Privacy Policy

Last updated: September 2, 2026

1. Who operates Drilonix

Drilonix is operated by Drilon Malvataj, who is the controller responsible for personal information processed through the service. References to “Drilonix,” “we,” “us,” or “our” in this policy refer to Drilon Malvataj operating Drilonix.

Privacy questions and requests may be sent to drilonixadmin@gmail.com .

2. Age requirement

Drilonix is intended for users who are at least 16 years old. If you are under 16, do not create an account or use the service.

3. Information we collect

We collect information that you provide, information created through your activity, and limited technical information needed to operate and protect Drilonix.

• Account information such as your email address, username, password credentials, profile name, biography, profile photo, and other profile details.
• Content you create, upload, or share, including posts, reels, photos, videos, music or other audio contained in uploaded media, captions, comments, opportunities, Journey entries, Portfolio content, workout information, and other user-generated content.
• Messages and media you send through Drilonix messaging features.
• Social activity such as likes, saves, follows, comments, post and reel views, blocked accounts, reports, and other interactions.
• Technical and security information such as authentication data, device or browser information, IP address, error information, session data, and service logs.
• Push-notification information, including an Apple device token, notification preferences, delivery information, and identifiers needed to route a notification to your device.
• Consent and confirmation records, including your user ID, the purpose of the consent or confirmation, the applicable policy version, the related content identifier where applicable, and the date and time you consented or confirmed.

We generally collect information directly from you, automatically from your device when you use Drilonix, from other users when they interact with you, and from service providers that operate features on our behalf.

4. Camera, photo library, and microphone

Drilonix may request access to your device camera, photo library, or microphone when you choose to create or upload media.

• Camera access allows you to take photos or record videos for posts, reels, messages, your profile, Journey, and Portfolio.
• Photo library access or the device photo picker allows you to select photos and videos you want to upload.
• Microphone access allows sound to be recorded when you create a video.

Drilonix does not access your camera, microphone, or selected media unless you choose to use a feature that requires that access. You can manage device permissions through your device settings.

5. How we use information

• To create and manage your account.
• To display your profile, posts, reels, opportunities, Journey, Portfolio, and other content.
• To provide features such as follows, likes, comments, saves, messaging, notifications, blocking, reporting, and private profiles.
• To process media uploads and provide editing, playback, and sharing features.
• To operate DX Fit, saved workouts, activity tracking, and AI workout-plan features.
• To personalize and organize feeds based on settings and choices made by users.
• To detect fraud, spam, abuse, security incidents, or violations of our rules.
• To review user reports, enforce platform policies, comply with legal obligations, and protect users and the service.
• To maintain, troubleshoot, improve, and measure the performance of Drilonix.

6. Legal bases for processing in the EEA, UK, and Switzerland

Where European data-protection law applies, we process personal information only when a legal basis permits us to do so:

• Contract: to create your account and provide the profiles, feeds, uploads, messaging, notifications, Journey, Portfolio, DX Fit, games, and other features you request.
• Legitimate interests: to secure and improve the service, prevent fraud and abuse, moderate content, respond to reports, understand performance, and protect Drilonix, users, and others. We consider the effect on users before relying on this basis.
• Consent: where you choose optional device permissions, enable push notifications, or where applicable law requires consent for particular information or processing. You may withdraw consent at any time, without affecting earlier lawful processing.
• Legal obligations and protection: to comply with law, valid legal process, and obligations involving safety, security, and legal claims.

7. AI Trainer and generated workout plans

If you use the Drilonix AI Trainer, information you provide for your workout request may be processed to generate a plan. This information may include your fitness goal, experience level, available days, workout location, session length, exercises to avoid, health-related notes, and other instructions you choose to submit.

Information submitted to the AI Trainer may be processed by a third-party artificial-intelligence service used to generate the requested plan. Do not submit highly sensitive information that is not necessary to create your workout plan.

Before an AI plan is requested, Drilonix asks for your consent and records your user ID, the consent purpose, the applicable policy version, and the date and time of consent. This record is used to document your choice and comply with legal obligations.

Health conditions, injuries, and similar details may be sensitive or specially protected information. Drilonix requires explicit consent before information entered in the AI Trainer is sent to the artificial-intelligence provider. You can decline by leaving the consent box unchecked and not requesting a plan.

AI-generated workout information is for general informational purposes and is not medical advice, diagnosis, or treatment.

8. Public and private content

Information posted on a public profile may be visible to other users. This may include your username, profile information, posts, reels, opportunities, comments, Journey content, Portfolio content, and other activity.

If you make your profile private, certain content is limited to approved followers. Some basic profile information and account activity may still be visible as necessary to operate the platform.

You should not post information that you do not want other people to see, save, copy, or share.

9. Messages

Messages and message attachments are stored so Drilonix can deliver and display conversations. Messages are not public, but they may be accessed or reviewed when reasonably necessary to investigate abuse, respond to reports, maintain security, comply with legal obligations, or protect users.

