Deutsch · English

Privacy Policy

Last updated: 30 October 2026, version 1.38

This is a translation for your convenience. The German version is legally binding.

This policy tells you what data ipixvent processes about you, why, on what legal basis, for how long and who receives it. It applies to the ipixvent app (iOS and Android), the website www.ipixvent.com and our support mailbox. The internal admin interface admin.ipixvent.com is for our staff only; its section is included for the sake of completeness. The complete text below is binding. Translations in the app are reading aids.

1. Who is responsible

The controller within the meaning of the GDPR is:

ipixvent
Esentepe Mah. 960. Sokak No: 2/6
Melikgazi/Kayseri, Türkiye
Email: support@ipixvent.com
Phone: ⟨phone number⟩

Data protection officer: ⟨if appointed: name and contact details; otherwise: “We have not appointed a data protection officer because the legal requirements under Art. 37 GDPR are not met.”⟩

For everything in this policy, this is the right address. We will reply to you in German or English. All details are also given in the Legal Notice.

2. Who the app is for and what this policy covers

ipixvent is aimed at people aged 14+ who reside in Austria. There are no accounts for younger people (section 12).

This policy covers:

• the ipixvent app for iOS and Android, including all features described in it;
• the website www.ipixvent.com, including the return page after ID verification;
• the support mailbox support@ipixvent.com;
• the admin interface admin.ipixvent.com, insofar as your data is displayed there.

Not covered is processing for which others are themselves responsible: what an organiser does with participant data outside the app, what Apple, Google and Stripe do during sign-in and payment, and what the OpenStreetMap Foundation does when map tiles are loaded. Where this is relevant, we say so at the relevant point and link to their policies.

Other texts also belong to ipixvent: the Terms of Use, the Community Guidelines, the participation terms of each individual Challenge, the terms of the Season programme and the website’s Cookie Policy. This policy does not contradict them; where they say something about data, they say the same as here.

3. Terms used

• Personal data is any information that can be related to you: your username, your email address, a video in which you can be seen, but also an identifier that only we can attribute to you.
• Processing means any handling of it: storing, displaying, passing on, deleting.
• We are the controller named in section 1. We decide why and how your data is processed.
• Processors are companies that process data only on our instructions, for example our database provider. They may not use the data for their own purposes. We have a contract under Art. 28 GDPR with each of them.
• Independent controllers are companies that process data for their own purposes as soon as they receive it, for example Apple when you buy a subscription. Their processing is governed by their own privacy policies.
• Legal basis is the reason that permits us to process data. We use four: contract (Art. 6(1)(b) GDPR: necessary to provide the app to you), legitimate interest (point (f): our interest or that of others, weighed against yours; we name it in each case), consent (point (a): you have expressly agreed and can withdraw at any time) and legal obligation (point (c): a law requires it, for example keeping receipts).
• Account ID is a random string (UUID) that our system gives your account. It does not appear on your profile, but it does appear in the addresses of your files.
• Hash is a fingerprint that is calculated from a value and cannot be turned back into that value. Peppered means: before the calculation, a secret addition is appended that exists only on our server. Without it, the fingerprint cannot be reproduced, not even by trial and error.
• Challenge is a competition in the app. The organiser creates it, runs it and offers any prize. Managers are people to whom the organiser has given rights over their Challenge (management, moderation, door). A jury consists of invited people who rate.
• Partners are businesses that grant perks in the Season programme. Advertisers place ads in the app. Neither needs a user account; with a Business account, an account is linked to them (4.11, “Business account”).
• Season is a period of the loyalty programme in which XP and Level are calculated.

4. What we process, why, on what basis, for how long

The table gives an overview. Below it, you will find exactly what happens for each feature. “Contract”, “legitimate interest”, “consent” and “legal obligation” are the legal bases from section 3. Detailed periods are given in section 8.

4.1 Account and sign-in

You need an account for everything except viewing public profiles. When you create one, you provide an email address, a password, your date of birth and a username; you can also choose a display name. Without an email address and date of birth there is no account, because otherwise we cannot reach you or check the minimum age. Your date of birth stays with us; it does not appear anywhere in the app and is not passed on to anyone.

Sign-in, passwords and sessions are managed by Supabase Auth on our behalf. Your password is stored there only as a hash. The emails for confirming your address and resetting your password are sent by Resend on our behalf (EU region Frankfurt); they contain your address and a link.

When you create your account, you accept the Terms of Use and confirm that you have read this policy. We store the version and the time of this. That is our proof that you agreed. Your confirmation is not consent to data processing; the legal bases we rely on are stated for each feature in this section.

Sign in with Apple. If you choose “Sign in with Apple”, we ask Apple for your email address and your name. Apple may offer to hide your address; we then receive a relay address (privaterelay.appleid.com) that forwards to you. We take over the email address and the Apple ID of your account. We suggest your name as your display name in the “Complete account” step; you can change it there. We ask you for your username and date of birth ourselves. In addition, during sign-in we exchange a one-time code with Apple for a revocation token; it is stored only on our server and serves solely to revoke your Apple sign-in for ipixvent when you delete your account — Apple requires this. When you delete your account, we send it to Apple and then remove it. Apple learns that and when you signed in to ipixvent. Apple is an independent controller for this.

Sign in with Google. Google sends us a sign-in token with your email address, your name, your profile picture and your Google ID. We take over the email address and the ID; we suggest your name as your display name in the “Complete account” step, and we do not take over the picture. Google learns that and when you signed in to ipixvent. Google is an independent controller for this.

Suspensions. If the ipixvent team suspends your account, this is recorded in Supabase Auth with an expiry date; indefinite suspensions carry a date far in the future. More on this in 4.13.

Disposable addresses. When an account is created, we check whether the email address belongs to a known disposable email service. The list of such services is public and is updated weekly. If the address belongs to one, we do not create an account. We do not store anything additional in the process.

Access codes. Private Challenges have an access code. We count failed attempts for 15 minutes per account, or per IP address for requests from people who are not signed in, to slow down guessing. After that, the counter is gone.

Registration. To stop anyone creating accounts en masse, we count new accounts per IP address. For this, we do not store the address itself, only an encrypted short value, and we delete it after 24 hours. If more than 30 new accounts come from the same address in one hour or more than 100 in one day, we temporarily accept no more.

Sign-in on a new device. If your account signs in on a device we do not yet know for your account, we send you an email with the device model and the time: if it was not you, you can change your password immediately. For this, the app reports, after sign-in and whenever it is opened, the ID of its installation (a random number it generates on first launch, not a hardware identifier; we store it only hashed) and the device’s model name, such as “iPhone 15 Pro Max”. For each account we remember the known devices with first and last use; we forget a device you have not used for 12 months (if it comes back after that, you get the email once), at the latest when the account is deleted; each individual sign-in, with time, device and whether an email was sent, we keep for only 30 days. There is no email on the very first sign-in to an account, and at most one per half hour. The email is sent by Resend on our behalf. The legal basis is our legitimate interest, and yours, in protecting your account from access by others.

4.2 Profile and public visibility

Your profile is public, even without signing in: username, display name, profile picture, bio, member since, counters (entries, Challenges, awards, ratings received with average stars, followers, following), the verified badge after passing ID verification, the “Reliable” badge, the label for organisers with a paid plan, your profile links and your public videos. If you set your profile to “private”, others only see the header: name, picture, bio, member since, badges and links; counters, entries and lists are visible only to people whose follow request you have accepted.

Profile pictures, entry photos and Challenge logos are stored in public folders of our file storage. Their addresses contain your account ID. Anyone who knows such an address can open the file, even without signing in. We do not give out the addresses, but the app shows the images to everyone who is allowed to see your profile or the entry.

