1. Who we are
Last updated: 16 October 2026
This privacy policy explains what personal data Elixor ("Elixor", "we", "us") collects when you use the Elixor app and our website at elixorapp.com, why we use it, who we share it with, how long we keep it and what rights you have. "Personal data" means any information about an identifiable person.
Elixor is run by Isa Ijaz, an individual based in the UK, who is the controller of your personal data. Contact us about privacy at theisaijaz@gmail.com. Apple and Google run the app stores and are separate controllers of the data they collect when you download apps from them.
2. The short version
This summary is for everyone, including 13 to 17-year-olds. The full details follow.
- What Elixor is. An app for people who are building something. You can show your projects, post progress, ask for feedback, follow people and projects, and message people.
- What we collect. Your email and password (we cannot read your password), your username and what you tell us about yourself and your projects, what you post, your messages, and a record of how you use the app. We ask your date of birth once to check you are 13 or over, then keep only whether you are under 18.
- Why. To run the app, show you projects that fit your interests, send notifications you have switched on, keep people safe and improve Elixor.
- Who can see it. Your profile, public projects, updates and comments can be seen by anyone signed in to Elixor. Your email address and age are never shown. Private feedback is seen only by you and the project owner. Messages are seen only by the people in the chat. Our moderators can see content when they need to, for example to check a report. We do not sell your data.
- Your choices. You can edit your profile, keep a project as a draft, turn off notifications, set quiet hours, block and report people, and delete your account and your data.
- Something wrong? Use the report button in the app, email theisaijaz@gmail.com, or talk to an adult you trust. If something online has upset you, Childline is free and confidential on 0800 1111. You can also complain to the Information Commissioner's Office at ico.org.uk.
3. Who can use Elixor
3.1 Minimum age. You must be 13 or older to use Elixor. In the UK, 13 is the age from which you can agree to use most online services yourself (section 9 of the Data Protection Act 2018). If we learn that an account belongs to someone under 13, we will close it and delete its data, unless the law requires us to keep some of it.
3.2 How we check age. When you sign up, we ask for your date of birth. If you are under 13, you cannot create an account. We use the date once to work out whether you are 13 to 17 or 18 and over, store only that age band, and do not store the date itself.
3.3 Users aged 13 to 17. We treat anyone who is or may be under 18 as a child for the purposes of the ICO's Children's Code. From 13, you can use your privacy rights yourself without a parent's permission. We will not tell a parent about your account unless the law requires it or we believe it is needed to protect you or someone else from serious harm.
3.4 Parents and carers. If you are worried about a child's account, email us. Depending on the child's age, we may need to speak to the child or confirm who you are before we share information or make changes. We will act in the child's best interests.
3.5 Who can message you. You can only start a one-to-one chat with someone if you follow each other. You can only be added to a group chat by someone you follow who follows you back. Groups have up to 32 people. Blocked people cannot message you or add you to a group.
3.6 If you think a child under 13 is using Elixor, report the account in the app or email us.
4. The personal data we collect
We collect data you give us, data created as you use the app, and data other people give about you.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email address; password, stored only in scrambled (hashed) form by Google's sign-in service, so we cannot read it; user ID; your age band (13 to 17, or 18 and over); when the account was created; the days you opened the app | You; our sign-in provider |
| Profile | Username; bio; role (for example Founder); what you are building and its stage; skills; interests; what you are looking for; what you can help with; goals; profile photo, if you add one; your privacy and notification settings | You |
| Projects and updates | Project name, tagline, description, category, stage, hashtags, the help you are looking for, feedback questions, milestones, cover image; progress updates with any photos (up to 10 MB) or videos (up to 50 MB) you attach; whether a project is public or a draft | You |
| Interactions | People and projects you follow; likes; saves; comments and @mentions; offers of help; requests to join a team and team invitations | You |
| Private feedback | Feedback you send to a project owner, and the category you choose | You |
| Messages | One-to-one and group messages; projects you share in chat; group names and members; when messages were delivered and read | You |
| Usage | A record of actions in the app (for example opening the app, creating a project or deleting your account) with the time, your user ID and whether you use iOS or Android | Automatically |
| Notifications | Your push notification token; your notification settings, including quiet hours and time zone; the notifications in your in-app inbox | Automatically; you |
| Safety | Reports you make or that are made about you, with a short preview of the reported content; blocks; suspensions | You; other users; our moderators |
| Support | Emails you send us | You |
| Beta testing | If you test Elixor through Apple's TestFlight app: crash reports, device model and operating system version, and any feedback or screenshots you choose to send through TestFlight | Apple (TestFlight); you |
Kept on your phone only. Your last 8 searches and any unsaved drafts stay on your device. They are not sent to us, and you can clear your searches in the app.
