Safe by default.

GoXC team feeds are invite-only. There is no public discovery, no search-by-name, no way for someone outside your team to find your profile or see your runs. Athletes join a team with a code from their coach — full stop.

There is no "public" mode. Sharing can be widened by a parent, but the default is always the most restrictive setting.

• Team feeds are only visible to verified team members
• No public athlete directory or discovery feature
• Profiles cannot be found via external search engines
• There are no private one-on-one messages — every conversation happens in a group

Every minor athlete can be linked to a parent or guardian account. Parents get a view-only window into their athlete's training logs, PRs, and the team meet schedule — without being able to post, comment, or interact with other athletes.

Any expansion of an athlete's sharing settings — like allowing their profile to be visible beyond the team — requires approval from the linked parent account.

• Parents can view training logs and PRs at any time
• Parents see the meet schedule and start times
• Parents receive push notifications for safety-relevant events
• Sharing expansions require parental approval for minors

GoXC does not run ads. We do not sell user data. We do not build advertising profiles. We do not use any advertising SDKs or third-party trackers.

We collect only the data needed to run the app. Your training logs, routes, and PRs belong to you — they are exportable and permanently deletable at any time from Settings.

• No advertising, ever — not even for coaches or programs
• No data sales or sharing with third parties for marketing purposes
• Data minimization: we only collect what the app needs to function
• All data is exportable from Settings → Help & Support
• Account deletion removes all personal data within 30 days

Route data is some of the most sensitive information we store, because it can reveal where an athlete lives, goes to school, and runs alone. We treat it accordingly.

GPS tracking is off by default and requires explicit permission from the athlete. Route maps are never publicly visible — they are only visible to the athlete and their coach within the team. Parents have a summary view without precise start/end coordinates.

• GPS tracking requires explicit opt-in — off by default
• No live location tracking — routes are logged after completion only
• Route maps are visible only to the athlete and their team coach
• Start/end coordinates are not exposed to other athletes or parents
• Location data is never shared with third parties

GoXC has no private one-on-one messages — anywhere, for anyone. This is a deliberate safety design. Every conversation happens in a group context where multiple people can see it.

Conversation types in GoXC:

• Coach posts to the full team — multiple athletes always present, never one alone
• Full-team group chats that include the coach and all team members
• Athlete-coach threads that always include the athlete's linked parent(s)
• No athlete-to-athlete private DMs — not now, not configurable, not possible to enable
• No private coach-to-athlete DMs — the parent is always included

Any user can report any message, comment, activity, or athlete with one tap from the menu on any content. Reports involving minor safety are flagged as highest priority and reviewed before other queued reports.

• One-tap report on any message, comment, workout, or user profile
• Reports reviewed within 24 hours; minor-safety reports prioritized
• One-tap block on any user — blocked users cannot see your activity or message you
• Serious safety concerns: [email protected]
• We cooperate with schools, athletic administrators, and law enforcement on safety matters
• Verified violations result in content removal, account suspension, or permanent ban

GoXC requires users to be at least 13 years old. Age is verified at signup and enforced server-side. We do not knowingly allow children under 13 to create accounts.

For users between 13 and 17, GoXC ships with the strictest available privacy and sharing defaults. Widening those defaults requires verified parental consent.

• Minimum age: 13 — enforced at signup and server-side
• Users under 13 are blocked and any accounts discovered are deleted immediately
• Under-13 suspected users: email [email protected]
• Ages 13–17 receive strictest defaults under COPPA and state minor-privacy laws
• Parental consent required before any default privacy setting can be widened for minors
• COPPA compliant — we do not collect data from children under 13