Shared links. If you share a link to a profile, a Challenge or an entry, messengers and social networks (such as WhatsApp, Instagram or iMessage) show a preview with name, image and text. They fetch this information from our website. We only give out what is visible without signing in anyway: for a profile, display name, username, profile picture and bio; for a public Challenge without an age limit above 14, title, description, image, venue and who organises it; for an entry in such a Challenge, also the preview image, description and name of the person who submitted it, but not if their profile is private; for a spot duel, the spot, the category and the names of the two people competing, plus an image our server assembles from the stills of both duel videos, and after the end instead who won, with the still of their video (images only if the videos are visible without signing in from age 14; if either profile is private, neither names nor image). For private Challenges and Challenges for ages 18+, only a general preview without content appears. What the messenger does with the preview is governed by its own privacy policy.

Pages for search engines. For every public Challenge without an age limit above 14 there is a dedicated page on our website, in German, English, French and Turkish, which search engines such as Google or Bing can index and show in their results. It only contains what is visible without signing in anyway: title, description, image, category, whether videos or photos are submitted, time period, prize, who organises the Challenge (display name and username, linked only if the profile is public), how many people are taking part, other editions of the same series and, for on-site events and spot Challenges, venue, city and coordinates, plus the address for on-site events. The page also carries the same information in machine-readable form so that search engines recognise the Challenge as an event. Participants, entries, ratings and comments are not on it. A list of these pages (sitemap) tells search engines which ones exist. Whoever runs a Challenge can opt out at any time, including after it has ended: Challenge → Management → “Show on Google”. The page then no longer exists; the same applies if the Challenge is made private, its age limit is raised or it is deleted. We do not keep a copy of our own: the page is generated from the Challenge each time it is requested, and Cloudflare caches it for at most one hour. It disappears from a search engine’s results once the search engine fetches the page again; this usually takes a few days to a few weeks and is outside our control. What a search engine does with the information is governed by its own privacy policy. The legal basis is our legitimate interest in public Challenges being found and people taking part (Art. 6(1)(f) GDPR). As an organiser you exercise your right to object (Art. 21 GDPR) by opting out, otherwise via the contact in section 16.

The following are not public: your email address, your date of birth, all details of ID verification, your purchases, your sanctions, your block list, your individual ratings, your location. Other users do not get to see your account ID, except in the file addresses mentioned.

The app calculates the “Reliable” badge from your activity: at least 5 visible entries, at least 10 votes received, an average of at least 3.5 stars, at least 30 days of membership and 180 days without a sanction (default values that we can adjust). This is a calculation, not a decision with legal effect; you cannot lose anything except the badge.

We store your profile links only as a handle; the target host is determined by a catalogue of permitted services. We record changes to your username and display name with the time, so that the waiting period between two changes can be counted.

4.3 Content: videos, photos, comments, chat, stories

Videos are uploaded by the app directly from your device to Bunny.net. Bunny sees your IP address in the process. At Bunny, the video carries a title made up of your username, the Challenge title, the date and your account ID, so that we can assign it. Bunny converts it into playback formats and delivers it via its network to everyone who is allowed to see it; here too, Bunny sees the IP address of the viewers. Our server generates the playback address; it is not given to third parties in plain text.

Photos are stored in our file storage at Supabase (Frankfurt) under a path made up of your account ID and the entry ID. For each entry we store the caption (up to 200 characters), the time and the Challenge; for videos, also which track from our music library you chose. The music library contains only tracks that we provide ourselves; rights holders do not learn who uses which track.

No hidden information. Phone photos and videos often carry hidden information in the file: the place of capture, the device and the time of capture. The app removes this on your device before anything is uploaded — for videos by repackaging the file, for photos by saving the image again. We therefore do not receive the place where your photos and videos were taken. If, exceptionally, a location cannot be removed from a video, the app does not upload it and asks you to record it directly in the app.

If you delete an entry, it is immediately invisible to everyone. The file goes into a deletion queue that is processed every 10 minutes; after that, its deletion has been requested at Supabase or Bunny respectively. Bunny removes copies from its delivery network usually within a few minutes.

Comments (up to 500 characters) appear under entries and are visible to everyone who sees the entry. If you delete a comment, it is marked as deleted and no longer shown; it is permanently removed together with the entry it is under, at the latest with your account.

Chat. Every Challenge has chat rooms (public and crew). Messages (up to 1,000 characters) are visible to everyone in the room; mentions with @ link to a profile. Whoever organises or manages the Challenge, and the ipixvent team, can delete messages with a reason and mute people with a reason; you see the reason. Chat messages and mutes are deleted 3 days after the Challenge ends (nightly job; we can set the period between 1 and 30 days and state the current value here). There are no direct messages between accounts.

Stories for a Challenge disappear 24 hours after posting; a job that runs every 10 minutes removes them and requests deletion of the file.

Hiding. If you hide an entry, we remember this per account so that it is no longer shown to you. No one else learns about it.

If your content shows other people, you are responsible for making sure they agree. What this means for the people shown is set out in section 5.

4.4 Ratings and leaderboards

If you rate an entry with one to five stars, we store your vote with your account ID, so that each person votes only once per entry and we can detect manipulation. Others only see the average and the number of votes, never your individual vote. You see your own. At on-site events, the same applies to the votes of the checked-in audience. You can change a vote once; after that it is final.

Protection against manipulation. You can rate online 24 hours after creating your account and once your email address is confirmed; jury members and the checked-in audience on site are exempt from this. For each vote we store two characteristics in order to detect multiple accounts: your internet connection in shortened form (for IPv4 without the last block, for IPv6 only the first four groups) and a random ID of your app installation. We store both only as a hash with a secret key, never in plain text; your IP address cannot be worked out from them. If several accounts vote for the same entry from the same device or connection, or if conspicuously many brand-new accounts vote, the case is flagged to the ipixvent team. A human decides, nothing happens automatically, because different people often share the same network. A vote that we classify as manipulation no longer counts afterwards; it remains in our admin log with the reason, and you cannot rate this entry again. We delete the two characteristics 30 days after the Challenge ends. The legal basis is our legitimate interest in fair scoring and in preventing abuse; you can object (section 9).

Likes. We store a like with your account ID and the time, one like per person and entry. A like is not a rating and does not count towards leaderboards. The number of likes is visible to everyone who is allowed to see the entry; the app shows who is behind them to the person the entry belongs to (the list can be retrieved by anyone who is allowed to see the Challenge). You can take back a like. If there is a block, your name disappears from this list, but the number stays.

Replies and hearts on comments. You can reply to a comment; the reply appears underneath it, and the person whose comment was replied to receives a notification. We store a heart on a comment with your account ID, one per person and comment. The number of hearts is visible to everyone who is allowed to see the comment; we show no one who gave a heart. The number also determines which comments appear at the top. If you remove a comment, we delete its hearts immediately.

Views. If an entry is visible on your screen for at least two seconds and you are signed in, we count a view. So that each person counts towards an entry only once a day, we remember your account ID, the entry and the date; we delete this record after two days at the latest. After that, only the number remains: per entry in total and per day, with no link to you. Your own entries do not count. The number is visible to the person the entry belongs to; everyone else sees it only after the Challenge ends, so that it does not influence the rating. Whoever organises or co-manages the Challenge sees the total for the Challenge, and a sponsor sees it in its report, also without names. Views do not count towards leaderboards. The legal basis is our legitimate interest in showing participants, organisers and sponsors their reach; you can object (section 9).

The app calculates leaderboards from the votes and from nothing else. There is a leaderboard for each Challenge (weighted average of the stars) and an overall leaderboard across all Challenges, either for all time or for the last 30 days; it sorts by the total number of stars and, in the event of a tie, by average and number of entries. “30 days” counts stars given and entries submitted during that period. With jury or organiser scoring, jury members and organisers see their own ratings; participants see the average and the number of votes.

If you delete your account, your votes are removed and the affected leaderboards are recalculated. This may change other people’s rankings.