Network data. Like any online service, our hosting provider, Google, receives your IP address when the app connects to it, and handles it for us as our service provider. We do not store IP addresses in our own database.
4.2 Sensitive information. We do not ask about your race or ethnic origin, politics, religion, health, sex life or sexual orientation, trade union membership, genetic or biometric data, or criminal record. If you choose to include such things in your profile, a post or a message, we treat it as your content and do not use it to recommend things to you. You can ask us to remove it at any time.
4.3 What we do not collect. We do not collect your location, contacts or microphone. The app does not use your camera: you choose photos and videos from your device yourself. We do not keep your date of birth. We do not take payments, because Elixor is free. We do not use advertising identifiers or show adverts.
4.4 Other people's data. Do not post private information about someone else without their permission.
4.5 If you do not give us data. We need your email address, a username and your date of birth (to check your age) to run your account. Everything else in your profile is optional.
5. How we use personal data, and why we are allowed to
The law requires a lawful basis for each use. Where we rely on legitimate interests, see 5.2.
| Purpose | Data used | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Create and run your account; check your age; sign you in; reset your password | Account, profile | Contract. Where you are under 18, legitimate interests |
| Provide Elixor: profiles, projects, updates, comments, follows, feedback, help offers, messaging, search | Profile, projects, interactions, messages, feedback | Contract. Where you are under 18, legitimate interests |
| Order the For You feed (Section 7) | Your interests and skills; projects' categories and needs | Legitimate interests |
| Send notifications you have switched on | Push token, notification settings, interactions | Contract; you can switch them off at any time |
| Keep Elixor safe: check age, handle reports and blocks, control who can message whom, suspend accounts, filter offensive words in profiles | Content, reports, account data | Legitimate interests (protecting users, especially children); legal obligation where online safety law applies |
| Understand how Elixor is used, for example how many people come back after a week | Usage records | Legitimate interests |
| Answer support requests and complaints | Support emails, account | Contract; legitimate interests |
| Handle your rights requests, comply with the law, and deal with legal claims | Whatever is needed | Legal obligation; legitimate interests |
| A sale or merger of Elixor | As little as possible, anonymised where we can | Legitimate interests |
| Fix bugs and improve the beta, using reports from TestFlight | Crash reports, device details, beta feedback | Legitimate interests |
5.2 Legitimate interests. Our interests are running a safe and useful service, protecting users and improving Elixor. We weigh these against your rights, giving extra weight to children. You can object at any time by emailing us (Section 13).
5.3 Marketing. We do not send marketing emails or messages, and we will never send marketing to under-18s.
5.4 Other uses. We use your data only for these purposes or ones compatible with them. We do not sell personal data. We do not use it to train artificial intelligence models, and Elixor does not use AI tools to process your data.
6. Protecting children's privacy
Elixor is likely to be used by under-18s, so the ICO's Children's Code applies to us. The table says what we do under each of its 15 standards.
| Children's Code standard | What this means on Elixor |
|---|---|
| 1. Best interests of the child | We consider children's needs and wellbeing when we design or change features. |
| 2. Data protection impact assessment | We consider the risks to children when we design or change features, and keep them under review as Elixor grows. |
| 3. Age-appropriate application | We check age at sign-up and refuse under-13s. The protections in this section apply to everyone. |
| 4. Transparency | This policy has a plain-English summary in Section 2, and the sign-up screen tells you how we use your data before you create an account. |
| 5. Detrimental use of data | Momentum shows how many days in a row you have built something: posting progress, giving feedback or offering help. Opening the app does not count, a single quiet day does not end it, and we never send notifications about it. |
| 6. Community standards | Our community guidelines are in the app under Settings. We enforce them as Section 15 describes. |
| 7. Default settings | One-to-one messages and group chats are limited to people who follow each other. Notifications only start after you allow them on your phone. Projects can be kept as private drafts. Profiles are visible to everyone signed in, because finding each other is what Elixor is for, but they never show your age, email address or location. |
| 8. Data minimisation | Only an email address, username and date of birth are required, and we keep only an age band from the date of birth. Everything else is optional. |
| 9. Data sharing | We share data only with the service providers in Section 9, or for safety and legal reasons. We do not sell it and do not show adverts. |
| 10. Geolocation | We do not collect your location. |
| 11. Parental controls | Elixor has no parental monitoring tools. If we add any, the child will be clearly told when they are being monitored. |
| 12. Profiling | The For You feed uses only the interests and skills you choose (Section 7). We do not profile you for advertising or guess sensitive things about you. |
| 13. Nudge techniques | Notifications are about real events, such as feedback, comments, follows and messages, and you can set quiet hours. The more private choice is as easy to make as the less private one. |
| 14. Connected toys and devices | Does not apply to Elixor. |
| 15. Online tools | In the app you can edit your profile, change privacy and notification settings, block and report people, and delete your account. For anything else, email us. |
6.2 Messaging. Messaging carries the most risk for children. Only people who follow each other can message each other or put each other in a group, and blocked people cannot do either. Do not share your address, school or phone number in messages. Any message or person can be reported or blocked.
