Privacy Policy

Last updated: October 15, 2026
Effective date: October 15, 2026

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal Data to provide and improve the Service. We collect, use, and disclose Your information as described in this Privacy Policy and, where required by applicable law, only where We have a valid legal basis to do so, including Your consent (where consent is required).

The Service is offered to adults 18 and older in the United States and Canada. Because Rung is a nutrition, weight, and workout tracking app, much of the information You enter relates to Your health and fitness. Please read the "Health and Fitness Information" and "AI Providers" sections carefully.

Summary

• What We collect: the information You enter (Your profile, body measurements, food, and workouts), the account details Apple or Google share when You sign in, and crash diagnostics.
• How We use it: only to run Rung, including Your calorie targets, AI check-ins, workout suggestions, and meal scanning, and to keep the Service working and secure.
• AI providers: some features send limited data to Anthropic and OpenAI. We never send them Your name, email address, date of birth, gender, or height, and neither uses it to train its models.
• No selling, no ads: We do not sell or share Your Personal Data, use it for advertising, or track You across other companies' apps or websites.
• Your data is yours: Your profile, logs, foods, and workouts are visible only to You. You can delete Your Account and its data at any time in the app under Profile > Delete Account.
• Health information: We ask for Your consent before saving it and use it only to provide Rung's features. Residents of Washington, Nevada, and Connecticut can also read Our Consumer Health Data Privacy Policy.
• Questions: email privacy@rungfit.com.

This summary highlights the key points. The rest of this Privacy Policy explains each one in full.

Interpretation and Definitions

Interpretation

The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access Our Service or parts of Our Service.

• Application refers to Rung: Workout & Nutrition ("Rung"), the software program provided by the Company for iOS.

• Business, for the purposes of the CCPA/CPRA, refers to the Company as the legal entity that collects Consumers' personal information, or on behalf of which such information is collected, and that alone, or jointly with others, determines the purposes and means of the processing of Consumers' personal information, and that does business in the State of California.

• CCPA and/or CPRA refers to the California Consumer Privacy Act (the "CCPA") as amended by the California Privacy Rights Act of 2020 (the "CPRA").

• Company (referred to as either "the Company", "We", "Us" or "Our" in this Privacy Policy) refers to CLZ Labs LLC, 1401 21st ST, STE R, Sacramento, CA 95811, USA.

  For the purposes of the GDPR, the Company is the Data Controller.

• Consumer, for the purpose of the CCPA/CPRA, means a natural person who is a California resident. A resident, as defined in the law, includes (1) every individual who is in the State of California for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the State of California who is outside the State of California for a temporary or transitory purpose.

• Consumer Health Data Privacy Policy refers to Our separate policy for residents of Washington, Nevada, and Connecticut, available at rungfit.com/consumer-health-data.

• Country/State refers to: California, United States. The Service is offered in the United States and Canada.

• Data Controller, for the purposes of the GDPR (General Data Protection Regulation), refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.

• Device means any device that can access the Service, such as a computer, a cell phone or a digital tablet.

• Do Not Track (DNT) is a concept that has been promoted by U.S. regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing Internet users to control the tracking of their online activities across websites.

• GDPR refers to the EU General Data Protection Regulation.

• Personal Data (or "Personal Information") is any information that relates to an identified or identifiable individual.

  For the purposes of GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.

  For the purposes of the CCPA/CPRA, Personal Data means any information that identifies, relates to, describes or is capable of being associated with, or could reasonably be linked, directly or indirectly, with You.

  We use "Personal Data" and "Personal Information" interchangeably unless a law uses a specific term.

• Service refers to the Application and the website at rungfit.com.

• Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.

  For the purposes of the GDPR, Service Providers are considered Data Processors.

• Third-Party Social Media Service refers to any website or any social network website through which a User can log in or create an account to use the Service. For Rung, this means Sign in with Apple and Google Sign-In.

• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

• User means any individual who accesses or uses the Service.

• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

  Under GDPR, You can be referred to as the Data Subject since You are the individual using the Service.

Collecting and Using Your Personal Information

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:

• Email address
• Name and profile picture link (if You sign in with Google)
• Username You choose
• Date of birth and gender
• Height, weight entries over time, and goal weight
• Diet type, activity level, goal, and target pace of change
• Training experience, how many days a week You train, and how You split Your training
• Unit and language preferences
• Foods and meals You log (including notes You add), saved meals, and foods You create
• Workouts You log or generate, including sets, reps, and weights, custom exercises, and training preferences
• Text You enter in the optional "special considerations" field, such as injuries
• Weekly check-ins and workout suggestions We generate for You
• Calorie needs and macro targets We calculate from the information above

Health and Fitness Information

Weight, body measurements, nutrition, workout data, and anything You tell Us about injuries can reveal information about Your health. We use this information only to provide the Service's features to You. We do not use it for advertising, and We do not sell it. If You live in Washington, Nevada, or Connecticut, Our Consumer Health Data Privacy Policy also applies to You.

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of Our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device's unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

We may also collect information that Your browser sends whenever You visit Our Service or when You access the Service by or through a mobile device.

For Rung, Usage Data includes:

• Diagnostics. Crash reports, a sample of performance traces and profiles, the names of screens You visit, a short trail of in-app actions (for example, "meal scanned" or a barcode that was not found), food search terms that were in progress when an error happened, Your device and operating system details, and Your Rung user ID. Diagnostics do not include Your name or email address. We have turned off IP address storage in Our error monitoring tool.
• Onboarding analytics. A pseudonymous device identifier, the sequential number of the onboarding step You view, and whether You start signup or complete setup, plus standard app and device metadata. These events do not include screen names, Your answers, health or fitness measurements, Your Rung account ID, or Your email address. We use PostHog for this limited funnel, with IP anonymization enabled and automatic capture and session replay disabled.
• Feature usage records. When You use an AI or food-search feature, We record when it ran, which feature it was, and whether it succeeded, so We can limit usage per hour and diagnose failures. These records do not contain Your photos, recordings, or the text You entered.
• Website signups. If You join the early-access list on rungfit.com, We create a keyed one-way hash of Your IP address to limit abuse. We do not store Your IP address itself, and the hash is not linked to Your email address.