4.5 Challenges, organiser registration and roles

Creating a Challenge. You enter the title, description, your own rules, times, scoring type, any prize with its type, value, provider and handover deadline, for on-site events the venue (name, address, town, coordinates that you set yourself; we do not use a geocoding service), plus a logo and intro video. Public Challenges are visible to all signed-in users; private ones only to those invited and those who have the access code. If there is a real prize, the ipixvent team reviews the Challenge before it is published.

Organiser registration. Anyone who wants to create a Challenge first registers in the app as an organiser: private or commercial, public name, contact email, for businesses a contact person, plus a phone number. The contact email and the public name appear in the participation terms of every Challenge you organise, because participants must be able to reach someone who answers for the prize; we tell you this before you submit. We do not publish the phone number; it is only for queries from us. We do not collect a postal address or company register number. We store the time of registration as proof of your agreement to the organiser obligations.

What organisers and managers see. About the participants in their Challenge: username, display name, status (active, withdrawn, disqualified, blocked), time of joining, entry, number of votes, average and warnings. The same fields are available as a CSV file; it contains no contact address and no account ID. For on-site events, also the door list (4.6) and, during a broadcast, the viewer count. They can warn, disqualify or block participants with a reason; you see the reason. For what they do with this information outside the app, they are independent controllers; the Terms of Use oblige them to use the information only for the Challenge.

Roles. Whoever organises a Challenge can give other accounts rights over it (management, moderation, door) and invite jury members. We store who has which role and when it was assigned. Invitations to private Challenges and to the jury are made via the username; the invited person sees who invited them.

4.6 On-site events and tickets

For an on-site event, you reserve a ticket in the app as a participant or as a spectator. We store the ticket with type, code, status, price, time of payment and time of admission, together with the person who checked you in. Payment is made on site to the organiser; ipixvent does not accept any money and only learns that the ticket has been marked as paid. The app draws the QR code on your device; it only leaves your device when it is scanned at the door.

Whoever organises or manages the Challenge, and people with the door role, see the door list: ticket code, amount, paid, checked in. The names of spectators are visible only to those who have a ticket themselves, to participants and to the door staff, not to the public. The audience can only vote after admission; that is why the vote is tied to the check-in.

Organisers are themselves responsible for recordings they make on site.

4.7 Time Challenges

Time Challenges run in rounds with deadlines. The round tasks are set by whoever organises the Challenge; your round videos are processed like other videos. The videos are deleted 7 days after the end (we can set the period between 1 and 365 days and state the current value here); the result, i.e. rankings and points, remains.

4.8 Livestreams and live packages

We do not currently offer livestreams. The feature is switched off: no live packages are sold and no data goes to Mux. This section describes what applies once we offer livestreams; we will then also update the date of this policy.

Organisers can broadcast on-site events. The broadcast runs via Mux, Inc. (USA). The app itself does not send any video: in the app you receive a server address and a stream key and enter both into a streaming program (such as OBS or Larix); this program sends the stream directly to Mux, which sees the IP address of the streaming source in the process. Viewers’ requests go to Mux’s network, which sees their IP addresses in the process. We store the broadcast IDs and, while a broadcast is running, which account is currently watching (a heartbeat that enforces the viewer limit of the booked package). This heartbeat is deleted every 10 minutes; there is no history of who watched when. Only whoever organises the Challenge sees the number. Within the booked broadcast time, you can pause and resume the broadcast; once the broadcast time has run out, it can only continue with a purchased extension. Mux records the broadcast; the recording stays at Mux under the same ID, and the app does not currently show it ⟨retention period at Mux⟩.

Live packages are bought by organisers from us via Stripe Checkout. We pass Stripe the package name, the Challenge title and the IDs of the purchase and of the Challenge; we do not pass on your email address. Stripe asks you directly for your email address and card details; we never see card details. Stripe Payments Europe, Ltd. (Ireland) is an independent controller for payment processing (stripe.com/at/privacy). We keep: the checkout session ID, package, price, status, the purchasing account and the time. If the Challenge is deleted, including when your account is deleted, the purchase record moves to an archive with no link to your profile. Purchase records are accounting records; we keep them for 7 years (§ 132 BAO (Austrian Federal Fiscal Code), § 212 UGB (Austrian Commercial Code)), also after account deletion. You receive a purchase confirmation and invoice by email ⟨once sending has been set up; currently none of our features sends an email after a purchase⟩.

4.9 Subscriptions and one-time pass (Apple, Google)

You buy the Creator Pass (€4.99 per month), the Orga plans Starter (€9.99), Pro (€19.99) and Max (€59.99 per month) and the one-time pass for a single Challenge in the App Store or on Google Play. The contracting party for payment, renewal, cancellation and refunds is Apple Distribution International Ltd. (Ireland) or Google Commerce Ltd. (Ireland); both are independent controllers for this and give us neither your name nor your payment details.

For each purchase, we receive a transaction ID or purchase token, the product ID, the environment (production or sandbox), the price and the term. We send this ID back to Apple or Google to verify the purchase; only then do we unlock it. For the one-time pass, we also store when it was redeemed; it is valid for 90 days. For subscriptions, we store the plan, term and source and, for each subscription, the store’s ID, the status (active, cancelled, payment pending, expired, refunded) and whether it renews automatically. The store holds the receipt for these purchases; the database currently deletes our records of the one-time pass and subscriptions together with the account ⟨until a separate archive has been built⟩.

So that a subscription continues correctly after the first month, the app passes your account ID to Apple or Google when you buy (at Apple as an “app account token”, at Google as an obfuscated account ID; it is a random number, not your name or email address). Apple and Google then notify us of every renewal, cancellation, failed payment and refund with this ID; we then query the current status directly from the store. In addition, we check once a day when a subscription is about to expire. This way a cancelled subscription ends on time, and a renewed one continues without interruption (Art. 6(1)(b) GDPR).

As of 10 October 2026, neither the purchase of subscriptions nor that of the one-time pass has been enabled in the store. As long as this is the case, the ipixvent team assigns plans and passes manually; this only creates the plan or pass record (plan or pass, term, source “admin”) and an entry in the admin log (4.13). Whether you are shown ads depends on your plan and is decided on our server (4.12).

4.10 ID verification (Didit)

What is checked and who checks it. You photograph an official ID document (identity card, passport or driving licence) and record a short selfie with a liveness check. This takes place in the app, in the module of our processor Didit Identity Spain, S.L., Calle Nápoles 227, 08013 Barcelona, Spain (didit.me/terms/privacy-policy); if the module does not work, the verification opens in the browser. Didit checks the security features of the document, reads the document type, issuing country, document number and date of birth, compares your face with the ID photo and checks that a living person is in front of the camera. This creates biometric data within the meaning of Art. 9 GDPR.

When verification is possible or necessary. Verification is voluntary. It gives you the verified badge on your profile. The order is: you buy the Creator Pass or an Orga plan; this lets you start the verification. With an Orga plan from the store (Starter, Pro, Max), the included Creator Pass applies immediately, but the organiser features only after you pass verification (Terms of Use 8.3). You never need it to use the app for free. The number of verifications per month is limited.

Voluntariness. So that consent remains voluntary, there is a way without biometric verification for every store plan: instead of the automatic verification, you can request a check by a human (support@ipixvent.com; we will agree with you how you identify yourself ⟨e.g. video call or ID with the number covered⟩). It takes longer, but costs nothing and unlocks the same plan. You need neither of them for free use.

What goes to Didit and what Didit keeps. We pass Didit the ID of the verification flow, your account ID, the return address and your language. You give the ID images, selfie and short video directly to Didit; we do not see them. Under our settings, Didit keeps the images for 30 days and then deletes them. During this time, our staff with the relevant permission can view them in the Didit console, for example if a verification needs a second look.

