OutliftMe
Sign in with X

Privacy

What we know about you, and why.

Short version: we know your X handle, your photo, your lifts, and the numbers you typed. Almost all of it is public because that is the product. We keep no email, no password, no tokens, and run no trackers.

Last updated 5 September 2026 · Terms

  1. 01

    Who is responsible

    OutliftMe (outliftme.com) is operated by Dejan Lazeski, an individual based in the Czech Republic, X handle @lazeskid. Under the GDPR that makes him the data controller. Reach him at hello@outliftme.com.

    There is no company behind the site yet. If that changes, this page will name it and the date it took over.

  2. 02

    Public by design

    OutliftMe is a public leaderboard. Everything you put on it is meant to be seen: your X handle and profile photo, the lift, the weight, your bodyweight, the DOTS score, the link to your video, your rank, the country, profession, company or project you chose to add, and the verification status. Profile pages are indexed by search engines and rendered into share images.

    Bodyweight and sex are published. DOTS needs both to compare lifters fairly. If you do not want that public, do not submit a lift.

    When a lift is verified, the official account @OutliftMe may post about it on X: your handle, the lift and weight, and a link to your board, quoting your evidence post. That post is public and stays on X under X's terms.

  3. 03

    What we store, and why

    When you sign in with X we receive your X user id, username, display name and profile image address from X. We store them with the time of your first and most recent sign-in and a sign-in counter. This identifies your account, shows your photo, and tells us how many people sign up. Legal basis: performing the service you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in knowing whether the product is used (Art. 6(1)(f)).

    We do not receive or keep your email address, password, phone number, X access token (it is discarded the moment your username is read), posts, followers, or direct messages. The only X permissions requested are the read-only ones needed to learn who you are.

    When you submit a lift we store the lift type, weight, bodyweight, sex (for DOTS), the video link, the time, and any country, profession, company, project name and project link you typed. Legal basis: performing the service (Art. 6(1)(b)). All of it is published, see above.

    When you challenge a lift we store your handle, the reason you picked, and the time. The challenge is shown publicly on the contested lift with your handle.

    When an operator reviews a lift we store the outcome and the time.

    Abuse limits. Submissions and challenges are limited per handle per 24 hours. We keep a counter per handle and day for that.

    Messages you send us. If you email a removal request, a takedown notice or a question, we keep that correspondence for as long as needed to answer it and to show what was asked and done.

    Server logs. Our hosting provider records each request (IP address, browser user agent, URL, time) for a short period, hours to a day, to run and debug the service. We do not run analytics or advertising trackers and do not build profiles of visitors.

  4. 04

    Cookies

    We set only cookies the site cannot work without, so there is no consent banner. None of them track you across other sites.

    • __Host-outlift_session, 30 days. A signed token saying which X handle is signed in. Cleared when you sign out.
    • outlift_oauth, 10 minutes. Protects the sign-in round trip to X against forgery. Removed when sign-in completes or fails.
    • __Host-outlift_operator, 7 days. Only set for the operator who reviews lifts.

    Your kg/lb preference is kept in your browser's local storage under outlift-unit. It never leaves your device.

    Video evidence is embedded from X or YouTube only after you open a “Watch” panel. At that point your browser talks to X (platform.twitter.com) or YouTube (youtube-nocookie.com), and those services may set their own cookies under their own policies. Profile photos load from X's image servers (pbs.twimg.com).

  5. 05

    Who processes it for us

    • Supabase hosts the database in Frankfurt, Germany (EU). Everything listed above lives there.
    • Vercel Inc. (USA) runs the web application and keeps the short-lived server logs. Vercel processes data under EU Standard Contractual Clauses.
    • X Corp. provides sign-in, hosts your evidence posts and profile photo, and hosts the @OutliftMe announcements. Your relationship with X is governed by X's own privacy policy.
    • Google / YouTube if your evidence is a YouTube video, when a visitor opens it.
    • Cloudflare provides DNS for the domain and forwards email sent to hello@outliftme.com.

    To show a preview image for an X evidence post, our server (not your browser) asks a public read-only mirror of X for the post's thumbnail. No visitor data is sent.

    We do not sell personal data and never will.

  6. 06

    How long we keep it

    • Account record (sign-in data): until you ask us to delete it.
    • Verified lifts: as long as they hold rank, or until you ask us to remove them.
    • Rejected submissions: the video link is kept so the same clip cannot be resubmitted under another handle. Removed on request.
    • Abuse counters: per day, kept briefly.
    • Server logs: hours to a day, at the hosting provider.
    • Backups: deleted rows can survive in database backups for up to 7 days before they age out.

    Anything already public may persist in places we do not control: search engine caches, screenshots, and posts on X.

  7. 07

    Your rights

    You can ask to see the data we hold about you, correct it, have it deleted, restrict or object to its processing, and receive a copy in a portable format. Email hello@outliftme.com, or message @OutliftMe from the X account in question so we know it is you. We act within 30 days.

    Removing yourself from the board deletes your lifts, challenges and account record. The @OutliftMe announcement posts are deleted on request too.

    You may complain to the Úřad pro ochranu osobních údajů (Czech Office for Personal Data Protection), uoou.gov.cz, or to the data protection authority where you live.

  8. 08

    Age

    You must be at least 15 to sign in or post a lift. That is the digital age of consent in the Czech Republic, where the site is run. If we learn that someone younger has an account, we delete it and its lifts.

  9. 09

    Security

    Everything is served over HTTPS. Session cookies are signed so they cannot be forged, and are never readable by scripts. We store no passwords and no X access tokens. The review console is restricted to the operator. If you find a security problem, email hello@outliftme.com.

  10. 10

    Changes

    When this page changes, the date at the top changes with it. Material changes, such as a new category of data or a new processor, are also announced from @OutliftMe. The terms describe the rules for using the board.

Questions: hello@outliftme.com