Information from Third-Party Social Media Services

The Company allows You to create an account and log in to use the Service through the following Third-Party Social Media Services:

• Apple (Sign in with Apple)
• Google

If You decide to register through or otherwise grant Us access to a Third-Party Social Media Service, We may collect Personal Data that is already associated with Your Third-Party Social Media Service's account. For Rung, this is limited to an account identifier and Your email address, and, if You sign in with Google, Your name and a link to Your profile picture. If You sign in with Apple, We do not store Your name. We do not collect Your activities or contact list from either service.

You may also have the option of sharing additional information with the Company through Your Third-Party Social Media Service's account. If You choose to provide such information and Personal Data, during registration or otherwise, You are giving the Company permission to use, share, and store it in a manner consistent with this Privacy Policy.

Information Collected While Using the Application

While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:

• Pictures and other information from Your Device's camera and photo library, to scan meals, nutrition labels, and barcodes
• Audio recordings from Your Device's microphone, up to 60 seconds, for voice entry
• Permission to show notifications, for workout rest timers

We use this information to provide features of Our Service and to improve and customize Our Service. Meal and label photos and voice recordings are sent to Our servers and Our AI providers for processing, and We do not keep them on Our servers after they have been processed. The Application deletes voice recordings from Your Device after use. Notifications are generated on Your Device. Photos, recordings, and text can contain personal details You did not intend to share, so avoid including anything You would not want processed this way.

To work offline and load quickly, the Application also keeps a copy of Your recent Rung data (such as Your profile, logs, and workouts) on Your Device. Your sign-in session is stored in Your Device's secure storage (keychain). Signing out or deleting Your Account clears this data from the Application.

The Application does not access Your location, contacts, or Apple Health data.

You can enable or disable access to this information at any time, through Your Device settings.

Tracking Technologies and Cookies

We do not use tracking technologies (such as advertising or analytics cookies, pixels, or software development kits) to track Your activity across other companies' apps or websites. The technologies We use within Rung are limited to:

• Error monitoring in the Application, described in the "Error Monitoring" section, which We use only to fix crashes and performance problems.
• Onboarding analytics in the Application, described in the "Usage Data" section, which We use to understand completion of the setup flow. Automatic capture and session replay are disabled.
• On-device storage in the Application, described above, which keeps the Application working.

Our website uses PostHog for basic, cookieless analytics, such as page views, early-access link clicks, and completed preview signups. The anonymous analytics identifier is held in memory in your browser and is not persisted across a page reload. We anonymize IP addresses, disable automatic interaction capture and session replay, and do not send email addresses or form contents to PostHog. Our website host also keeps standard server logs.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain Our Service, including to monitor the usage of Our Service.

• To manage Your Account: to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.

• To calculate Your targets: to estimate Your calorie needs and macro targets, and to chart Your progress toward Your goals.

• To provide AI features: to generate weekly check-ins and workout suggestions, recognize meals and nutrition labels, analyze meal descriptions, and transcribe voice entries, as described in the "AI Providers" section.

• For the performance of a contract: the development, compliance and undertaking of any contract with Us through the Service, including Our Terms of Service and any subscriptions You purchase.

• To contact You: To contact You by email, or by in-app notices, regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation. If You joined the early-access list on Our website, We will email You about Your invitation.

• To provide You with news, special offers, and general information about other goods, services and events which We offer that are similar to those that You have already purchased or inquired about. We send such marketing communications only where permitted by applicable law: where prior consent is required (for example, under the laws applicable in the EEA, the UK, and Canada), We will send them only with Your consent; otherwise, We may send them until You opt out. You may opt out or withdraw Your consent at any time by using the unsubscribe link in any marketing email We send or by contacting Us.

• To manage Your requests: To attend and manage Your requests to Us.

• To keep the Service secure: to detect crashes, prevent abuse, and limit how often paid features can be used.

• For business transfers: We may use Your Personal Data to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about Our Service users is among the assets transferred.

• For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, and evaluating and improving Our Service, products, services, and Your experience.

We do not use Your Personal Data for advertising, and We do not use it to build advertising profiles.

We may share Your Personal Data in the following situations:

• With Service Providers: We may share Your Personal Data with Service Providers to operate the Service, to provide AI features, to monitor errors and performance, and to contact You. They are listed in the "Detailed Information on the Processing of Your Personal Data" section.
• For business transfers: We may share or transfer Your Personal Data in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
• With Your consent: We may disclose Your Personal Data for any other purpose with Your consent.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with Our legal obligations (for example, if We are required to retain Your data to comply with applicable laws), resolve disputes, and enforce Our legal agreements and policies.

Where possible, We apply shorter retention periods and/or reduce identifiability by deleting, aggregating, or anonymizing data. Unless otherwise stated, the retention periods below are maximum periods ("up to") and We may delete or anonymize data sooner when it is no longer needed for the relevant purpose. We apply different retention periods to different categories of Personal Data based on the purpose of processing and legal obligations:

• Account Information

  • User Accounts, including Your profile, health and fitness information, logs, workouts, saved meals and foods, foods and custom meals You created, special considerations, weekly check-ins, and feature usage records: retained while Your Account is active. When You delete Your Account, this data is deleted from Our database immediately.

• Content Submitted for Analysis

  • Meal and nutrition-label photos, voice recordings, and meal descriptions: not stored on Our servers after they have been processed. Our AI providers retain them as described in the "AI Providers" section.