What stays with us. The result (passed, failed, under review), the reason for any rejection, document type, issuing country, the date of birth from the ID, notes from Didit in shortened form, the session ID at Didit and a peppered hash of country, document type and document number. Not with us: your name as shown on the ID, your address, images, scoring values, the document number in plain text. The hash serves only to detect whether the same ID has already been used for another account; if so, the verification is rejected. If you pass verification, the date of birth from your ID replaces the one you entered yourself.

Legal basis. Your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR): before you start, the app explains what is checked and what remains stored; the consent sentence sits directly above the “Agree and verify” button, and the verification only begins when you tap it. We store the version and time of your consent as proof. For store plans, verification is also a contractual requirement (Art. 6(1)(b)); we process the biometric data itself only with your explicit consent. We base the prevention of multiple accounts via the hash on our legitimate interest in fair competitions (point (f)). We assessed this processing under data protection law before launch (data protection impact assessment, ⟨date⟩).

Automated decision (Art. 22 GDPR). The verification runs automatically, and its result decides whether you receive the verified badge and whether you can use an Orga plan bought in the store. The logic in outline: authenticity of the document, match between face and ID photo, liveness, age at least 18, no other account with the same ID. Consequences: without passing verification, no verified badge and no store plan, except via the check by a human (see above, “Voluntariness”); if the ID shows an age under 18, you receive neither the verified badge nor a store plan; you may continue to use the app from age 14 (section 12). This decision is permitted because you have given explicit consent (Art. 22(2)(c) GDPR); for store plans, we additionally base it on its being necessary for the contract (Art. 22(2)(a)). Your rights in this respect: if the verification is negative or needs a second look, a person from the ipixvent team looks at it. You can also request this yourself, express your point of view and contest the decision: support@ipixvent.com. The app shows you the reason for a rejection.

Withdrawal. You can withdraw your consent at any time: in the app on the verification page (“Withdraw consent”) or by email to support@ipixvent.com. We then remove the verified badge, clear the verification record with us (document type, country, date of birth from the ID, notes from Didit), cancel any verification in progress and have Didit delete your sessions including the images. Only the hash of the ID number on a passed verification remains, until account deletion, so that the same ID cannot be used for a second account (legitimate interest, Art. 6(1)(f)). Your account’s date of birth stays because it carries the age limits; it no longer counts as verified. Organizer features of an Orga tier bought in the store pause until a new verification. Withdrawal does not affect the lawfulness of what happened before it.

What the ipixvent team sees. Result, document type, issuing country, environment and the session ID at Didit. If your Creator Pass ends, the verified badge is put on hold; with a new pass or an Orga plan, it returns without a new verification.

4.11 Season programme

The Season programme is a loyalty programme that we run; its terms in the app apply. From your activity in public Challenges (completed entries, stars received, rankings, votes cast, your own Challenges that have ended), the app calculates XP and, from them, your Level for each Season. We store XP, Level and the highest Level of the Season. XP are calculated, not booked: if an entry is removed, they go down.

If you redeem a perk, we store which perk you redeemed when and the code you received. The partner granting the perk receives no personal data: neither name nor account, only the number of redemptions and, where applicable, its own code. The partner map shows the partners’ business addresses, not any user data.

The XP calculation evaluates your behaviour in the app, but it does not make any decision with legal or similarly significant effect: perks are voluntary offers from the partners, XP are not credit, and nothing depends on them except access to these offers. That is why Art. 22 GDPR is not engaged here.

Spot King. At places we have approved (spots) there is one crown per category; it is not tied to any Season. A spot only comes into being after our review; a spot challenge merely proposes its place. The crown is held by whoever won a public spot challenge at that place or won a duel for the crown. The crown can only be challenged with a new video recorded at the spot (duel video); the king can counter once per duel with a new duel video. While a spot challenge is running at that place, there are no duels. For this we store who holds the crown with which entry or duel video, since when and until when it is protected; the duel videos themselves (the file is kept by our video service); earlier crowns (roll of honour: who, from when to when, and how); duels (king, challenger, their two videos, period, result, number of votes); and, for each duel, who voted for whom. Publicly visible are the crown with name and video on the spot page and on the map, the roll of honour, and running duels with both videos and their result. We show nobody how you voted; we only store it so that each person votes once per duel. Anyone who may see a duel can comment on it; we store and show these comments like comments on entries, the two people competing are notified, and we delete them seven days after the duel ends (if one of them is the subject of a report or measure, after six months). After the end, everyone else only sees the result: who won, with their video. A duel can be shared (see shared links above) and sent to people you follow who follow you back, and a duel video can be reported; if we remove it after a report, that person loses the duel, and if it holds a crown, the crown becomes free. On the map we show the profile picture only for adults; for under-18s only the initial appears. In the settings you can choose not to appear as Spot King on the map; the map then shows only the crown, and you remain visible on the spot page. People you have blocked, or who have blocked you, do not see you there. Whether your entry or duel video was recorded at the spot is checked by the app on your device (4.15); we only receive “at the spot: yes”. The legal basis is the contract (Art. 6(1)(b) GDPR): by submitting an entry to a public spot challenge or a duel video, you take part in Spot King. We delete a duel video, including its file, as soon as it loses a duel, is replaced by a counter or the crown changes hands through a spot challenge — it only remains while it is in a running duel or holds the crown. Entries from spot challenges are not affected. A crown lasts until it changes hands or its video or your account is deleted; a duel with its votes until one of the two accounts is deleted (deleted videos are then missing from it); roll-of-honour entries and your votes until you delete your account.

Partner applications. If a company wants to grant perks in the Season programme, you can represent it in the app: with a Business account via “Offer a perk” (the paragraph “Enquiries from businesses” below applies) or under Season → “Become a partner”, both from age 18. You can also write to us at support@ipixvent.com (4.17 then applies). Via “Become a partner”, we store the details from the form (company, company description, contact person, phone, website, VAT ID number, address, sector, the offer), an automatic note if the text sounds like an excluded sector, and an encrypted short value of your IP address (HMAC), which we use to slow down mass requests; we do not store the IP address itself. We link the application to your account: we take the email address from the account, you do not need to confirm it and only receive an acknowledgement of receipt there; the ipixvent team sees your username, how long the account has existed and whether your ID has been verified. The legal basis is steps prior to entering into a contract (Art. 6(1)(b) GDPR) and, for the abuse brake and the account details, our legitimate interest in secure operation and a swift review (point (f)). We send the acknowledgement and reply emails via Resend. At the press of a button, we check the VAT ID number in the European Commission’s VIES database; the result is not stored. If you delete the account, the application remains without this link. Staff with access to Season management see the details, including the contact email address. We delete rejected applications 180 days after the decision. From an accepted application we create a partner record (4.12; phone, VAT ID number and sector are kept there in an internal note) that remains until the end of the partnership; we delete the accepted application itself 12 months after acceptance, and applications still open 12 months after the last step — you can request earlier deletion at any time (section 9). Until 24 October 2026, companies could also apply without an account via a form at www.ipixvent.com/partner; for those we additionally stored the email address from the form and sent a confirmation link to it. We delete unconfirmed applications after two days.

