California Privacy Notice (CCPA / CPRA)

What's combined & why. This Notice covers app and Portal users together because NXTRUNN is the single business handling personal information across both. It supplements, and uses the same definitions as, the main Privacy Policy.

1. About this Notice

This Notice is for California residents and is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA"). It describes the categories of personal information we collect, the purposes, and your California rights. Terms not defined here have the meaning in our Privacy Policy.

2. Notice at collection — categories we collect

In the past 12 months (or since launch), we collect or may collect the following CCPA categories of personal information:

• Identifiers — name, username, email, account ID, IP address, device IDs — Collected: Yes
• Customer records (Cal. Civ. Code §1798.80) — name, contact details, payment-related metadata — Collected: Yes
• Protected classifications — 18+ eligibility attestation (no exact date of birth collected) — Collected: Limited
• Commercial information — memberships, tickets/orders, payouts (partners), purchase history — Collected: Yes
• Internet/network activity — usage, feature interactions, analytics events — Collected: Yes
• Geolocation data — precise GPS from venue check-ins [app]; approximate location — Collected: Yes
• Sensory data — photos/images you upload (runs, profile, posts) — Collected: Yes
• Professional/employment [Portal] — business role, organization details — Collected: Limited
• Health information — injury logs and workout/fitness metrics you sync from Apple Health (HealthKit) or Google Health Connect — Collected: Yes (see §4)
• Inferences — preferences/interests derived from activity — Collected: Limited

We collect this information from you, automatically from your use of the platform, and from service providers (auth, payments) and — where you connect them — from Apple Health (HealthKit) and Google Health Connect. The business/commercial purposes are those listed in §5 of the Privacy Policy.

3. Sensitive Personal Information (SPI)

Under CPRA, we collect the following sensitive personal information:

• Account log-in / credentials (via our auth provider);
• Precise geolocation (venue check-ins);
• Health information (injury logs; workout/fitness data you sync from Apple Health or Google Health Connect).

We use and disclose SPI only for permitted business purposes — to provide the features you request, secure accounts, process payments, and comply with law. We do not use SPI to infer characteristics about you. You may still delete this data and withdraw consent (e.g., revoke location permission, delete injury logs, or disconnect a health integration in your device settings).

4. Health data note

NXTRUNN's injury-tracking features, and the workout/fitness data you choose to sync from Apple Health (HealthKit) or Google Health Connect, involve health information you voluntarily provide. We process it only to provide those features, on the basis of your consent, and you can delete it at any time. We do not sell or share it, and — consistent with Apple's and Google's platform requirements — we never use it for advertising or marketing.

5. Sale or sharing of personal information

NXTRUNN does NOT sell personal information, and does NOT "share" it for cross-context behavioral advertising, as those terms are defined under CCPA/CPRA. We have not done so in the preceding 12 months, including with respect to the personal information of minors (and the platform is 18+ regardless).

6. Disclosure for business purposes

We disclose personal information to service providers / contractors (e.g., Clerk, Supabase, Stripe, Cloudflare R2, Mapbox, AWS SES, Sentry, PostHog, Upstash, Anthropic, Printful — see the Subprocessor List) solely to perform services for us under written contracts that restrict their use of the information.

7. Your California rights

California residents may request to:

• Know / Access — the categories and specific pieces of personal information we collected, the sources, purposes, and categories of recipients.
• Delete — your personal information (subject to legal exceptions).
• Correct — inaccurate personal information.
• Opt out of sale/sharing — not applicable, because we do not sell or share (we honor Global Privacy Control signals regardless).
• Limit use of SPI — not applicable as described in §3 (we do not use SPI to infer characteristics).
• Non-discrimination — we will not discriminate against you for exercising your rights.

8. How to exercise your rights

• Online / in-product: Settings → Data & Export, or nxtrunn.com/account-deletion.
• Email: legal@nxtrunn.com (or info@nxtrunn.com for app / partners@nxtrunn.com for portal).

Because NXTRUNN maintains a direct relationship with you and operates primarily online, we accept privacy requests by email, at nxtrunn.com/account-deletion, and through in-product controls. We will verify your identity before fulfilling a request, and respond within 45 days (extendable to 90 with notice). You may use an authorized agent; we will require proof of authorization.

9. Retention

We retain each category of personal information for as long as needed for the purposes in the Privacy Policy and as required by law; see the Data Retention & Deletion Policy.

10. Minors

NXTRUNN is an 18+ platform; we do not knowingly collect personal information from anyone under 18. We do not sell or share the personal information of minors.

11. Contact

legal@nxtrunn.com · info@nxtrunn.com (app) · partners@nxtrunn.com (portal) · NXTRUNN LLC, 1317 Edgewater Dr #2018, Orlando, FL 32804, United States.