• Customer Support Data

  • Emails You send Us: retained for as long as needed to resolve Your request, and up to 12 months afterward to handle follow-up questions.

• Usage Data

  • Diagnostics in Our error monitoring tool: up to 30 days.
  • Hashed website IP addresses used for rate limiting: about 1 day.
  • Server logs kept by Our hosting providers: according to their standard log retention schedules.

• Marketing Data

  • Website early-access email addresses: until You ask Us to delete them, or until We no longer need them to send Your invitation.

• Financial and Transaction Data

  • Payment information: credit/debit card details are not stored on Our servers; they are processed by Apple or Google. We retain subscription and transaction records (product, price, purchase and renewal dates) for up to 10 years from the date of transaction to comply with tax laws and financial regulations, including after You delete Your Account.

Usage Data is retained in accordance with the retention periods described above, and may be retained longer only where necessary for security, fraud prevention, or legal compliance.

We may retain Personal Data beyond the periods stated above for different reasons:

• Legal obligation: We are required by law to retain specific data (e.g., financial records for tax authorities).
• Legal claims: Data is necessary to establish, exercise, or defend legal claims.
• Your explicit request: You ask Us to retain specific information.
• Technical limitations: Data exists in backup systems that are scheduled for routine deletion. Our database backups are kept for up to 7 days.

You may request information about how long We will retain Your Personal Data by contacting Us.

When retention periods expire, We securely delete or anonymize Personal Data according to the following procedures:

• Deletion: Personal Data is removed from Our systems and no longer actively processed.
• Backup retention: Residual copies may remain in encrypted backups for a limited period consistent with Our backup retention schedule and are not restored except where necessary for security, disaster recovery, or legal compliance.
• Anonymization: In some cases, We convert Personal Data into anonymous statistical data that cannot be linked back to You. This anonymized data may be retained indefinitely for research and analytics.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. This means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ from those of Your jurisdiction.

Our database is hosted in the United States (AWS us-east-2, Ohio), and Our error monitoring data is stored in the United States. Your information is stored and processed primarily in the United States. If You live in Canada, Your information will be transferred to the United States, where it may be accessible to courts, law enforcement, and national security authorities under United States law.

Where required by applicable law, We will ensure that international transfers of Your Personal Data are subject to appropriate safeguards and, where relevant, supplementary measures. The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place, including the security of Your data and other personal information.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

Our Service gives You the ability to delete Your Account and its data from within the Application: Profile > Delete Account. This immediately and permanently deletes Your Account and the data tied to it in Our database, including Your profile, health and fitness information, weight and food logs, workouts, saved meals and foods, foods and custom meals You created, special considerations, weekly check-ins, and feature usage records. It also clears Rung's data from the Application on that Device.

Some information may remain for a limited time after You delete Your Account:

• Diagnostics in Our error monitoring tool are kept for up to 30 days. They are tied only to Your Rung user ID, which no longer maps to an Account once You delete it.
• Database backups are overwritten within 7 days.
• Data held by Our AI providers follows the retention described in the "AI Providers" section.
• Subscription and transaction records are kept as described in "Retention of Your Personal Data" to meet tax and accounting obligations. Deleting Your Account does not cancel a subscription; cancel it with Apple or Google first.

You may update or amend most of Your information at any time by signing in to Your Account and editing it in the Application. You may also contact Us to request access to, correct, or delete any Personal Data that You have provided to Us, including a website early-access email address.

Please note, however, that We may need to retain certain information when We have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, the Company may disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other Legal Requirements

The Company may disclose Your Personal Data in the good-faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public
• Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While We strive to use commercially reasonable means to protect Your Personal Data, We cannot guarantee its absolute security.

The measures We use include encrypting traffic between the Application and Our servers, storing Your sign-in session in Your Device's secure storage, and database access rules that restrict Your profile, logs, foods, and workouts to Your own Account.

Detailed Information on the Processing of Your Personal Data

The Service Providers We use may have access to Your Personal Data. These third-party vendors collect, store, use, process and transfer information about Your activity on Our Service in accordance with their Privacy Policies and their agreements with Us. They may process Your Personal Data only to provide their services to Us.

Infrastructure

• Supabase: database, authentication, and server functions. Our database is hosted in the United States. Their Privacy Policy can be viewed at https://supabase.com/privacy

• Expo (EAS): delivers Application updates to Your Device. Their Privacy Policy can be viewed at https://expo.dev/privacy

• Vercel: hosts Our website. Their Privacy Policy can be viewed at https://vercel.com/legal/privacy-notice

• PostHog: provides limited website analytics and anonymous onboarding funnel analytics in the Application, as described in the "Usage Data" section. Their Privacy Policy can be viewed at https://posthog.com/privacy

Sign-In

• Apple (Sign in with Apple). Their Privacy Policy can be viewed at https://www.apple.com/legal/privacy/en-ww/

• Google (Google Sign-In). Their Privacy Policy can be viewed at https://policies.google.com/privacy

AI Providers

Some features of the Service are powered by third-party AI providers. When You use them, We send the minimum information needed. We do not send Your name, email address, date of birth, gender, or height to these providers.

• Anthropic receives the following. Their Privacy Policy can be viewed at https://www.anthropic.com/legal/privacy

  • Weekly check-ins: a summary of Your week, including weigh-in count, weekly average, current and goal weight, rate of change, Your goal and target pace, calorie and macro averages against Your targets, Your calculated calorie needs, and workouts completed.
  • Meal and label scans: meal and nutrition-label photos, and text descriptions of meals.
  • Workout generation: Your session settings, the names of exercises You trained recently, and anything You typed in the description or special considerations fields.