Enquiries from businesses. If you want to advertise, sponsor a Challenge, offer a perk in the Season programme or become a spot sponsor on a spot page on behalf of a company, you do so via its Business account in the app (see the paragraph “Business account” below); you can also write to us at support@ipixvent.com (4.17 then applies). For an enquiry from the Business account, we store the type of enquiry, where and when, the budget (for a spot sponsor: spot, category and term) and your message, plus company, contact person, contact email address and website from the company record (4.12), and the links to the company record and to your account. If the company record has no contact person, we use your display name or username; if it has no contact email address, the business email address from your Business account application. There is no confirmation email; we only receive an internal notification. The legal basis is steps prior to entering into a contract (Art. 6(1)(b) GDPR). We send our reply (acceptance, follow-up question or rejection) via Resend to the contact email address; you can also see the status and our reply in the Business account in the app. Staff with access to advertising see the details, including the contact email address and your username. If you delete your account, the enquiry remains without the link to the account. We delete rejected enquiries 180 days after the decision. We delete accepted enquiries 12 months after acceptance (what the cooperation needs is kept in the company record, 4.12), and enquiries still open 12 months after the last step — you can request earlier deletion at any time (section 9). Until 24 October 2026, businesses could also enquire about advertising or sponsorship without an account via a form at www.ipixvent.com/unternehmen. For those we stored the details from the form (type of enquiry, company, contact person, email address, phone, website, where and when, budget, message), an automatic note if the company name, message or website sounded like an excluded sector, and an encrypted short value of the IP address (HMAC) to slow down mass requests, not the IP address itself (legitimate interest in secure operation, point (f)); the short value stays with the enquiry as long as it exists. We sent a confirmation link to the email address via Resend (storing an encrypted short value of the link, which we delete on confirmation). If we accepted a form enquiry, we created a company record (4.12) with the company, contact person, email address and website, or linked it to an existing one. We delete unconfirmed enquiries after two days.

Waiting list. If you sign up for the waiting list on www.ipixvent.com, we store your email address, the language of the page, the times of sign-up, email and confirmation, and an encrypted short value of your IP address (HMAC), which we use to slow down mass sign-ups; we do not store the IP address itself. We send you an email with a confirmation link; you are only on the list once you click it. After that, you receive exactly one email when ipixvent appears in the App Store and on Google Play, and we delete your address. The legal basis is your consent (Art. 6(1)(a) GDPR; § 174 TKG 2021). You can withdraw it at any time, via the unsubscribe link in the email or by email to support@ipixvent.com; we then delete the address immediately. We delete unconfirmed entries after two days. We send the emails via Resend. The ipixvent team only sees the number of entries, not any addresses.

Sponsor suggestions. If you organise a public Challenge, you can suggest a business as a sponsor in the app. For this, we store what you enter (company name, contact person, email address or phone, website, what the company would like to contribute, your note), as well as your account, the Challenge and whether you have a subscription (this determines how many suggestions you can have open at the same time and the order in which we look at them). You must be 18+ to make a suggestion; you confirm that the company agrees to us contacting it. The legal basis is steps prior to entering into a contract with the company (Art. 6(1)(b) GDPR) and our legitimate interest in arranging sponsorships for Challenges (point (f)). Staff with access to advertising see the suggestion, your username and whether your ID has been verified; you receive our decision as a notification. We delete rejected and withdrawn suggestions 180 days after the decision; an accepted suggestion becomes a company record (4.12); we delete the suggestion itself 12 months after acceptance, and suggestions still open 12 months after the last step.

Business account. You can apply in the app for your account to be run as a company’s account. For this, we store what you enter (company name, country, address, VAT ID number and company register or registration number if provided, website, business email address, phone, note) and your account. You must be 18+ to apply; you confirm that you are authorised to act on behalf of the company. We send a link to the business email address; we only look at the application once the link has been opened (for this we store an encrypted short value of the link and the times). We calculate whether the domain of this address matches the website given and show this only to our staff. We check an EU VAT ID number in the European Commission’s register (VIES): only the number goes to the Commission, and we store what the register says about it (valid or not, name and address according to the register, time). The legal basis is your application (Art. 6(1)(b) GDPR) and our legitimate interest in labelling only genuine companies as such (point (f)). Staff with access to advertising see the application, your username and whether your ID has been verified; you receive our decision as a notification. If we approve the Business account, we link your account to the company record (4.12): your profile then shows “Verified business” to everyone, even if it is private, because advertising must be recognisable as such, and in the app you can see what the company has booked with us, including impressions, clicks and redemptions. Enquiries from the Business account (advertising, sponsorship, perk) are described in the paragraph “Enquiries from businesses” above. The link ends when you delete your account or we remove it; the company record remains. We delete unconfirmed applications after two days, rejected and withdrawn ones 180 days after the decision, and applications still open 12 months after the last step. We keep the accepted application until you delete your account, because it shows who acts for the company.

4.12 Advertising

In the feed and in Challenges, the app shows ads from advertisers whom we look after ourselves. There is no ad network and no third-party advertising SDK in the app. Every ad carries the label “Ad” and the name of the advertiser; an explanation sheet in the app says who paid.

Ads are not tailored to you. Which ad you see depends only on which campaigns are running during the period, for which placement (feed, Challenge, both) and for which region they are booked, what priority they have, and then on chance. There are no target groups and no selection based on interests or on what you look at. The exceptions are youth protection — every campaign carries an age rating (14, 16 or 18), and you only see ads whose rating you meet — and the region, see the next paragraph. Your name, your picture and your entries never appear in ads.

Regional ads without your location leaving your device. A campaign can run worldwide, only in certain countries or only within a radius around a place. For countries, when loading ads the app sends along the country from your device’s region setting (for example “AT”), just like a language setting; this is not location tracking, and we do not store it. For a radius, our server sends the ad together with the centre point and radius to your device, and only your device calculates whether you are inside it. For this, the app uses the location your device already knows, and only if you have granted location permission anyway; it never asks for it for advertising and does not switch on location services. Your location is neither transmitted nor stored in the process.

We count, per campaign, account and day, how often an ad was shown and how often it was tapped. We use this to bill advertisers, distribute impressions and detect abuse. Advertisers only receive totals, never accounts. The legal basis is our legitimate interest in financing the app through advertising and billing it correctly; you can object to this (section 9). With a Creator Pass or an Orga plan that includes ad-free use, the app does not show you any ads; our server decides this based on your plan.

From advertisers and partners we store business data: name, contact person, contact email, description, website, logo, for partners the address and coordinates for the map; with a Business account (4.11), also country, VAT ID and company register number and the linked account. Without a Business account, they have no user account. If a company is a spot sponsor – it exclusively organises one category at a spot for a fixed term – we also store the spot, category, term and an internal note, and show its name and logo on the spot page (“presented by …”). Payment runs through an offer with an invoice (as for ads).

4.13 Following, blocking, reporting, moderation

Following and blocking. We store whom you follow, which follow requests are pending and whom you block. A block works in both directions: no contact, no visibility of entries and profiles. Leaderboards are not affected by this. The blocked person does not receive a notification about it.

Reporting. You can report entries, comments, profiles, chat messages and Challenges, with a reason from a list (violence, hate or insults, sexual content, spam or fraud, copyright infringement, impersonating another person, something else) and a note of up to 500 characters; for “Something else”, the note is required. We store your report with your account ID, the target, the reason and later the decision. One report per person and target. The reported person does not learn who reported them. Conversely: if you respond to a report about an infringement of rights with a counter-notice (Terms of Use 11.3), we forward it to the person who reported, with your name but without your email address, unless you allow it. The legal basis is our legitimate interest, and yours, in resolving the dispute (Art. 6(1)(f)). You receive a notification as soon as a decision has been made.

How we decide. Reports end up in a review list for the ipixvent team. People decide; there is currently no automatic content filter. Staff can add internal notes (up to 2,000 characters) to a case. Actions are: rejecting the report, removing content, restoring content, a warning, a temporary or indefinite suspension, resetting the display name or links, removing the verified badge, approving or rejecting a Challenge. Every action requires a reason and is logged. You receive a notification in the app with the reason, without the name of the person who acted, and you can check your sanctions in the app at any time. What organisers do in their own Challenge (warn, disqualify, block), we also store with the reason. You can appeal against our actions via support@ipixvent.com (Terms of Use 9.5); against an exclusion or a block in a Challenge, directly in the app (next paragraph).

