G GoXC
  • Home
  • Terms

Privacy Policy

Last Updated: May 15, 2026  ·  Effective Date: May 15, 2026

This Privacy Policy describes how TMCM Estates, LLC ("we," "us," or "our") collects, uses, and shares information about you when you use the GoXC mobile application ("the App").

We built GoXC for high school cross country athletes. We take your privacy — and your safety — seriously, especially given that many of our users are minors. This policy is written to be clear and honest about what we do with your data.

If you have questions, email us at [email protected].

1. Who We Are

GoXC is operated by TMCM Estates, LLC, located in the United States. We are the data controller for the personal information collected through the App.

Contact: [email protected]

2. Age Requirement

You must be at least 13 years old to use GoXC. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly.

If you believe a child under 13 is using GoXC, please email us at [email protected] and we will investigate.

3. Information We Collect

Information you give us

When you create an account and use GoXC, we collect:

  • Account information: Email address, password (stored encrypted), full name, username, date of birth, graduation year, grade level
  • Profile information: Avatar photo (if you upload one), running events you participate in
  • Team information: The cross country team you join or create
  • Workout data: Miles run, pace, duration, date and time, route name, optional notes
  • GPS routes: When you use the in-app GPS tracking, we collect the latitude/longitude coordinates that make up your route, including the city, region, and country where you ran
  • Personal records (PRs): Race times and event names you choose to log
  • Season goals: Mileage goals you set
  • Shoes: Brand, model, total miles, retirement status of running shoes you track
  • Messages and comments: Text messages you send in team chat, comments on workouts, and reactions/likes
  • Photos: Images you choose to share in team chat
  • Reports: Information about content or users you report for review

Information from Apple Health (HealthKit)

If you grant permission, GoXC reads running workout data from Apple Health, including:

  • Workout date, duration, and distance
  • Heart rate data (if recorded by your device or wearable)

We use this only to automatically log your runs in GoXC. We do not write to Apple Health. We do not share your health data with any third party, and we never use it for advertising. Your HealthKit data is stored on our servers (Supabase) only to display it back to you and your team in GoXC. You can revoke HealthKit access at any time in your iPhone Settings.

Information collected automatically

  • Push notification tokens: A unique identifier issued by Apple or Google that lets us send you notifications
  • Timezone: So we send you notifications at the right time of day
  • Device type and OS version (collected by Expo / Supabase infrastructure for crash reporting and platform support)

What we do NOT collect

  • We do not collect contacts from your phone
  • We do not access your microphone
  • We do not track you across other apps or websites for advertising
  • We do not collect financial information (the App is free)
  • We do not use any advertising SDKs

4. How We Use Your Information

We use your information to:

  • Provide the App's features (logging runs, tracking PRs, syncing with your team)
  • Display your activity to your teammates as part of normal team-app functionality
  • Send you push notifications about teammate activity, reactions to your runs, messages, season updates, and daily reminders (you can control these in Settings)
  • Sync your running data from Apple Health when you allow it
  • Improve the App and fix bugs
  • Respond to your reports and moderate the App for safety
  • Comply with legal obligations

We do not sell your personal information.
We do not use your information for targeted advertising.
We do not profile users in any automated decision-making that affects their rights.

5. How We Share Your Information

With your teammates

GoXC is designed for team interaction. Your profile, workouts, PRs, comments, and chat messages are visible to other members of your team within the App. This is the core function of the App. By joining a team, you understand that team members will see your activity.

With service providers

We use the following services to operate GoXC:

  • Supabase, Inc. — provides our backend database, authentication, file storage, and push delivery services. Supabase processes data on our behalf under their security and privacy commitments. See supabase.com/privacy
  • Apple Push Notification Service (APNs) — delivers iOS push notifications
  • Firebase Cloud Messaging (FCM) — delivers Android push notifications
  • Expo (Expo Application Services, Inc.) — provides build and over-the-air update infrastructure for the App

We do not authorize these providers to use your information for any purpose other than supporting GoXC.

For legal reasons

We may disclose information if required by law, subpoena, court order, or to protect the rights, safety, or property of users, the public, or TMCM Estates, LLC.