• OpenAI receives the following. Their Privacy Policy can be viewed at https://openai.com/policies/privacy-policy

  • Voice entry: voice recordings, for transcription.
  • Meal descriptions: text descriptions of meals, if We route meal analysis to it.

Under the providers' current commercial and API terms, neither uses the content We send to train its models. Anthropic deletes inputs and outputs from its systems within 30 days. If its automated systems flag content as violating its usage policy, it may keep that content for up to 2 years. OpenAI does not keep voice recordings sent for transcription. For meal text, OpenAI may keep request logs for up to 30 days for abuse monitoring, and We ask it not to store the request otherwise. These terms are set by the providers and may change.

AI features can be wrong. The Service is not a substitute for medical advice. See Our Terms of Service.

Error Monitoring

We use a third-party Service Provider to detect crashes and performance problems in the Application. It processes the diagnostics described in the "Usage Data" section on Our behalf and does not use them for its own purposes.

• Sentry (data stored in the United States). Their Privacy Policy can be viewed at https://sentry.io/privacy/

Food Data Lookups

When You search for a food or scan a barcode, We look it up in public food databases. These services receive food names, search terms, or barcodes, not Your Account or personal information.

• USDA FoodData Central. Their Privacy Policy can be viewed at https://www.usda.gov/privacy-policy

• Open Food Facts. Their Privacy Policy can be viewed at https://world.openfoodfacts.org/privacy

• Browserbase, used to fill gaps in food data from manufacturer websites. It receives past search text that is not linked to any user. Their Privacy Policy can be viewed at https://www.browserbase.com/privacy-policy

Website Email

If You join the early-access list on Our website, We use these Service Providers to receive and record Your signup.

• Resend (email delivery). Their Privacy Policy can be viewed at https://resend.com/legal/privacy-policy

• Google Workspace (spreadsheet). Their Privacy Policy can be viewed at https://policies.google.com/privacy

Website Analytics

We use PostHog for basic website usage analytics and a limited mobile onboarding funnel. The Application sends only a pseudonymous device identifier, sequential step numbers, signup-started and completion events, and standard app/device metadata. We do not send mobile account identifiers, email addresses, answers, screen names, or health measurements. We anonymize IP addresses and disable automatic capture and session replay. Website analytics do not include signup email addresses or form contents. Their Privacy Policy can be viewed at https://posthog.com/privacy.

Payments

We provide paid products and/or services within the Service, including subscriptions. We use third-party services for payment processing (e.g. payment processors).

We will not store or collect Your payment card details. That information is provided directly to Our third-party payment processors whose use of Your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

Subscriptions are purchased through the Apple App Store or Google Play using the payment method on Your Apple or Google account. Apple or Google processes Your payment and handles billing, renewals, cancellations, and refunds under its own terms. We do not receive Your payment card details or billing address.

We use RevenueCat to manage subscriptions. RevenueCat receives an app user identifier, Your purchase and subscription records (such as the product, price, currency, purchase and renewal dates, trial status, and transaction identifiers), and basic device information (such as platform, operating system, and app version). We use this information to unlock paid features, show Your subscription status, handle billing questions, and meet tax and accounting obligations.

You can manage or cancel Your subscription at any time in Your Apple or Google account settings. Deleting Your Account does not cancel a subscription; cancel it with Apple or Google first.

• Apple Store In-App Payments. Their Privacy Policy can be viewed at https://www.apple.com/legal/privacy/en-ww/

• Google Play In-App Payments. Their Privacy Policy can be viewed at https://www.google.com/policies/privacy/

• RevenueCat. Their Privacy Policy can be viewed at https://www.revenuecat.com/privacy

GDPR Privacy

The Service is not currently offered in the European Economic Area ("EEA") or the United Kingdom ("UK"). This section applies if the GDPR or the UK GDPR applies to Our processing of Your Personal Data.

Legal Basis for Processing Personal Data under GDPR

We may process Personal Data under the following conditions:

• Consent: You have given Your consent for processing Personal Data for one or more specific purposes. Where We process health data, which is a special category of Personal Data, We rely on Your explicit consent.
• Performance of a contract: Provision of Personal Data is necessary for the performance of an agreement with You and/or for any pre-contractual obligations thereof.
• Legal obligations: Processing Personal Data is necessary for compliance with a legal obligation to which the Company is subject.
• Vital interests: Processing Personal Data is necessary in order to protect Your vital interests or those of another natural person.
• Public interests: Processing Personal Data is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Company.
• Legitimate interests: Processing Personal Data is necessary for the purposes of the legitimate interests pursued by the Company.

The legal basis We rely on depends on the purpose of the processing:

• Performance of a contract: creating and administering Your Account, providing and maintaining the Service, processing purchases and payments, and providing customer support.
• Legitimate interests: securing the Service and preventing fraud and abuse; monitoring, analyzing, and improving the Service; sending non-marketing service communications; enforcing Our agreements and establishing, exercising, or defending legal claims; and evaluating or completing business transfers. Where We rely on legitimate interests, Our interest is the effective, secure, and commercially sustainable operation and improvement of the Service, and We balance that interest against Your rights and freedoms.
• Consent: processing health and fitness information (explicit consent); sending marketing communications where consent is required.
• Legal obligation: retaining transaction, tax, and accounting records, and responding to lawful requests from courts and public authorities.

Where the provision of Personal Data is a statutory or contractual requirement, or necessary to enter into a contract with Us, We will make this clear at or before the point of collection, including whether You are obliged to provide the Personal Data and the possible consequences of not providing it. If You have questions about the legal basis for any specific processing activity, please contact Us.

International Transfer of Personal Data

We may transfer, store, and process Personal Data in countries other than the country in which You are located, including countries outside the European Economic Area ("EEA") and the United Kingdom ("UK"), where data protection laws may differ.