Appeals against actions in a Challenge. If an organiser has removed you from the scoring or blocked you from the Challenge, you can lodge an appeal in the app once per action, up to 48 hours after the Challenge ends. We store your text (up to 500 characters), the action it relates to, the times, the decision, the reply (up to 300 characters) and who decided. The appeal can be read by the organiser and by the people to whom they have given moderation rights; they also see your username, display name and profile picture. If they do not decide within 72 hours, the appeal goes to the ipixvent team, which then decides in their place; this decision is recorded in the admin log. You receive a notification in the app about every step. The legal basis is the contract and our legitimate interest in fair competitions (Art. 6(1)(b) and (f)). Appeals are deleted with your account or with the Challenge; an entry in the admin log remains like any other (section 8).

Admin log. Every action taken by the ipixvent team is recorded in a log that no one can change or delete: ID and username of the person acting, action, ID and name of the target (for example your username as text), reason, time. This log is our proof to authorities and courts and protects you against arbitrary actions.

Legal bases. Contract (the Community Guidelines are part of the Terms of Use), legitimate interest in safety, preventing abuse and legal defence, and legal obligation (Art. 16 and 17 of the Digital Services Act require reporting channels and reasoned decisions). If we suspect criminal offences against the life or safety of persons, we notify the law enforcement authorities (Art. 18 DSA).

Retention. Blocks and follow relationships remain until you undo them. Sanctions, your appeals and the reports you have made yourself are deleted with your account. Other people’s reports about you remain with reason, note and the ID of the reported content, without a link to your deleted profile, 1 year after the decision. What remains: the admin log and internal case notes for 3 years from the action, because we must be able to prove our decisions (section 8).

4.14 Notifications

You receive notifications in the app, in your inbox: type of message and reference (entry, Challenge, perk, moderation action). We store your settings for this per account. Entries are cleared out after 7 days. If you allow notifications on your device, we also send you push notifications (see below). By email, we only write to you about what is necessary for operation and for the contract: confirming your address (which is also the confirmation of your account), resetting your password, a warning about a sign-in on a new device (4.1), purchase confirmation and invoice for live packages ⟨once sending has been set up, 4.8⟩, notice and reasons for an account suspension, announcements of changes to this policy or the Terms of Use, and replies to your enquiries. We do not send marketing emails without your consent (§ 174 TKG 2021); currently there are none.

Push notifications. The app asks the operating system whether it may send you notifications; without your yes, there are none. If you say yes, Firebase Cloud Messaging (Google) gives your device an identifier for delivery (push token) and also an installation ID for the app. We store the push token with your account, the platform (Android or iOS) and the times of registration and last use, for at most ten devices per account. If there is a new notification for you whose type is set to “Push” in your settings, we send the following to your device via Firebase: the text of the notification (for example “Lea and 11 others like your entry.”) and what the app needs to open it — type of message, username of the person acting, ID and title of the Challenge, ID of the entry. On iPhones, Firebase delivers the message via Apple’s push service (APNs). We use Firebase only for delivery: no analytics, no advertising ID, no crash reports.

You choose which types arrive as push in the app under Settings, Notifications; you can switch them off completely in your device’s notification settings. If you sign out, we delete the device’s token; likewise when Firebase reports that it is no longer valid (for example because the app was deleted), and together with your account. A delivery job stays with us only until it has been delivered, and is retried a few times in case of errors. The legal basis is the contract (notifications are part of the app you use); access to your device for the token is permitted by § 165(3) TKG 2021 because you have expressly requested the function. Google processes the data as our processor (section 6).

4.15 Location and map

If you ask for distances on the map, the app asks the operating system for your location. It stays on the device; the app uses it to calculate the distance to events and displays it. It is not stored in any database and not attached to any request. If you decline, you still see the map, just without distances.

Two things leave your device when you use the map. First, the app sends our server the map section you are currently looking at, rounded to a coarse grid, so that the server can deliver the events in it; our server learns “an account looked at this rectangle”, not where you are, and does not store the section. Second, the map loads its tiles from the server of the OpenStreetMap Foundation (United Kingdom, tile.openstreetmap.org); this server sees your IP address and the coordinates of the tiles loaded, i.e. roughly which area you are looking at. The OpenStreetMap Foundation is an independent controller for this; the legal basis on our side is the legitimate interest in being able to show you a map.

Spot challenges. Some Challenges only accept entries recorded at a particular place. The organiser sets the place (point and radius); it is shown publicly with the Challenge and on the map. Whether you are within the radius when recording is checked by the app on your device using your location. All we receive is whether the recording was made at the spot (yes or no), not the location itself; as with every entry, the app removes the recording location from the file. If you decline location access, you cannot submit to spot challenges; everything else works as usual.

4.16 Camera, microphone, photos

The app only asks for permissions when you use a feature that needs them, and explains the purpose when it does:

• Camera: record a Challenge video, take a profile picture, scan tickets as door staff, photograph your ID and record your selfie during ID verification.
• Microphone: sound for your video, a short recording during ID verification.
• Photos: choose a picture from your gallery as your profile picture; during ID verification, an ID image from the gallery if the camera does not work.
• Location: distances on the map (4.15).

The app only reads what you select or record. It does not access the camera, microphone, gallery or location in the background. If you refuse a permission, only the relevant feature is missing.

4.17 Support requests

If you write to support@ipixvent.com or via “Help and contact” in the app, we process your sender address, the content and any attachments in order to reply to you. The mailbox is operated by Zoho on our behalf (⟨Zoho contracting entity, data centre⟩). For requests about your account, we ask you to write from your account’s address so that we know it is you. We keep requests for 2 years after closure so that we can answer follow-up questions and document the history.

4.18 Website www.ipixvent.com

The website is a static site that Cloudflare delivers on our behalf. In doing so, Cloudflare logs the IP address, time, page accessed and browser identifier in order to deliver the site and fend off attacks; the legal basis is our legitimate interest in security and operation. We do not analyse these logs. The site loads fonts and styles from our own server and does not embed any third-party content.

Cookies and device storage. Before you make a choice, the website itself does not place anything on your device. Cloudflare may set a technically necessary cookie to fend off attacks (__cf_bm, lifetime under one hour); it does not require consent (§ 165(3) TKG 2021). Our own script (not a third-party consent tool) knows the categories “Necessary”, “Functional”, “Statistics” and “Marketing”. Currently, no category except “Necessary” has a service assigned to it; that is why no banner appears, and there is nothing you would need to agree to. If you nevertheless make a choice via “Cookie settings”, the site stores only this choice (version, time, categories) in device storage and in a cookie named ipx_consent for 12 months; this storage is strictly necessary and does not require consent (§ 165(3) TKG 2021). Should we ever add a service that requires consent, the site will ask you first, “Reject all” will be offered on an equal footing next to “Accept all”, and rejecting will not restrict anything. Details are in the Cookie Policy.

Return page after ID verification. After the verification in the browser, www.ipixvent.com/verifiziert shows you a page with the button “Back to the app”. The page does not read any data, stores nothing and loads nothing from third parties.

4.19 Admin interface admin.ipixvent.com

The admin interface is only for our staff; users have no access to it. It stores the session’s sign-in token in the browser’s device storage; this is strictly necessary for signing in and does not require consent. What staff see about you there depends on their role: profile, plans, verification status including document type, country and Didit session ID, sanctions, reports, warnings, organiser details, review list with internal notes. No view of the admin interface shows users’ email addresses (it does show the contact address of a company applying as a partner or enquiring via its Business account — 4.11); these are visible only to those with access to sign-in management at Supabase. Every action there is logged (4.13).

