What we know about you, and why.

1. Who is responsible

   OutliftMe (outliftme.com) is operated by Dejan Lazeski, an individual based in the Czech Republic, X handle @lazeskid. Under the GDPR that makes him the data controller. Reach him at hello@outliftme.com.

   There is no company behind the site yet. If that changes, this page will name it and the date it took over.

2. Public by design

   OutliftMe is a public leaderboard. Everything you put on it is meant to be seen: your X handle and profile photo, the lift, the weight, your bodyweight, the DOTS score, the link to your video, your rank, the country, profession, company or project you chose to add, any support or payment link you posted, and the verification status. Profile pages are indexed by search engines and rendered into share images.

   Bodyweight and sex are published. DOTS needs both to compare lifters fairly. If you do not want that public, do not submit a lift.

   When a lift is verified, the official account @OutliftMe may post about it on X: your handle, the lift and weight, and a link to your board, quoting your evidence post. That post is public and stays on X under X's terms.

3. What we store, and why

   When you sign in with X we receive your X user id, username, display name and profile image address from X. We store them with the time of your first and most recent sign-in and a sign-in counter. This identifies your account, shows your photo, and tells us how many people sign up. Legal basis: performing the service you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in knowing whether the product is used (Art. 6(1)(f)).

   We do not receive or keep your email address, password, phone number, X access token (it is discarded the moment your username is read), posts, followers, or direct messages. The only X permissions requested are the read-only ones needed to learn who you are. Donating is the one exception for email, see below.

   When you submit a lift we store the lift type, weight, bodyweight, sex (for DOTS), the video link, the time, and any country, profession, company, project name, project link, and support or payment link you typed. Legal basis: performing the service (Art. 6(1)(b)). All of it is published, see above.

   When you challenge a lift we store your handle, the reason you picked, and the time. The challenge is shown publicly on the contested lift with your handle.

   When an operator reviews a lift we store the outcome and the time.

   When you donate, Stripe collects your name, email address, country, payment method details and the amount. Card numbers go to Stripe only; we never see or store them. We can see the rest in our Stripe account, to send receipts, answer questions, handle refunds and keep the accounts. Our own database stores nothing about donations, and a donation is not linked to your X handle or to anything on the board. Legal basis: processing the donation you asked to make (Art. 6(1)(b)), our legal obligation to keep accounting and tax records (Art. 6(1)(c)), and our legitimate interest in preventing fraud (Art. 6(1)(f)).

   The retired network pass. Listing extras used to need a paid pass, with the first lifters getting it free. Both are retired and nothing is collected for them any more. If you held an early free pass or bought one before that, the record (slot number or Stripe checkout ids, handle and time) is kept as described under how long we keep it. Legal basis: our legitimate interest in keeping past grants and payments exact (Art. 6(1)(f)) and our accounting obligations (Art. 6(1)(c)).

   Abuse limits. Submissions and challenges are limited per handle per 24 hours. We keep a counter per handle and day for that.

   Messages you send us. If you email a removal request, a takedown notice or a question, we keep that correspondence for as long as needed to answer it and to show what was asked and done.

   Server logs. Our hosting provider records each request (IP address, browser user agent, URL, time) for a short period, hours to a day, to run and debug the service. Cloudflare Web Analytics records aggregate page views (path, referrer, country, browser) with a cookieless beacon; it does not set cookies, use local storage, or fingerprint visitors.

   Product analytics. PostHog (eu.posthog.com) receives events our server sends when you sign in, submit a lift, challenge a lift, or when an operator reviews one. Those events are identified by your X handle and may include the lift type, the unit you entered in, the sex category you lift in, the projected rank, whether you filled in a profession, company, or project (not what you typed), why a submission was refused, the challenge reason, and the review outcome. We do not send video URLs, bodyweights, passwords, or tokens. When you remove your account, we ask PostHog to delete your events too. PostHog sets no cookies on this site. Legal basis: our legitimate interest in seeing whether the product is used (Art. 6(1)(f)). We do not run advertising trackers and do not build profiles of people who only browse.

4. Cookies

   We set only cookies the site cannot work without, so there is no consent banner. None of them track you across other sites.

