Privacy policy

Who is responsible

The data controller is Luis Moreno González, an individual based in Spain. Contact: support@testomaximus.com. You can also lodge a complaint with the Spanish data protection authority (AEPD) or your local authority.

What we collect, and why

Email address: to sign you in and send the magic link (legal basis: contract).

Handle, time zone, reminder time, marketing consent, referral code, league tier, Premium status: to run the service (contract).

Your test answers and scores, daily check-ins, challenge and protocol progress, XP, badges, scans you make (barcode, product, verdict, pasted ingredient text): to show you your score and progress (contract). These are habit and lifestyle data. We deliberately do not ask for symptoms, lab values or other health data.

Friends, friend requests, battles (the result you enter, the XP at stake), brotherhoods and referrals: who invited or challenged whom, to run the social features (contract).

Country (your flag on the boards) and, only if you add them, a board photo and your X username, picture and verified status when you connect X (read-only; we never post). You can remove them any time (consent).

Push subscription (a browser endpoint and keys), only if you turn notifications on: friend requests, battle challenges, your league result, an evening reminder and the daily reminder (consent, withdrawable any time).

First-party usage events (for example test started, test completed, share clicked, signup, day completed, checkout started) with a random anonymous id or your user id: to understand the funnel and improve the product (legitimate interest). No third-party tracking cookies and no advertising pixels.

Payment and subscription status from Stripe when you subscribe (contract). Stripe is an independent controller for the payment itself.

Cookies

Testo Maximus uses only strictly necessary first-party cookies: the sign-in session, a random anonymous id for funnel counts, and a referral code when you arrive through a friend's link. Browser storage keeps your test draft and last result on your device. See the cookie policy.

Who sees your data

Hosting and database: Supabase (EU region, Frankfurt) and Netlify. Payments: Stripe. Product lookups: barcodes you scan are sent to Open Food Facts and Open Beauty Facts, without your identity. Email delivery: our email provider for sign-in links. No data is sold. Public boards show handles and scores only, and the global board only if you opt in.

How long

For as long as you have an account. Delete your account from your profile and everything tied to it is removed from our database; backups expire within 30 days. Anonymised usage events may be kept. Stripe keeps invoices for as long as tax law requires.

Your rights

Access, rectification, erasure, restriction, portability and objection. Export your data from your profile as a JSON file, change your handle or reminder settings yourself, delete your account yourself, or email us. We answer within one month.

Children

Testo Maximus is aimed at adults. We do not knowingly collect data from children under 14; if you think a child has an account, email us and we will delete it.