Blocking another user prevents new communication according to the platform's blocking rules, but existing messages may remain visible in conversation history.

10. How information may be shared

Drilonix does not sell your personal information. Drilonix currently does not use your information for cross-app advertising tracking.

Information may be shared in the following circumstances:

• With other users when you choose to publish content or interact publicly.
• With service providers that help host, store, secure, process, and operate Drilonix.
• With an artificial-intelligence provider when you use the AI Trainer.
• When required by law, legal process, court order, or a valid government request.
• When reasonably necessary to investigate fraud, abuse, safety risks, security incidents, or violations of platform rules.
• To protect the rights, property, safety, and security of Drilonix, its users, or others.

11. Service providers and data storage

Drilonix uses third-party infrastructure and service providers to operate the platform. These providers may process information on our behalf for purposes such as authentication, database storage, file storage, website hosting, app hosting, security, technical operations, and AI-generated workout plans.

Current service providers include Supabase for authentication, databases, file storage, and server functions; Netlify for website hosting and delivery; Apple for App Store distribution and push notifications; and OpenAI for AI Trainer requests. Providers receive only information reasonably needed to perform their services.

We require providers that process personal information on our behalf to protect it consistently with this policy and applicable law.

12. International data transfers

Information may be processed or stored in the United States or other countries where Drilonix or its service providers operate. Those countries may have different data-protection laws from your country.

Where European law requires a transfer safeguard, we rely on an applicable adequacy decision, the European Commission's Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where a recipient is eligible, or another legally recognized safeguard. Information about an applicable safeguard may be requested using the contact address below.

13. Data security

Drilonix uses reasonable administrative, technical, and organizational measures intended to protect account information and user content. However, no internet service, database, or storage system can be guaranteed to be completely secure.

You are responsible for keeping your login credentials secure and should notify Drilonix if you believe your account has been accessed without authorization.

14. Data retention

Information is retained for as long as reasonably necessary to provide Drilonix, maintain security, resolve disputes, enforce agreements, comply with legal obligations, and protect users.

Content you delete may remain temporarily in backups, logs, cached copies, moderation records, or systems used for fraud and abuse prevention.

Reports, moderation information, security records, and certain transaction or legal records may be retained when reasonably necessary for safety, legal compliance, and enforcement.

Retention is determined by the type of information, why it was collected, account status, security and moderation needs, applicable limitation periods, and legal requirements. Backup copies are removed through the normal backup-overwrite cycle when they are no longer required.

15. Account deletion

You may request account deletion through the account settings available in Drilonix.

When account deletion is requested, the account enters a 30-day deletion period. During that period, you may be able to restore your account by signing back in and following the restoration process.

After the 30-day period, Drilonix may permanently delete or anonymize account information and user content, except information that must be retained for legal, security, fraud-prevention, moderation, or safety purposes.

16. Your choices and privacy rights

Depending on your location and applicable law, you may request access to, correction of, deletion of, or restriction of certain personal information. You may also have the right to receive portable data, object to processing based on legitimate interests, and withdraw consent where processing relies on consent.

You may also:

• Update your account and profile information.
• Delete certain posts, reels, comments, or other content.
• Change your profile privacy setting.
• Block or unblock other users.
• Manage camera, microphone, and photo permissions.
• Stop using Drilonix or request account deletion.

To submit a privacy request, contact Drilonix using the email address provided below. We may need to verify your identity before completing certain requests.

European users may lodge a complaint with the data-protection authority in the country where they live, work, or believe a violation occurred. Exercising a privacy right will not result in discriminatory treatment.

17. Cookies, sessions, and technical tools

Drilonix may use authentication tokens, local storage, cookies, device storage, session information, error logs, and similar technical tools to keep users signed in, remember settings, provide features, maintain security, and improve performance.

Drilonix does not currently use third-party advertising cookies or cross-app tracking. If non-essential analytics or advertising tools are introduced, we will update this policy and request consent where required.

18. Notifications

Drilonix provides in-app and push notifications related to messages, comments, likes, follows, account activity, moderation, or other platform features.

Push notifications require device permission and use an Apple device token to route notifications. You may disable push notifications at any time through your device settings.

19. Automated decisions and feed organization

Drilonix may organize content using choices and interactions such as follows and selected feed filters. Drilonix does not currently make decisions based solely on automated processing that produce legal or similarly significant effects for users.

20. Third-party links

Drilonix content may include links to third-party websites, opportunities, services, or other external destinations. Drilonix is not responsible for the privacy practices, security, or content of third-party services.

21. Changes to this policy

This Privacy Policy may be updated from time to time as Drilonix changes, adds features, or responds to legal and operational requirements.

The updated date shown at the top of this policy indicates when the latest version became effective. We will provide reasonable notice before a material change where required by law.

22. Contact

Drilonix is operated by Drilon Malvataj. For privacy questions, account requests, objections, or concerns, contact drilonixadmin@gmail.com .