in the organizer form on the Activities page, we store your email address, the kind of organizer you are, your city, your club or business name (optional) and your language. We use them only to send you a confirmation and to contact you about organizer features — on the basis of your request (consent), which you can withdraw at any time by writing to us or using the unsubscribe link. The form is protected by Cloudflare Turnstile.

Hosting and security logs: our hosting provider processes technical data such as IP address and browser type to deliver the site and protect it against abuse.

How we use your data and why we are allowed to

• To provide the service (account, profile, matching, messaging, activities, Premium) — performance of our contract with you.
• To show you athletes and races nearby — your consent to location access, which you can withdraw in your device settings.
• To send push notifications — your consent in your device settings.
• To send product and race-alert emails — your consent; you can unsubscribe at any time.
• To keep RoxConnect safe (fraud prevention, moderation, security logs) — our legitimate interest in protecting users.
• To understand and improve RoxConnect (analytics, crash reports) — our legitimate interest; we use aggregated or pseudonymised data wherever possible.
• To meet legal obligations (for example tax records for purchases).

We do not sell your personal data and we do not use it for third-party advertising.

What other users can see

Other athletes can see your profile (name, photos, age, country, divisions, preferences, strengths and race history) and an approximate distance to you. They cannot see your email address, exact location or purchases. Public pages on roxconnect.com only show aggregated numbers (for example “28 athletes going”); counts below 3 are never shown.

Service providers

We share data only with providers that process it on our behalf under data-processing agreements:

• Supabase — database, authentication and file storage
• Stream — chat and messaging
• OneSignal — push notifications
• RevenueCat — subscription management (with Apple App Store and Google Play)
• PostHog (EU hosting) — product analytics
• Sentry — crash and error reporting
• Loops — transactional and product emails
• Cloudflare — website hosting, security and Turnstile
• Apple and Google — sign-in, app distribution, payments and maps
• Our backend hosting provider, which runs RoxConnect’s servers

Some providers are located outside the European Economic Area. When data is transferred, we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision.

How long we keep data

• Account and profile data: while your account is active. When you delete your account, personal data is deleted within 30 days and removed from backups within 90 days.
• Day-level activity records: up to 180 days.
• Race-alert emails: until you unsubscribe.
• Purchase records: as long as required by tax law.
• Aggregated, anonymous statistics may be kept because they no longer identify you.

Deleting your account

You can delete your account at any time in the app: Settings → Account → Delete Account. You can also email hello@roxconnect.com with the subject “Delete My Account” from the email address linked to your account; we may ask you to confirm your identity. Account deletion is permanent.

Your rights

Under the GDPR you have the right to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent at any time. To exercise them, email hello@roxconnect.com. You also have the right to lodge a complaint with a supervisory authority; in Portugal this is the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt).

Children

RoxConnect is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, contact hello@roxconnect.com and we will delete it.

Security

We protect your data with industry-standard measures, including encryption in transit, access controls and coarsened location storage. No system is completely secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.

Changes to this policy

We may update this policy. We will post the new version on this page with a new date and, for material changes, notify you in the app or by email.

Contact

Questions about this policy or your data: hello@roxconnect.com