In a business transfer

If TMCM Estates, LLC is acquired, merged, or transfers assets, your information may be transferred as part of that transaction. We will notify you and post an update to this policy before any change takes effect.

6. Your Privacy Choices

Account deletion

You can delete your account at any time from within the App: Settings → Help & Support → Delete My Account. When you delete your account, we permanently remove:

  • Your profile, login, and date of birth
  • Your workouts, routes, PRs, and goals
  • Your messages, comments, and shared photos
  • Your follows and likes

Some data may persist in backups for up to 30 days before being permanently erased. Reports you submitted may be retained in anonymized form for safety and moderation purposes.

If you cannot access your account, email [email protected] from the email address on file, and we will process your deletion request within 30 days.

Notification preferences

Control which push notifications you receive in Settings → Notifications within the App.

HealthKit access

Revoke GoXC's access to Apple Health at any time in iPhone Settings → Privacy & Security → Health → GoXC.

Location permissions

Revoke or adjust GoXC's location access at any time in iPhone Settings → Privacy & Security → Location Services → GoXC. If you revoke location access, GPS run tracking will not work, but you can still log runs manually.

Blocking other users

You can block any user from the menu on their message, comment, or profile. Blocked users cannot message you, comment on your activities, or see your runs. Manage your blocks in Settings → Blocked Users.

7. Your Rights

California residents (CCPA / CPRA)

You have the right to:

  • Know what personal information we collect, use, and share
  • Access a copy of your personal information
  • Request deletion of your personal information
  • Opt out of the sale or sharing of personal information (we do not sell or share for cross-context advertising)
  • Not be discriminated against for exercising these rights

To exercise these rights, email [email protected] with the subject "CCPA Request."

European Union / UK residents (GDPR)

You have the right to:

  • Access your personal information
  • Correct inaccurate personal information
  • Delete your personal information ("right to be forgotten")
  • Restrict or object to processing
  • Data portability
  • Lodge a complaint with your supervisory authority

To exercise these rights, email [email protected]. We will respond within 30 days.

Everyone else

Email [email protected] with any privacy-related request and we will help.

8. Data Security

We use industry-standard security practices to protect your information, including:

  • Encrypted connections (HTTPS / TLS) between the App and our servers
  • Encryption at rest in our database (Supabase)
  • Password hashing (we never see your password in plain text)
  • Row-level security on our database so users only access data they're authorized to see

No system is perfectly secure. If we discover a security breach affecting your personal information, we will notify you and the appropriate authorities as required by law.

9. Data Retention

We keep your information for as long as your account is active. When you delete your account, we delete your personal information within 30 days, except:

  • Reports and moderation records: We retain reports of objectionable content (in anonymized form where possible) to maintain App safety
  • Backups: May persist for up to 30 additional days before being overwritten
  • Legal compliance: Information we are required to retain by law

10. Children Under 13

GoXC is not intended for children under 13. We enforce this by:

  • Requiring date of birth at signup
  • Blocking account creation for users under 13
  • Server-side enforcement of the age requirement

If we learn we have collected personal information from a child under 13, we will delete it immediately. Parents and guardians who believe their child is using GoXC can email [email protected] to request deletion.

11. International Users

GoXC is operated from the United States. If you use the App from outside the U.S., your information will be transferred to and processed in the U.S., where data protection laws may differ from those in your country. By using GoXC, you consent to this transfer.

12. Third-Party Links

The App may include links to third-party websites (such as your team's school website). We are not responsible for the privacy practices of these websites. Review their privacy policies separately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

  • Update the "Last Updated" date at the top
  • Notify users of material changes through the App or by email
  • Provide at least 14 days' notice before material changes take effect

Your continued use of GoXC after changes take effect means you accept the updated policy.

14. Contact Us

For any questions about this Privacy Policy or our privacy practices:

Email: [email protected]
Operator: TMCM Estates, LLC

We respond to privacy inquiries within 7 business days.

© 2026 GoXC · TMCM Estates, LLC Privacy Policy Terms of Service