6.3 Your age is never shown. We do not display anyone's age or age band to other users.
6.4 Children's rights. Children have the same rights as adults. The right to have data deleted is especially strong for information collected when you were a child.
6.5 Protecting a child from harm. If we believe a child is at risk of serious harm, we may share limited information with the police, social services or other authorities, as the law allows.
7. How the For You feed works
7.1 What it uses. The For You tab first shows projects in categories you said you are interested in, or that need a skill you said you have, in random order. All other projects follow, also in random order. It uses only what you put in your profile, not what you open, like or watch. Some cards show the reason, for example "In FinTech, which you're interested in". The Following and New tabs are never personalised.
7.2 Recommendation notifications. If you allow them, we may notify you when a new project matches your interests or skills. You can turn these off in notification settings.
7.3 Your controls. You can change your interests and skills at any time, choose whether you are suggested to other people ("Suggest me to other builders"), and block people to hide their projects.
7.4 Automated decisions. When you sign up, your date of birth decides automatically whether you can create an account. When you save your profile, an automatic filter blocks certain offensive words. Nothing else about your account is decided automatically: reports are reviewed, and accounts suspended, by a person. If a decision significantly affects you, you can ask us to explain it, give your side and ask for a person to review it.
8. What other people can see
Only people signed in to Elixor can see anything in the app. Nothing in the app is shown to search engines.
| Content | Who can see it in the app |
|---|---|
| Username, profile photo, bio, role, what you are building, skills, interests, needs, goals | Everyone signed in |
| Email address, age band | No one |
| Public projects, their updates, photos and videos | Everyone signed in |
| Draft projects | You, your project team, and people you have invited to the team |
| Comments | Everyone who can see the project. Comments are public. |
| Likes and followers | Everyone signed in |
| Saves | Only you |
| Private feedback | You and the project owner |
| Messages | The people in the chat. Messages are not end-to-end encrypted. |
| Reports | Only our moderators. The person reported is not told who reported them. |
Our moderators can see content, including messages, feedback and drafts, when they need to, for example to check a report or protect someone from harm.
8.2 Public means public. People can screenshot or copy anything you post and share it outside Elixor, and we cannot control that. Think before posting your school, location, contact details or anything you would not want a stranger to know.
8.3 Deleting messages. You can delete a message for everyone within 5 minutes of sending it. If you delete your account, all the messages you sent are deleted from every chat.
8.4 Mentions. If someone @mentions you, you may get a notification.
9. Who we share personal data with
9.1 Other users, as described in Section 8.
9.2 Service providers. These companies run parts of Elixor for us. They may only use the data on our instructions, under contracts that meet UK GDPR Article 28.
| Provider | What they do | Data involved | Where |
|---|---|---|---|
| Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Firebase Hosting) | Sign-in, password-reset emails, database, file storage, the server code that sends notifications and deletes data, and hosting our website | All the data in Section 4 | United States |
| Expo | Sends push notifications to your phone | Push token, and the notification's title and text. Message notifications say only who wrote to you, never what they wrote | United States |
| Apple and Google push services | Deliver notifications to iPhones and Android phones | Push token, notification content | Worldwide |
| Google (Gmail) | Receives the emails you send us | Your email address and what you write | Worldwide |
| Professional advisers (lawyers, accountants, insurers) | Advice and compliance | Only what they need | UK |
9.3 Separate controllers. Apple and Google decide for themselves how they use the data they collect through their app stores and Apple's TestFlight beta app. Their privacy policies apply. If you test Elixor through TestFlight, Apple shares with us the crash reports and device details it collects and any feedback you choose to send, which we use only to fix problems and improve Elixor.
9.4 Legal and safety reasons. We may share personal data with the police, courts, regulators (such as the ICO and Ofcom) or other authorities where the law requires or allows it, to prevent or detect crime, or to protect someone, especially a child, from serious harm. We share only what is needed.
9.5 If Elixor changes hands. If Elixor is sold or merged, personal data may move to the new owner, who must protect it at least as well. We will tell you about any significant change.
9.6 When you share. If you share a project outside Elixor, for example as a PDF or link, we pass what you choose to the app you pick.
9.7 What we do not do. We do not sell personal data or share it for advertising.
10. Sending data outside the UK
Some of our providers process data in the United States: Google stores our database and files and runs our server code there, and Expo sends notifications from there. Sending personal data outside the UK needs a legal safeguard. We rely on the UK-US data bridge, under which both Google and Expo are certified. You can ask us for a copy of these safeguards.