4.20 Technical logs and security

Operating the app creates technical logs at our processors: at Supabase for requests to the database, sign-in and functions (IP address, time, function called, status, account ID), at Bunny for uploads and retrievals (IP address), at Mux for livestreams (IP addresses of the streaming source and viewers), at Cloudflare for the website, at Resend for email delivery (address, status), at Stripe for payments. We use them to find errors, detect attacks and prove abuse; the legal basis is our legitimate interest in secure operation. The providers delete them according to their own periods (Supabase and Cloudflare at most 7 days, Bunny 3 days, Resend 30 days). In addition, we store short-lived operational data: failed attempts at access codes (15 minutes), upload tickets, submission attempts. The app contains no third-party analytics, tracking or crash reporting service.

Error reports and performance data. If the app crashes or an unexpected error occurs, it sends a report to our own database, not to a third party: the type and text of the error (without values, email addresses and longer sequences of digits), the location in the code, the screen as a pattern without identifiers (for example “/competitions/:id”), up to the last 20 steps before the error (screen changes, names of buttons pressed, addresses called without parameters), device model, operating system, app version, language and, if you are signed in, your account ID. What you type is never included. In addition, there are speed measurements: duration of the app start-up, waiting time for videos, proportion of stuttering frames per session and requests that take longer than three seconds. To protect the reports against flooding, we count them per sender and hour; the sender is recorded only as an encrypted check value that is deleted after three hours. The reports can only be read by members of the ipixvent team with the permission for operations. We use them exclusively to fix errors and make the app faster. The legal basis is our legitimate interest in a working app (Art. 6(1)(f)). You can switch off the reports in the app at any time: Profile → Menu → Settings → Privacy → “Send error reports”. We delete individual incidents after 30 days, measurements after 30 days, and aggregated cases no later than 180 days after the last occurrence; when an account is deleted, the account ID is removed from all reports.

Usage figures. When you open the app for the first time on a given day or return to it from the background, our server records that day’s date on your account, without the time and at most once a day. Nothing is stored on or read from your device for this, and no third party is involved. From this and from what is already in our database (registration, joining, entries, ratings, comments, likes), we calculate aggregated figures: how many people have used the app today, in the last 7 and in the last 30 days, and, for each week in which people registered, what proportion of them take part and come back after one day, in the second week and in the fifth week. The ipixvent team only sees these group figures, and for weeks with fewer than five new accounts not even those; no interface shows an individual person’s days, not even to you. For the period before 15 October 2026, we filled in the days from your existing activity (registered, submitted, rated, commented, liked, wrote in the chat, joined, signed in). The legal basis is our legitimate interest in improving the app (Art. 6(1)(f) GDPR); you can object (section 9). We delete the days after 13 months, and immediately when an account is deleted.

5. Data about you that does not come from you

Some data about you does not come from you yourself. Art. 14 GDPR requires us to tell you about it:

• You can be seen or heard in another person’s entry, story or livestream. The source is the person who uploads the content. We process image, voice and surroundings in order to display the entry, based on the legitimate interest of the uploaders and of the platform in publication; the uploaders assure us that the people shown have agreed. If you do not agree, report the entry in the app or write to us; we will review it and remove anything that infringes your right to your own image (§ 78 UrhG (Austrian Copyright Act)) or your privacy. We cannot inform you individually, because we do not know who can be seen in an entry or how to reach you (Art. 14(5)(b) GDPR). That is why we make this information publicly available, oblige the uploaders to ask you, and accept reports even without an account: support@ipixvent.com.
• Sign in with Apple or Google. What we receive in the process is set out in 4.1.
• Other people’s reports about you. Content of the report, reason, note; you do not learn who reported you. Who sees this and for how long is set out in 4.13.
• Invitations. If someone invites you to a private Challenge or to a jury, your username comes from the person inviting you. You accept or decline a jury invitation. You can only ignore an invitation to a Challenge; it remains stored until the Challenge or one of the two accounts is deleted.
• Mentions. If someone addresses you with @ in the chat, a reference to your profile is created; it is deleted together with the chat.
• Information about third parties in Challenges. Organisers state who provides a prize; businesses name contact persons for advertising or a partnership. These names appear in the participation terms or in our admin system. If you are named in this way and do not want to be, write to us.
• Admission. If a person with the door role checks you in, this is stored on your ticket and is visible to the people running the Challenge (4.6).

6. Recipients and processors

Your data is received only by those who need it for the purpose described. Processors act on our instructions and under a contract pursuant to Art. 28 GDPR. Independent controllers process data according to their own policies, which we link to. You can obtain copies of the contracts and safeguards on request from support@ipixvent.com.

There is no integration of Meta, there are no ad networks, no data brokers and no disclosure for purposes not stated here.

7. Transfers to countries outside the EEA

The rule is Frankfurt: database, files, sign-in and email delivery run in the EU. The exceptions are listed in the table in section 6, each with the safeguard we rely on:

• Adequacy decisions of the European Commission (Art. 45 GDPR): for the USA, the EU-US Data Privacy Framework (Decision (EU) 2023/1795), insofar as a company is certified under it (Cloudflare, Resend, Mux, Stripe, Inc., Google LLC for Firebase Cloud Messaging); for the United Kingdom, the decision that was extended on 19 December 2025 until 27 December 2031.
• Standard contractual clauses (Art. 46(2)(c) GDPR, Implementing Decision (EU) 2021/914) with an assessment of the destination country: for Supabase (Singapore, USA) and as a fallback wherever an adequacy decision should cease to apply. The Data Privacy Framework was upheld by the General Court of the European Union on 3 September 2025 (T-553/23); an appeal is possible; if the framework falls, the standard contractual clauses apply for us.
• Apple and Google transfer data according to their own rules; they are independent controllers for sign-in and purchases.

You can obtain copies of the standard contractual clauses and the links to the certifications from support@ipixvent.com.

8. Retention periods

We store data only for as long as the purpose requires or a law prescribes. Where there are fixed jobs, we name them; they come from how the app is built, and we keep them up to date.

What remains after account deletion and why

If you delete your account, the database deletes, in one go, your sign-in account and everything attached to it: profile, entries, comments, chat, votes, likes, your own reports, sanctions, records of one-time passes and subscriptions, tickets, invitations, roles, Season status, redemptions, Spot King crowns, duel videos, duels and votes, ID verification including the hash, ad counters, notifications, push tokens of your devices, known devices and sign-ins. Files and videos go into the deletion queue. There is no grace period and no restoring, not even via support.

What remains is what we must be able to prove, and only for as long as necessary:

• Receipts for live packages: 7 years under § 132 BAO and § 212 UGB, in an archive with no link to your profile (package, price, time, ID of the purchase, your former account ID). The database currently deletes records of one-time passes and subscriptions together with the account; the store holds the receipt for these purchases ⟨until a separate archive has been built⟩.
• Other people’s reports about you remain with reason, note and the ID of the reported content, without a link to your deleted profile, 1 year after the decision (4.13).
• Admin log and case notes on moderation actions: 3 years, so that we can substantiate decisions to authorities, courts and you yourself (legitimate interest in legal defence; Art. 17 DSA). Your account ID is removed where you are the person acting; your former username may remain as text as the name of a target.
• References in other people’s records, such as “checked in by” on someone else’s ticket or “deleted by” on someone else’s message, are set to empty.
• Redeemed codes remain marked as used for the perk, with no link to you.
• At providers: payment data at Stripe, images at Didit (at most 30 days), videos at Bunny until the queue job runs, livestream recordings at Mux ⟨retention period at Mux⟩, delivery logs at Resend and technical logs at Supabase according to their own periods.

What others have added to your content, such as a comment under your entry, disappears with the entry. Other people’s entries in a Challenge you organised are deleted together with your Challenge; before deletion, the app shows you how many are affected.

9. Your rights

You have the following rights against us. You exercise them by email to support@ipixvent.com, preferably from your account’s address; if there is reasonable doubt about your identity, we will check with you. We reply within one month; for complex requests we may extend this period by two months and will tell you so in advance. Exercising your rights is free of charge, except for manifestly unfounded or excessively frequent requests.