Where We transfer Personal Data outside the EEA/UK to a country that has not been recognized as providing an adequate level of protection, We rely on appropriate safeguards, such as:

• Transfers to countries that the European Commission or the UK Government has decided provide an adequate level of data protection, including, for transfers to the United States, recipients certified under the EU-U.S. Data Privacy Framework (and its UK Extension), where applicable
• The European Commission's Standard Contractual Clauses ("SCCs") and/or the UK International Data Transfer Agreement ("IDTA") or the UK Addendum to the SCCs (as applicable)
• Supplementary measures where appropriate, such as encryption in transit and at rest, access controls, data minimization, and vendor security reviews.

We transfer Personal Data internationally only as needed to provide the Service and to work with Our Service Providers (for example, hosting, AI processing, error monitoring, email delivery). You may contact Us using the details in the "Contact Us" section of Our Privacy Policy to request further information about the safeguards We use for international transfers, including copies of relevant contractual protections (redacted where necessary).

Your Rights under the GDPR

The Company undertakes to respect the confidentiality of Your Personal Data and to guarantee You can exercise Your rights.

You have the right under this Privacy Policy, and by law where the GDPR or the UK GDPR applies to Our processing of Your Personal Data (including, in particular, if You are in the European Economic Area (EEA) or the United Kingdom (UK)), to:

• Request access to Your Personal Data. The right to access, update or delete the information We have on You. Where possible, You can access, update or request deletion of Your Personal Data directly within Your Account settings section. If You are unable to perform these actions yourself, please contact Us to assist You. This also enables You to receive a copy of the Personal Data We hold about You.
• Request restriction of processing. You have the right to ask Us to restrict processing of Your Personal Data in certain circumstances (for example, while We verify accuracy or consider an objection).
• Request correction of the Personal Data that We hold about You. You have the right to have any incomplete or inaccurate information We hold about You corrected.
• Object to processing of Your Personal Data. This right exists where We are relying on a legitimate interest as the legal basis for Our processing and there is something about Your particular situation that makes You want to object to Our processing of Your Personal Data on this ground. You also have the right to object where We are processing Your Personal Data for direct marketing purposes.
• Request erasure of Your Personal Data. You have the right to ask Us to delete or remove Personal Data when there is no good reason for Us to continue processing it.
• Request the transfer of Your Personal Data. We will provide to You, or to a third-party You have chosen, Your Personal Data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which You initially provided consent for Us to use or where We used the information to perform a contract with You.
• Withdraw Your consent. You have the right to withdraw Your consent to Our use of Your Personal Data. If You withdraw Your consent, We may not be able to provide You with access to certain specific functionalities of the Service.

Exercising of Your GDPR Data Protection Rights

You may exercise any of the rights described above by contacting Us. Please note that We may ask You to verify Your identity before responding to such requests. If You make a request, We will try Our best to respond to You as soon as possible. We generally respond within one month, and may extend by two further months where necessary, in accordance with applicable law.

You have the right to complain to a supervisory authority about Our collection and use of Your Personal Data. If You are in the EEA, please contact Your local data protection authority. If You are in the UK, You can complain to the Information Commissioner's Office (ICO).

Automated Decision-Making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning You or similarly significantly affect You. The calorie targets, check-ins, and workout suggestions the Service generates are recommendations You can choose to follow or ignore. If this changes, We will update this Privacy Policy and provide the information and safeguards required by the GDPR.

Canada Privacy

This section applies if You live in Canada.

Consent. We collect, use, and disclose Your Personal Information with Your consent, which You give when You create an Account and enter information into the Service. We ask for Your express consent, through a separate checkbox during setup, before We save Your health information. You can withdraw consent at any time by deleting Your Account, though some features cannot work without the information they need.

Access and correction. You have the right to access the Personal Information We hold about You and to ask Us to correct it. You can correct most information directly in the Application, or contact Us. We will respond within 30 days, and if We need more time, We will tell You why and how much longer it will take.

Transfers outside Canada. Your Personal Information is stored and processed primarily in the United States, as described in "Transfer of Your Personal Data."

Person responsible for privacy. The person responsible for privacy at the Company is the Privacy Officer, CLZ Labs LLC, reachable at privacy@rungfit.com.

Complaints. If You are not satisfied with Our response, You can contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information du Québec.

Consumer Health Data (Washington, Nevada, and Connecticut)

If You live in Washington, Nevada, or Connecticut, information We collect about Your health may be "consumer health data" under those states' laws. Our Consumer Health Data Privacy Policy describes the consumer health data We collect, why, who We share it with, and how to exercise Your rights, including the right to appeal a decision.

CCPA/CPRA Privacy Notice (California Privacy Rights)

This privacy notice section for California residents supplements the information contained in Our Privacy Policy and it applies solely to visitors, users, and others who reside in the State of California.

Categories of Personal Information Collected

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or Device. The following is a list of categories of personal information which We may collect or may have collected from California residents within the last twelve (12) months.

The categories and examples provided in the list below are those defined in the CCPA/CPRA. Listing a category does not mean that every type of information it describes was in fact collected by Us. It means only that, to the best of Our knowledge, some information within that category may be, or may have been, collected. Certain categories would be collected only if You provided that information to Us directly.

• Category A: Identifiers.

  Examples: A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, driver's license number, passport number, or other similar identifiers.

  Collected: Yes. Email address, name (Google sign-in only), username, account identifiers, and device identifiers.

• Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).

  Examples: A name, signature, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

  Some personal information included in this category may overlap with other categories.

  Collected: Yes. Name, physical characteristics (height and weight), and information You choose to enter about injuries.

• Category C: Protected classification characteristics under California or federal law.

  Examples: Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

  Collected: Yes. Age (from date of birth) and sex, which We use to calculate Your calorie needs.

• Category D: Commercial information.

