Privacy Policy
Last updated: June 13, 2026
1. Who We Are
MilEx ("we", "us") operates the MilEx mileage exchange platform at milex.xyz. This Privacy Policy explains what personal data we collect, how we use it, and the rights you have over it.
2. Data We Collect
- Account data: name, email, password hash, profile photo.
- Activity data: distance, duration, route summaries, sport type — either logged manually or synced from connected services.
- Connected services: when you connect Strava we receive your athlete profile and activity history per the scopes you authorize.
- Device & usage: IP address, browser, device type, and anonymized analytics events.
- Redemption data: shipping address and contact information for fulfilling rewards.
3. How We Use Data
- Calculate and credit MilEx points for your activities.
- Operate the rewards catalog and process redemptions with partners.
- Authenticate you and secure your account.
- Send transactional emails (point updates, redemption confirmations).
- Improve the Service through aggregated, de-identified analytics.
4. Legal Bases
We process your data under the legal bases of (a) performance of a contract (delivering the Service), (b) your consent (for connected services and marketing email), and (c) legitimate interests (security, fraud prevention, product improvement).
5. Sharing
We do not sell your personal data. We share data only with: reward fulfillment partners (for orders you place), infrastructure providers under contract (hosting, email, analytics), and authorities when required by law.
6. Strava Data
Activity data fetched from Strava is used solely to calculate MilEx points and display your activities inside MilEx. You may disconnect Strava at any time from your account settings, which revokes our access and stops further syncs. Previously imported activities remain associated with your points history unless you delete them.
7. Retention
We retain account and activity data for as long as your account is active. If you delete your account, we erase personal data within 30 days, except where retention is required by law (e.g. tax records for redemptions).
8. Your Rights
Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights email privacy@milex.xyz.
9. Security
We use encryption in transit (TLS), encrypted storage, hashed passwords, and row-level security on our database. No system is perfectly secure — please use a strong, unique password and notify us if you suspect compromise.
10. Cookies
We use strictly necessary cookies for authentication and a minimal set of analytics cookies to understand product usage. You can control cookies through your browser settings.
11. Children
MilEx is not directed to children under 16. We do not knowingly collect data from children.
12. International Transfers
Your data may be processed in countries other than your own. Where required, we use standard contractual clauses or equivalent safeguards.
13. Changes
We will post updates to this policy on this page and, for material changes, notify you by email or in-app message.
14. Contact
Privacy questions or requests: privacy@milex.xyz.