• Access (Art. 15 GDPR): what data we hold about you, why, where it comes from, to whom it goes, for how long. You receive a copy.
• Rectification (Art. 16): we correct incorrect data. You change your username, display name, bio, profile picture and links yourself in the app.
• Erasure (Art. 17): you delete entries, comments and stories yourself in the app; you delete your account under Settings (section 10). For individual data that you cannot delete yourself, write to us. The limits are statutory retention obligations and our interest in being able to provide proof (section 8).
• Restriction (Art. 18): while we are reviewing a request, or if you do not want erasure but dispute the processing, we freeze the data.
• Data portability (Art. 20): you receive data that you have given us and that we process on the basis of contract or consent in a common, machine-readable format (⟨JSON⟩). There is currently no button for this in the app; write to us and you will receive the file within one month. Your videos and photos are included in it as files.
• Withdrawal of consent (Art. 7(3)): at any time, with effect for the future. Currently this concerns ID verification (4.10) and, in future, any marketing emails or optional cookies; for location, camera, microphone and photos, you withdraw permission in your device’s settings.

Right to object (Art. 21 GDPR). If we process data on the basis of our legitimate interest, you can object at any time on grounds relating to your particular situation. This applies in particular to: the ad counters (4.12), security and abuse logs (4.1, 4.20), the admin log after account deletion (section 8) and the display of other people’s content in which you can be seen (section 5). We will then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. We do not engage in direct marketing; if we ever do, you can object to it without giving reasons.

Complaint. You can lodge a complaint with the supervisory authority at any time (§ 24 DSG (Austrian Data Protection Act)):

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
www.dsb.gv.at

You can also assert claims before the ordinary courts (§ 29 DSG). The fundamental right to data protection under § 1 DSG remains unaffected by everything stated here.

What you have to give us. Email address and date of birth are a contractual requirement; without them there is no account. ID verification is voluntary; without it there is no verified badge, and you can only get an Orga plan bought in the store through it or through the check by a human (4.10); everything else remains available. Location, camera, microphone and photos are voluntary; without them, only the relevant feature is missing.

10. Delete your account

You delete your account in the app under Settings, “Delete account”. Beforehand, the app shows you what is attached to it (Challenges, entries, participations, tickets) and that other people’s entries and tickets in your Challenges will also be deleted; they are not notified about this. You confirm by typing the word LÖSCHEN; the database checks it. After that, deletion is immediate and permanent (section 8).

If you do not have access to the app, you can request deletion via www.ipixvent.com/en/konto-loeschen or by email to support@ipixvent.com from your account’s address; we will carry it out within one month.

A subscription in the App Store or on Google Play does not end when you delete your account. Cancel it separately in the store’s subscription settings; otherwise it will keep running and you will keep being charged.

11. Ranking, profiling, automated decisions

How lists are ranked. The feed shows entries without a rating first, then in an order that is calculated in a fixed way for you (from a key on your device, otherwise from the day and your account), so that the list does not jump when more is loaded. The “Featured” strip shows Challenges whose organiser has an Orga plan with this feature (Pro: 1, Max: 3), in an order shuffled per account and day; places in it are not sold individually, and the app states at the strip that this is a feature of the plan and not an editorial selection. Leaderboards depend only on the votes. The map shows events in the section, by date. Ads depend on running time, placement, priority and chance (4.12).

No profile. We do not build an interest profile, do not learn from what you look at, and adapt neither the feed nor ads to it. What the app calculates automatically are XP and Level (4.11) and the “Reliable” badge (4.2); both are calculations from your activity with no legal or similarly significant effect.

Automated decisions. The only decision within the meaning of Art. 22 GDPR is ID verification (4.10); the logic, consequences and your rights are set out there. We check the age limit using the date of birth you enter yourself; this is a contractual requirement, not an automated assessment. Sanctions, suspensions and removals are decided by people.

12. Minors

ipixvent is for people aged 14+ (as of 20 September 2026; previously 18). This is the age from which you can consent yourself to the processing of your data in Austria (Art. 8 GDPR, § 4(4) DSG). When you create your account, you enter your date of birth; there is no account for anyone under 14. From your date of birth, the server calculates your age and applies the age ratings: you do not get to see Challenges, their chats or ads that are rated 16+ or 18+. If you are under 18, your profile is private at the start; you can change this in the settings. ID verification (section 4.9) is open only to adults, as are creating your own Challenges and registering as an organiser.

If an ID verification shows an age under 18, the app rejects the verification, shows you the reason and refers the case to the ipixvent team; a person then decides on a suspension pending clarification and on deleting the account. If we otherwise have reasonable grounds for suspicion, we suspend the account pending clarification and delete it if the suspicion is confirmed; you can contact support@ipixvent.com with proof. We do not knowingly collect data from children. If you see a person in the app who is obviously under 18, report the profile or write to us.

13. Data security

We protect your data with measures that correspond to the state of the art and to the risk (Art. 32 GDPR). Specifically:

• All connections between the app, the website, our servers and our providers are encrypted (TLS). Supabase, Bunny, Stripe and Didit enforce HTTPS; data at Supabase (AWS) and Bunny is stored encrypted.
• Every table in our database has access rules per row. Sensitive tables (ID verification, subscriptions, organiser details, tickets, advertisers, ad counters) cannot be read directly by the app at all; every change goes through verified server functions that release only what the respective role is allowed to see.
• Other people’s account IDs do not leave the database, except in the addresses of public files. The server generates the playback addresses for videos.
• Callbacks from Stripe, Didit and Mux are signed; we do not trust unsigned callbacks. Scheduled jobs require a secret. Secrets (keys, pepper) are stored only on the server, never in the app.
• With us, the ID number exists only as a peppered hash. We verify purchase receipts with Apple and Google on the server; prices come from the database, never from the device.
• Failed attempts at access codes are throttled. The admin log cannot be changed; an entry is only deleted once its 3-year period has expired. Account deletion requires a typed word that the database checks.
• Your location is never uploaded.
• Only staff with the relevant role have access to the admin system and provider consoles. Supabase keeps database backups for at most 7 days.

There is no such thing as absolute security. If there is a breach of the protection of your data that poses a high risk to you, we will inform you and the Austrian Data Protection Authority in accordance with Art. 33 and 34 GDPR.

14. What we do not do

• Push notifications only if you allow them on your device; the push token is used only for delivery.
• No third-party analytics, tracking or crash reporting SDK in the app; no advertising ID, no fingerprinting.
• No ad network, no disclosure to advertisers or data brokers, no sale of data.
• No ads based on a profile, no learning from your viewing behaviour.
• No transmission of your location.
• No website cookies before you make a choice, except Cloudflare’s protection cookie (4.18); and currently none that would require a choice.
• No marketing emails without consent.
• No storage of ID images, selfies or the ID number in plain text.
• No disclosure of personal data to Season programme partners.

If any of this is ever added, we will change this policy beforehand and tell you in the app before the feature becomes active for you.

15. Changes to this policy

We change this policy when the app, our providers or the law change. We will inform you in advance of new purposes for which we want to use data already collected (Art. 13(3) GDPR); where consent is required, we will obtain it in advance. In the case of significant changes, the app shows a notice before you continue, and we write to your account’s address. Each version carries a version number and date; you can find older versions at ⟨www.ipixvent.com/datenschutz/archiv⟩. This is version 1.38 of 30 October 2026.

16. Contact

Questions about this policy, requests concerning your rights, objections, withdrawals of consent and reports of content:

support@ipixvent.com
ipixvent, Esentepe Mah. 960. Sokak No: 2/6, Melikgazi/Kayseri, Türkiye
Phone: ⟨phone number⟩

In the app, you can reach us via Settings, “Help and contact”. A human will reply to you, in German or English.

Supervisory authority: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, +43 1 52 152-0.