  Examples: Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

  Collected: Yes. Your subscription and purchase history with Us.

• Category E: Biometric information.

  Examples: Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

  Collected: Yes, limited to health and exercise data You enter (such as weight entries, food logs, and workouts). We do not collect fingerprints, faceprints, voiceprints, or other biometric identifiers.

• Category F: Internet or other similar network activity.

  Examples: Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.

  Collected: Yes. Diagnostics and in-app activity described in the "Usage Data" section, and food search terms.

• Category G: Geolocation data.

  Examples: Approximate physical location, physical location or movements.

  Collected: No.

• Category H: Sensory data.

  Examples: Audio, electronic, visual, thermal, olfactory, or similar information.

  Collected: Yes. With Your prior permission, We collect pictures and other visual information from Your Device's camera and photo library, and audio recordings from Your Device's microphone, in order to provide features of Our Application. We do not keep them on Our servers after they have been processed.

• Category I: Professional or employment-related information.

  Examples: Current or past job history or performance evaluations.

  Collected: No.

• Category J: Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).

  Examples: Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.

  Collected: No.

• Category K: Inferences drawn from other personal information.

  Examples: A profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

  Collected: Yes, limited to the calorie needs, macro targets, check-ins, and training recommendations We calculate to provide the Service to You.

• Category L: Sensitive personal information.

  Examples: Government-issued identifying numbers; a Consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; genetic data; neural data; precise geolocation; racial or ethnic origin; religious or philosophical beliefs; union membership; the contents of mail, email, and text messages (unless the Business is the intended recipient); biometric data; health data; and sexual orientation or sex life.

  Collected: Yes. Health data, such as weight, body measurements, nutrition, workouts, and information You enter about injuries. We use it only to provide the Service to You.

Under CCPA/CPRA, Personal Information does not include:

• Publicly available information, meaning: information lawfully made available from federal, state, or local government records; information that the Business has a reasonable basis to believe is lawfully made available to the general public by the Consumer or from widely distributed media; or information made available by a person to whom the Consumer has disclosed it, unless the Consumer restricted the information to a specific audience
• Deidentified or aggregated consumer information
• Information excluded from the CCPA/CPRA's scope, such as:
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data
  • Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994

Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from You. For example, from the information You enter in onboarding and in the Application, from preferences You express or provide through Our Service, and from photos, recordings, and text You submit for analysis.
• Indirectly from You. For example, from observing Your activity on Our Service, and from the figures We calculate from the information You enter.
• Automatically from You. For example, through the diagnostics Our Service Providers collect as You use the Application.
• From Third-Party Social Media Services. For example, Apple and Google when You sign in.
• From Service Providers. For example, Apple, Google, and RevenueCat when You purchase or renew a subscription.

Use of Personal Information

We may use or disclose Personal Information We collect for "business purposes" or "commercial purposes" (as defined under the CCPA/CPRA), which may include the following examples:

• To operate Our Service and provide You with Our Service.
• To provide You with support and to respond to Your inquiries, including to investigate and address Your concerns and monitor and improve Our Service.
• To fulfill or meet the reason You provided the information. For example, if You share Your contact information to ask a question about Our Service, We will use that personal information to respond to Your inquiry.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to You when collecting Your personal information or as otherwise set forth in the CCPA/CPRA.
• For internal administrative and auditing purposes.
• To detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, including, when necessary, to prosecute those responsible for such activities.
• Other purposes consistent with the context in which the information was collected, or as otherwise disclosed to You at the time of collection.

Please note that the examples provided above are illustrative and not intended to be exhaustive. For more details on how We use this information, please refer to the "Use of Your Personal Data" section.

If We decide to collect additional categories of Personal Information or use the Personal Information We collected for materially different, unrelated, or incompatible purposes, We will update this Privacy Policy.

Disclosure of Personal Information

We may use or disclose and may have used or disclosed in the last twelve (12) months the following categories of Personal Information for business or commercial purposes:

• Category A: Identifiers
• Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
• Category C: Protected classification characteristics under California or federal law
• Category D: Commercial information
• Category E: Biometric information
• Category F: Internet or other similar network activity
• Category H: Sensory data
• Category K: Inferences drawn from other personal information
• Category L: Sensitive personal information

The categories listed above are those defined in the CCPA/CPRA. Listing a category does not mean that every type of information it describes was in fact disclosed. It means only that, to the best of Our knowledge, some information within that category may be, or may have been, disclosed.

When We disclose Personal Information to a Service Provider or contractor for a business purpose, We enter into a contract that describes the purpose, requires the recipient to keep that Personal Information confidential, and prohibits the recipient from using it for any purpose other than the limited and specified purposes stated in the contract, consistent with the CCPA/CPRA.

Categories of Recipients to Whom We Disclose Personal Information

We may disclose, and may have disclosed in the preceding twelve (12) months, the categories of Personal Information identified below to the following categories of recipients for the business purposes described in this Privacy Policy:

• Category A: Identifiers — Service Providers (hosting, authentication, and error monitoring), and third-party vendors to whom You or Your agents authorize Us to disclose Personal Information in connection with products or services We provide to You.
• Category B: Personal information categories listed in the California Customer Records statute — Service Providers (hosting and AI providers), and third-party vendors to whom You or Your agents authorize Us to disclose Personal Information in connection with products or services We provide to You.
• Category C: Protected classification characteristics — Service Providers (hosting).
• Category D: Commercial information — Payment processors (Apple and Google) and Service Providers (subscription management and hosting).
• Category E: Biometric information — Service Providers (hosting and AI providers).
• Category F: Internet or other similar network activity — Service Providers (hosting and error monitoring).
• Category H: Sensory data — Service Providers (hosting and AI providers).
• Category K: Inferences drawn from other personal information — Service Providers (hosting and AI providers).
• Category L: Sensitive personal information — Service Providers (hosting, AI providers, and error monitoring).