   • __Host-outlift_session, 30 days. A signed token saying which X handle is signed in. Cleared when you sign out.
   • outlift_oauth, 10 minutes. Protects the sign-in round trip to X against forgery. Removed when sign-in completes or fails.
   • __Host-outlift_operator, 7 days. Only set for the operator who reviews lifts.
   • outlift-unit, one year. Remembers whether you view weights in kg or lbs so the board can render in that unit on the first paint. Also kept in local storage under the same name. It is not used to identify you.

   Video evidence plays on this site only after you open a “Watch” panel. X clips are fetched by our server from X's video CDN (video.twimg.com) and played here. Profile photos load from X's image servers (pbs.twimg.com).

   Submit, challenge, withdraw, support-link, and account-deletion forms load Cloudflare Turnstile from challenges.cloudflare.com to stop scripted posts. That script may set a cookie such as cf_clearance on Cloudflare's own domain. We do not read it.

5. Who processes it for us

   • Supabase hosts the database in Frankfurt, Germany (EU). Everything listed above lives there.
   • Vercel Inc. (USA) runs the web application and keeps the short-lived server logs. Vercel processes data under EU Standard Contractual Clauses.
   • X Corp. provides sign-in, hosts your evidence posts and profile photo, and hosts the @OutliftMe announcements. Your relationship with X is governed by X's own privacy policy.
   • Cloudflare provides DNS for the domain, forwards email sent to hello@outliftme.com, runs Turnstile on the submit and challenge forms, and runs Cloudflare Web Analytics as described above.
   • PostHog (eu.posthog.com, EU cloud) receives the product events described above. It does not run in your browser.
   • Stripe processes donations, as described above. For some of that data, such as fraud checks and financial regulation, Stripe is responsible on its own under its privacy policy.

   To show a preview image for an X evidence post, our server (not your browser) asks a public read-only mirror of X for the post's thumbnail. No visitor data is sent.

   We do not sell personal data and never will.

6. How long we keep it

   • Account record (sign-in data): until you ask us to delete it.
   • Verified lifts: as long as they hold rank, or until you withdraw them or remove your account.
   • Rejected or deleted clips, and clips of a challenged lift you withdraw: the video identifier is kept in a tombstone so the same clip cannot be resubmitted under another handle. That identifier is not shown on the board.
   • Billing records (each donation or past payment: by whom, when, for how much, and any receipt or refund): 10 years, as Czech accounting and tax law requires, even after you remove your account. They are kept in Stripe and our accounts, not on the board.
   • Retired pass records in our database: a checkout row is deleted when you remove your account. The Stripe id of a refunded or disputed payment is kept, without your handle. An early pass slot is kept for good.
   • Abuse counters: per day, kept briefly.
   • Server logs: hours to a day, at the hosting provider.
   • Backups: deleted rows can survive in database backups for up to 7 days before they age out.

   Anything already public may persist in places we do not control: search engine caches, screenshots, and posts on X.

7. Your rights

   You can ask to see the data we hold about you, correct it, have it deleted, restrict or object to its processing, and receive a copy in a portable format. Signed in, use Remove me from OutliftMe on your board, or withdraw a single lift. You can also email hello@outliftme.com, or message @OutliftMe from the X account in question so we know it is you. We act within 30 days when you use the email fallback.

   Removing yourself from the board deletes your lifts, challenges and account record, and deletes the @OutliftMe announcement posts when posting is configured. Billing records and any early pass slot from the retired pass are kept, as described under how long we keep it.

   You may complain to the Úřad pro ochranu osobních údajů (Czech Office for Personal Data Protection), uoou.gov.cz, or to the data protection authority where you live.

8. Age

   You must be at least 15 to sign in or post a lift. That is the digital age of consent in the Czech Republic, where the site is run. If we learn that someone younger has an account, we delete it and its lifts.

9. Security

   Everything is served over HTTPS. Session cookies are signed so they cannot be forged, and are never readable by scripts. We store no passwords and no X access tokens. The review console is restricted to the operator. If you find a security problem, email hello@outliftme.com.

10. Changes

    When this page changes, the date at the top changes with it. Material changes, such as a new category of data or a new processor, are also announced from @OutliftMe. The terms describe the rules for using the board.

Questions: hello@outliftme.com