What we get from X
When you sign in, we receive your X account ID, display name, handle and profile image. We do not request your email address or permission to post, follow people or read direct messages. The sign-in access token is discarded after your profile is retrieved.
X asks you to approve the users.read and tweet.read permissions for this sign-in. FlexedOnThem uses the connection only to retrieve your own profile details. See X’s privacy policy.
What other people can see
Your profile appears on the leaderboard only after you agree to public participation and complete a payment. Your name, handle, image, X link, flex total and rank are then public. You can hide your profile at any time from your account.
Profile images may load from X’s image servers. X can receive the usual connection information, including a viewer’s IP address, when an image loads.
Payment information
Square handles your card details and payment verification under its privacy notice. We do not store your card number or security code. We keep purchase IDs, payment status, amounts, tax country and state, refunds and disputes so we can maintain your total and help with payment problems.
A temporary payment token may be stored encrypted while we check an unfinished payment. It is removed when the attempt finishes or by scheduled cleanup after 24 hours.
Cookies and site records
We use a session cookie to keep you signed in and protect account actions. We do not use advertising trackers. We keep limited technical records to investigate errors and prevent abuse.
Hosting statistics
Our hosting provider, IONOS, provides SiteAnalytics traffic reports to help us understand usage and improve the site. These reports include pages requested, referring sites, access times, and browser and device details. IONOS states that it anonymizes IP addresses and does not use cookies for SiteAnalytics. See how IONOS processes this data.
Viewing now
The live count estimates browsers active across the site in the last 75 seconds, not verified people. It uses a random browser identifier in a first-party cookie that expires 30 minutes after its last refresh. Tabs share that identifier when cookies are available, and hidden pages stop sending updates.
For the count, we store only a hashed identifier and its latest activity time, separate from X accounts and payment records. We do not collect IP addresses or create device fingerprints for this feature. Inactive entries stop counting after 75 seconds and are cleared as the count refreshes. Hosting providers may still keep ordinary server access logs.
Removing your information
Hiding your profile removes it from our public rankings. Account deletion is a separate request, available from your account. We may need to retain private payment, consent and dispute records for accounting, payment disputes or legal obligations.
For access, corrections or deletion questions, email flexedonthem@gmail.com. Never send card details, passwords or access tokens.