Sale or Sharing of Personal Information

As defined in the CCPA/CPRA, "sell" and "sale" mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer's personal information by the Business to a third party for valuable consideration. This means that We may have received some kind of benefit in return for sharing personal information, but not necessarily a monetary benefit.

As defined in the CCPA/CPRA, "share" and "sharing" mean disclosing, making available, or otherwise communicating a Consumer's personal information by the Business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.

We do not sell or share Personal Information as those terms are defined in the CCPA/CPRA, and We have not done so in the preceding twelve (12) months. This includes sensitive Personal Information and the Personal Information of Consumers under 18 years of age. We do not use advertising or analytics vendors that use Your information for their own purposes, and We do not place advertising cookies, tags, or pixels on the Service.

Retention of Personal Information

We retain California residents' Personal Information for as long as reasonably necessary to achieve the purposes described in this Privacy Policy (including the purposes disclosed in this CCPA/CPRA notice), taking into account: (i) how long We need the information to provide and maintain the Service and Your Account; (ii) whether You have requested deletion (subject to applicable exceptions); (iii) Our legal, tax, accounting, and regulatory obligations; (iv) security, fraud prevention, and abuse monitoring needs; and (v) the time periods needed to resolve disputes and enforce Our agreements.

Specific retention periods for major data categories are described in the "Retention of Your Personal Data" section of Our Privacy Policy, and We may retain certain information longer where required or permitted by law (for example, to comply with recordkeeping obligations or to establish, exercise, or defend legal claims).

Personal Information of Minors Under 18 Years of Age

The Service is for people 18 and older. We do not knowingly collect personal information from minors under the age of 18 through Our Service, although certain third-party websites that We link to may do so. We ask for Your date of birth when You set up Your Account, and You cannot continue if You are under 18. These third-party websites have their own terms of use and privacy policies and We encourage parents and legal guardians to monitor their children's Internet usage and instruct their children to never provide information on other websites without their permission.

We do not sell or share the Personal Information of any Consumer, including Consumers We actually know are less than 18 years of age. Because We do not knowingly collect Personal Information from anyone under 18, We do not seek affirmative authorization (the "right to opt-in") from parents or guardians to sell it.

If You have reason to believe that a minor under the age of 18 has provided Us with personal information, please contact Us with sufficient detail to enable Us to delete that information. If We learn that an Account belongs to someone under 18, We will delete it.

Your Rights under the CCPA/CPRA

The CCPA/CPRA provides California residents with specific rights regarding their personal information. If You are a resident of California, You have the following rights:

• The right to notice. You have the right to be notified which categories of Personal Information are being collected and the purposes for which the Personal Information is being used.
• The right to know/access. Under CCPA/CPRA, You have the right to request that We disclose information to You about Our collection, use, sale, disclosure for business purposes and sharing of personal information. Once We receive and confirm Your request, We will disclose to You:
  • The categories of personal information We collected about You
  • The categories of sources for the personal information We collected about You
  • Our business or commercial purposes for collecting or selling that personal information
  • The categories of third parties with whom We share that personal information
  • The specific pieces of personal information We collected about You
  • If We sold Your Personal Information or disclosed Your Personal Information for a business purpose, We will disclose to You:
    • The categories of personal information sold
    • The categories of personal information disclosed
• The right to say no to the sale or sharing of Personal Information (opt-out). You have the right to direct Us to not sell Your personal information. We do not sell or share Personal Information. See the "Do Not Sell or Share My Personal Information" section or contact Us.
• The right to correct Personal Information. You have the right to correct or rectify any inaccurate personal information about You that We collected. Once We receive and confirm Your request, We will use commercially reasonable efforts to correct (and direct Our Service Providers to correct) Your personal information, unless an exception applies.
• The right to limit use and disclosure of sensitive Personal Information. You have the right to request to limit the use or disclosure of certain sensitive personal information We collected about You, unless an exception applies. To submit a request, please see the "Limit the Use or Disclosure of My Sensitive Personal Information" section or contact Us.
• The right to delete Personal Information. You have the right to request the deletion of Your Personal Information under certain circumstances, subject to certain exceptions. The quickest way is Profile > Delete Account in the Application. Once We receive and confirm Your request, We will delete (and direct Our Service Providers to delete) Your Personal Information from Our records, unless an exception applies. We may deny Your deletion request if retaining the information is necessary for Us or Our Service Providers to:
  • Complete the transaction for which We collected the Personal Information, provide a good or service that You requested, take actions reasonably anticipated within the context of Our ongoing business relationship with You, or otherwise perform Our contract with You.
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
  • Debug products to identify and repair errors that impair existing intended functionality.
  • Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
  • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.).
  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if You previously provided informed consent.
  • Enable solely internal uses that are reasonably aligned with consumer expectations based on Your relationship with Us.
  • Comply with a legal obligation.
  • Make other internal and lawful uses of that information that are compatible with the context in which You provided it.
• The right not to be discriminated against. You have the right not to be discriminated against for exercising any of Your consumer rights, including by:
  • Denying goods or services to You
  • Charging different prices or rates for goods or services, including the use of discounts or other benefits or imposing penalties
  • Providing a different level or quality of goods or services to You
  • Suggesting that You will receive a different price or rate for goods or services or a different level or quality of goods or services

Exercising Your CCPA/CPRA Data Protection Rights

Please see the "Do Not Sell or Share My Personal Information" section and "Limit the Use or Disclosure of My Sensitive Personal Information" section for more information on how to opt out and limit the use of sensitive information collected.

