Privacy Policy

VELOX ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how personal data is collected, used, stored, and protected when you use the VELOX mobile application, website, and related services (collectively, the "Platform").

Scope of This Policy

This Privacy Policy applies to: • The VELOX mobile application ("App") • The VELOX website ("Website"), if available • Features, tools, and services offered through the App and Website (the "Services") This Policy is provided for informational purposes under applicable data protection laws and does not form part of any contract.

Data Controller

The data controller for personal data processed through the Services is TESORO SA (PTY) LTD, trading as Lumic Social ("Velox", "we", "us"), a company registered in the Republic of South Africa. For GDPR and UK GDPR purposes we act as controller for account and app data you provide to us. Privacy contact: support@velox.fitness. If you need our registered office address for legal correspondence, email us at that address and we will provide it.

Failure to Provide Personal Data

Where personal data is required to create an account or provide core functionality, failure to provide such data may result in limited access to the Services or the inability to provide requested features.

Information We Collect

Personal Information

• Email address, first and last name, preferred nickname, profile photo, date of birth, gender, and time zone (used for scheduling and local-day boundaries).
• Progress photos, weight, height, body measurements, nutrition diary entries, water intake logs, and custom workouts you create.
• Push notification device tokens and in-app push notification preferences (per notification type).

Apple Health & Health Connect

If you connect Apple Health (iOS) or Health Connect (Android), we read steps and active energy (calories) that you authorize and sync daily totals to your account. We use this data only to show activity in the App and do not use it for advertising. You can disconnect access in the App or in your device health settings at any time.

Sign-In & Authentication

If you register or sign in with a third-party provider (such as Google or Apple), we receive information that provider shares with us (for example, your email address and a provider user identifier), as permitted by your settings with that provider. We do not receive your third-party account password.

Fitness & Health-Related Data

As a fitness application, VELOX processes health-related data that you voluntarily provide, including workout sessions, training performance metrics, and exercise history.

Usage & Technical Data

We collect technical data such as app or website usage statistics, device and browser information, app version, and crash diagnostics to maintain and improve the Platform. This includes analytics events describing how you move through and use the App, which are described in "Analytics & Crash Reporting" below.

Email

We send transactional emails when you create an account (welcome), reset your password, contact support, or delete your account (goodbye). We do not offer marketing email preference controls because we do not send promotional email campaigns through the App.

Usage metering

We store per-user daily counts of database reads and writes in Firebase to monitor infrastructure cost and abuse. This metering is separate from Firebase Analytics and is not controlled by the Share Usage Data setting.

Legal Basis for Processing (GDPR)

We process personal data under the following legal bases: • Contract (Art. 6(1)(b)) – to create and manage accounts and deliver Services • Consent (Art. 6(1)(a)) – for optional usage analytics when you opt in at sign-up, on the legal update screen, or under Settings → Share Usage Data • Explicit Consent (Art. 9(2)(a)) – for health and fitness-related data, collected when you accept the health-data consent during sign-up or re-consent • Legitimate Interests (Art. 6(1)(f)) – for security, fraud prevention, and service reliability (including crash diagnostics) • Legal Obligation (Art. 6(1)(c)) – where required by law

Analytics & Crash Reporting

We use Firebase Analytics to understand how the App is used, and Firebase Crashlytics to identify technical issues. Analytics helps us see which features are valuable, where people get stuck, and what to improve or remove.

What Analytics Records

Analytics records events about your activity in the App rather than the contents of what you log. These events include: • Screens and tabs you open, and how you move through sign-up and onboarding • Training activity, such as starting, completing, or leaving a workout, saving a custom workout, and enrolling in a program • Hyrox setup and training-plan choices, including race simulation activity • The fact that you recorded an entry in a tracker such as nutrition, water, weight, progress photos, or body measurements • Opening, sharing, or saving a share card We do not send the contents of your entries to Analytics. For example, we record that a meal or weight was logged, not the food or the value.

Analytics Profile Attributes

So that usage can be understood by group rather than individually, we also store a small number of general attributes alongside these events: your experience level, race division, preferred training discipline, whether you use guided coaching, whether a training plan is set up, and whether a race date is set together with a broad indication of how far away it is.

Identifiers & Your Control

Analytics data is linked to a pseudonymous app installation identifier and to your account identifier. It is never used for advertising, and no advertising identifiers are collected or shared. Analytics is off by default until you opt in at account creation, accept the optional analytics checkbox when we ask you to re-consent, or turn on Settings → Share Usage Data. You can turn analytics off again at any time in Settings. Crash diagnostics remain active in production builds so that we can detect and fix stability problems; they are not used for advertising.

Cookies, Online Advertising & Tracking Technologies

Public Website (marketing)

On public pages at velox.fitness we use Google Ads (including the Google tag and related measurement) and the Meta Pixel to run and measure online advertising, including conversions and remarketing. These services may set cookies and similar identifiers (for example _ga, _gcl_*, _fbp) and receive information about your visit, device, and interactions with our ads. Where required by law, we obtain consent before loading non-essential advertising tags. Details, durations, and your choices are in our Cookie Policy.

Google and Meta process data under their own privacy policies. We do not use health or fitness data from the App to target these website ads.

Mobile App

The Velox App does not use your health or workout content for cross-context behavioural advertising. Optional Firebase Analytics is described above; we signal to Firebase that advertising storage consent is not granted for in-app analytics. Analytics collection can be switched off under Settings → Share Usage Data.

Automated Decision-Making

VELOX does not make decisions based solely on automated processing that produce legal or similarly significant effects on users.