11. How long we keep your data
We keep data only as long as we need it. You can delete your account in the app under Settings, then Delete account.
| Data | How long we keep it |
|---|---|
| Profile, projects, updates, comments, follows, likes, saves, blocks you made, notifications and push tokens | Until you delete them or your account |
| Photos and videos you uploaded | Until you delete them or your account |
| Messages you sent | Until you delete them (within 5 minutes of sending) or your account. Deleting your account removes them from every chat |
| Private feedback you sent or received, offers of help, team invitations | Until you delete your account |
| Usage records | 24 months, or until you delete your account if that is sooner |
| Reports and moderation records | Until the case is closed, then 12 months. Reports about you are kept for that time even if you delete your account, so we can deal with repeated harm |
| Searches and drafts on your phone | Until you clear them or uninstall the app |
| Support emails | 24 months after the matter is closed |
| Accounts nobody uses | Until the person deletes them. We do not delete inactive accounts automatically |
Deletion happens straight away for most data and within a day for the rest. We may keep data longer if the law requires it or we need it for a legal claim.
12. Keeping your data secure
- Data is encrypted when it travels between your phone and our servers, and when it is stored, by Google.
- Passwords are handled by Google's sign-in service and are never stored in readable form.
- Database rules control who can read and change each kind of data. For example, email addresses are never stored where other users could read them, and drafts are readable only by their team.
- Only named moderators can review reports and suspend accounts.
No system is completely secure. Messages on Elixor are not end-to-end encrypted. You can help by using a strong, unique password and logging out on shared devices.
If a data breach is likely to put people at risk, we will tell the ICO within 72 hours of finding out. If it is likely to cause a high risk to you, we will tell you without undue delay. To report a security problem, email theisaijaz@gmail.com.
13. Your rights
Under the UK GDPR you have these rights, free of charge.
| Right | What it means |
|---|---|
| Access | Get a copy of your data and information about how we use it. |
| Correction | Have wrong data corrected. You can edit most of it in the app. |
| Deletion | Have your data deleted. You can delete your account in Settings. This right is especially strong for data collected when you were a child. |
| Restriction | Ask us to pause using your data while we look into a complaint. |
| Portability | Get the data you gave us in a common, machine-readable format. |
| Objection | Object to uses based on legitimate interests, including usage records. We will stop unless we have compelling grounds or need it for a legal claim. |
| Withdraw consent | Turn off notifications in the app or in your phone's settings. |
13.2 How to use your rights. Email theisaijaz@gmail.com. We may ask for enough information to confirm who you are, and no more. We reply within one month. For complex requests this can be extended by up to two more months, and we will tell you if so.
13.3 Children and parents. If you are 13 or over, you can use these rights yourself. A parent or carer may contact us about a child's data, and we will act in the child's best interests.
13.4 Complaints. Please contact us first so we can put things right. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You can always complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. If you are under 18, a parent, carer or Childline (0800 1111) can help you.
14. Our website
Our website, elixorapp.com, does not use cookies, does not track visitors and has no forms. Everything on it, including its fonts, is served from the website itself. It is hosted by Google (Firebase Hosting), which receives your IP address to deliver the page. If you follow a link from our website to an app store, its privacy policy applies.
15. Safety, reporting and moderation
15.1 Reporting. You can report a project, update, comment or person from inside the app. You choose a reason (inappropriate or offensive, harassment or hate, spam or scam, misleading or stolen work, or something else) and can add details. The person you report is not told who reported them.
15.2 What we do. Our moderators review reports. They may remove content, warn someone or suspend an account. A suspended account cannot use Elixor.
15.3 Blocking. You can block anyone. Blocked people cannot message you or add you to a group, and their projects are hidden from you. You can manage blocked accounts in Settings.
15.4 Disagreeing with a decision. If we act on your account or content and you think we got it wrong, email theisaijaz@gmail.com and a person will look at it again.
16. Changes to this policy
We will update this policy when what we do changes. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell you in the app before it takes effect.
17. Contact us
Email theisaijaz@gmail.com about privacy, security or anything in this policy. The UK data protection regulator is the Information Commissioner's Office, at ico.org.uk.
18. What this policy does not do
This policy explains how we handle personal data. It does not limit any right you have under data protection law, and nothing in it reduces our responsibilities where the law does not allow that.
- Other people's copies. We cannot control what other users do with content you show them, such as screenshots. Section 8.2 explains how to protect yourself.
- Other companies' services. App stores, websites you open from links, and apps you share to have their own privacy policies, and those govern how they use your data.