Additionally, in order to exercise any of Your rights under the CCPA/CPRA, and if You are a California resident, You can contact Us:

• By email: privacy@rungfit.com
• By mail: CLZ Labs LLC, 1401 21st ST, STE R, Sacramento, CA 95811, USA

We may verify Your identity before responding to requests to know, delete, or correct Personal Information, as permitted or required by applicable law. We will not require You to submit a verifiable consumer request to opt out of the sale or sharing of Personal Information or to limit the use or disclosure of Sensitive Personal Information. For those requests, We may ask only for information reasonably necessary to identify the Personal Information to which the request applies and process the request.

Only You or an authorized agent acting on Your behalf may make a verifiable request relating to Your Personal Information.

Your request to Us must:

• Provide sufficient information that allows Us to reasonably verify You are the person about whom We collected Personal Information or an authorized representative
• Describe Your request with sufficient detail that allows Us to properly understand, evaluate, and respond to it

We cannot respond to Your request or provide You with the required information if We cannot:

• Verify Your identity or authority to make the request; and
• Confirm that the personal information relates to You

For example, We may ask You to reply from the email address associated with Your Account.

No later than 10 business days after receiving a request to know, delete, or correct, We will confirm receipt and provide general information about how We will process and verify the request and when You should expect a response, unless We have already granted or denied the request. We will respond no later than 45 calendar days after receipt. If reasonably necessary, We may extend the response period once by an additional 45 calendar days. If We do, We will notify You during the initial 45-day period and explain the reason for the extension.

Unless You request a longer period, Our response to a request to know will cover the preceding 12 months. You may request information collected on or after January 1, 2022, for a longer period, unless providing it is impossible or requires disproportionate effort. We are not required to retain Personal Information for any specific period.

For data portability requests, We will select a format to provide Your personal information that is readily usable and should allow You to transmit the information from one entity to another entity without hindrance.

Appeals. If We decline Your request, You can appeal by emailing privacy@rungfit.com with "APPEAL" in the subject line. We will respond to Your appeal within the time required by the law where You live. If We deny Your appeal, You may contact Your state attorney general.

Do Not Sell or Share My Personal Information

You have the right to opt out of the sale and sharing of Your Personal Information. We do not sell or share Personal Information, so there is nothing to opt out of, and We do not display a "Do Not Sell or Share My Personal Information" link. If Our practices change, We will update this Privacy Policy and provide a way to opt out before any sale or sharing begins.

Opt-Out Preference Signals (Global Privacy Control)

Our Service recognizes and honors opt-out preference signals, such as the Global Privacy Control (GPC), as required by the CCPA/CPRA. If Your browser or browser extension transmits a legally recognized opt-out preference signal, We will treat it as a valid request to opt out of the sale and sharing of Personal Information linked to that browser or device and, where We can reasonably associate the signal with You, to Your Account. You may need to enable the signal separately on each browser and device that You use.

Mobile Devices

Your mobile device may give You the ability to opt out of the use of information about the apps You use in order to serve You ads that are targeted to Your interests:

• "Opt out of Interest-Based Ads" or "Opt out of Ads Personalization" on Android devices
• "Limit Ad Tracking" or "Allow Apps to Request to Track" on iOS devices

The Application does not request permission to track You across other companies' apps and websites, and does not collect location information.

Limit the Use or Disclosure of My Sensitive Personal Information

We do not collect or use sensitive Personal Information for purposes other than those specified in the CCPA/CPRA and its implementing regulations, and We do not collect or process sensitive Personal Information for the purpose of inferring characteristics about consumers. We use the health data You enter only to provide the Service You request. Accordingly, We are not required to provide, and do not provide, a method for submitting requests to limit the use or disclosure of sensitive Personal Information. If Our practices change, We will update this Privacy Policy and provide the required means to exercise this right.

"Do Not Track" Policy as Required by California Online Privacy Protection Act (CalOPPA)

Our Service does not respond to Do Not Track signals. Because We do not track You across other websites or apps, a Do Not Track signal would not change how the Service handles Your information.

However, some third-party websites do keep track of Your browsing activities. If You are visiting such websites, You can set Your preferences in Your web browser to inform websites that You do not want to be tracked. You can enable or disable DNT by visiting the preferences or settings page of Your web browser.

Your California Privacy Rights (California's Shine the Light law)

Under California Civil Code § 1798.83 (California's Shine the Light law), California residents with an established business relationship with Us can request information once a year about sharing their Personal Data with third parties for the third parties' direct marketing purposes. We do not share Personal Data with third parties for their direct marketing purposes.

If You would like to make such a request, or to ask that We not disclose Your Personal Information to third parties for their direct marketing purposes, please submit Your request in writing using the contact information provided in the "Contact Us" section of this Privacy Policy.

California Privacy Rights for Minor Users (California Business and Professions Code Section 22581)

California Business and Professions Code Section 22581 allows California residents under the age of 18 who are registered users of online sites, services or applications to request and obtain removal of content or information they have publicly posted.

The Service is not available to anyone under 18 and does not allow public posting. If You believe a minor has an Account, You can contact Us using the contact information provided below, and include the email address associated with the Account, and We will delete it.

Be aware that Your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

Children's and Minors' Privacy

The Service is not directed to, and We do not knowingly collect Personal Information from, anyone under the age of 18. We ask for Your date of birth when You set up Your Account, and You cannot continue if You are under 18.

If You are a parent or guardian and You believe Your child has provided Us with Personal Information, please contact Us. If We become aware that We have collected Personal Information from anyone under the age of 18, We will take steps to remove that information from Our servers as soon as reasonably possible.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third-party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy. If We want to collect new categories of health information, or use or share it for a new purpose, We will ask for Your consent first where the law requires it.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If You have any questions about this Privacy Policy, You can contact Us:

• By email: privacy@rungfit.com
• By mail: CLZ Labs LLC, 1401 21st ST, STE R, Sacramento, CA 95811, USA