Data Sharing & Third Parties

We do not sell personal data. Data may be shared only with trusted service providers acting as data processors—for example:

• Google Firebase — Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, Remote Config, App Check, Performance Monitoring, Analytics, and Crashlytics
• Google BigQuery — aggregated analytics and race-result processing
• Apple — Sign in with Apple (where you choose it)
• Postmark — transactional and support email delivery
• YouTube — embedded exercise demonstration videos
• Open Food Facts — barcode product lookups; contributions you make may be published under Open Food Facts' open-data licence
• Garmin Connect IQ — companion watch app for eligible accounts
• Google Ads / Google Marketing Platform — online advertising and conversion measurement on the public Website
• Meta (Facebook / Instagram ads) — Meta Pixel and ad measurement on the public Website

We do not sell personal data. We do not currently use in-app subscription billing processors; premium access may be enabled manually while billing integrations are prepared.

Public HYROX race results

We collect publicly published HYROX race results (including athlete names, gender, age group, nationality, bib numbers, finish times, and disqualification information) from official HYROX results sources to power leaderboards and benchmarks in the App. This data may relate to individuals who do not have a Velox account. We process it based on our legitimate interests in providing accurate race information and analytics, balanced against your rights. If you appear in public results and object to our use, contact support@velox.fitness and we will review your request.

International Data Transfers

Personal data may be processed outside your country of residence. Where data is transferred outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses approved under GDPR.

Data Retention & Account Deletion

You may delete your account at any time from within the App (Settings → Delete Account). Our backend removes Firestore documents keyed to your user ID and deletes your files in Cloud Storage, and sends a goodbye email to confirm deletion. Firebase Analytics and Crashlytics events linked to your account age out on Google's retention schedules rather than being deleted immediately. Contact-form messages and email provider logs may be retained for support and legal purposes. Data cached on your device is not cleared automatically when the account is deleted. We do not configure Firestore point-in-time recovery in our project repository; if operational backups exist in Google Cloud, they are purged on Google's standard backup retention schedule unless law requires longer storage.

Information Security

We implement appropriate technical and organizational measures, including encryption and access controls, to protect personal data. No system can be completely secure.

Children's Privacy

VELOX is not intended for children under the age of 13. We do not knowingly collect personal data from children.

Your choices and controls

Declining optional tracking or marketing measurement does not remove your access to Velox features unless a choice is required to create an account (for example accepting the Terms and health-data consent at sign-up).

Analytics & diagnostics (Firebase)

Velox uses Firebase Analytics to understand how the App is used and improve features, and Firebase Crashlytics and Firebase Performance Monitoring to diagnose crashes and performance issues. We do not use Mixpanel, Datadog, or session replay tools in the App.

Optional usage analytics are off until you opt in when you create an account, accept an updated legal screen, or turn on Settings → Share Usage Data. You can disable analytics again at any time in Settings. Turning analytics off does not affect access to App features.

Crash and performance diagnostics stay enabled in production builds so we can keep the App stable; they are not used for advertising and are not controlled by the Share Usage Data toggle. Infrastructure usage metering (daily database read/write counts) runs separately for cost monitoring and is not controlled by that toggle either.

Advertising & measurement (Google Ads, Meta)

On the public Website (velox.fitness marketing pages), we use Google Ads and the Meta Pixel to measure campaigns, conversions, and remarketing. These technologies are used only with your consent where required by law—for example through our cookie consent banner or preference centre on the Website, and through your browser’s cookie controls. See the Cookie Policy for details and provider opt-out links.

The Velox mobile App does not load the Meta Pixel or mobile attribution SDKs such as AppsFlyer. We do not use your health, workout, or nutrition data for advertising. If we introduce Apple App Tracking Transparency prompts or an Android in-app advertising consent flow in a future App version, we will update this Policy before they go live.

You can limit Meta matched and lookalike audiences and ad personalisation in your Meta account settings at any time; declining Website ad cookies does not affect App features.

Push notifications

Push notifications are controlled through your device’s system settings and through in-app notification preferences (per notification type). Denying push permission only affects notifications; the App remains fully functional.

Other essential storage

Local storage on your device (for example Hive boxes for offline data, analytics preference flags, and cached workouts or metrics) and cloud storage required for sign-in, sync, and core features are essential to how Velox works and cannot be switched off without uninstalling the App or deleting your account.

Your Rights (GDPR / UK GDPR)

You have the right to access, correct, delete, restrict, or object to the processing of your personal data, as well as the right to data portability and to withdraw consent at any time. Where we process data based on legitimate interests, you may object on grounds relating to your situation. Requests can be made by contacting support@velox.fitness. You also have the right to lodge a complaint with a supervisory authority in the European Economic Area or the UK, in particular in the member state or territory where you habitually reside, work, or where an alleged infringement occurred.

South Africa (POPIA)

If you are in South Africa, the Protection of Personal Information Act (POPIA) applies. You may contact us at support@velox.fitness with privacy requests. You may lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

California & Similar U.S. State Privacy Laws

If you are a resident of California or another U.S. state with comparable privacy laws, you may have additional rights regarding access, deletion, and correction of personal information, and to opt out of certain types of processing. We do not sell personal information. We may use cookies and pixels on the Website that involve "sharing" or targeted advertising under U.S. state laws; you can opt out via our cookie controls (where offered), browser settings, and provider opt-out pages linked in the Cookie Policy. To exercise other applicable rights, contact support@velox.fitness.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Updates will be reflected by revising the "Last updated" date.

Contact Us

For privacy-related questions or requests, contact us at: support@velox.fitness