ICXC NYKA LLC – NYKA Fitness Application

Effective Date: 06/11/2026
Last Updated: 06/11/2026

1. Introduction and Scope

1.1 This Privacy Policy (“Policy”) describes how ICXC NYKA LLC (“Company,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal information when you access or use the NYKA mobile application (“App”) and any related services, features, or content (collectively, the “Services”).

1.2 By downloading, registering for, or using the Services, you acknowledge and agree to the data practices described in this Policy. If you do not agree, please do not use the Services.

1.3 This Policy applies to all users of the Services, including those who subscribe to premium features, join the Founders Club, or use free portions of the App. It does not apply to third‑party websites, services, or applications that may be linked from the App.

1.4 We are committed to protecting your privacy and are designed to comply with applicable U.S. federal and state privacy laws. Because the NYKA App and Services are currently available only to users in the United States, this Policy is tailored to U.S.-based users and complies with:

• The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA/CPRA”) to the extent it applies to California residents;

• The Federal Trade Commission’s Health Breach Notification Rule (16 C.F.R. Part 318), which applies to our handling of unsecured individually identifiable health information (including fitness, injury, and reproductive health data collected via the App);

• Other relevant U.S. laws, such as the Children’s Online Privacy Protection Act (“COPPA”) and state-specific data breach notification laws.

To the extent any future international users are added, we will update this Policy and comply with additional applicable requirements. No jurisdiction-specific language for non-U.S. users is included at this time.

2. Information We Collect

We collect the following categories of personal information from and about you.

2.1 Personal Identifiers and Account Information

• Full name (first and last)

• Nickname (optional, for display)

• Email address

• Password (stored in encrypted, hashed form)

• Age range (e.g., 18–24, 25–34, etc.)

• Account creation and modification timestamps

2.2 Fitness and Health‑Related Information (Sensitive Personal Information)

This category constitutes sensitive personal information under CCPA/CPRA and other state laws. We collect it solely with your affirmative input to personalize workout plans and promote safer exercise.

• Workout preferences: Selected fitness goals (e.g., strength, weight loss, endurance), target muscle groups, experience level (beginner, intermediate, advanced), days available to work out, and available equipment.

• Physical limitations: Any pain, injuries (e.g., lower back pain, knee injury), or physical limitations you voluntarily disclose.

• Female reproductive states (for users who identify as female; multiple‑choice selection): Not Pregnant, Pregnant, Breastfeeding, Postpartum (with timing if provided), Perimenopausal/Menopausal.

• Exercise response data: Workout completion status, time spent exercising, weights lifted, repetitions performed, progress tracking metrics (e.g., personal records, trends).

2.3 Motivational Preferences

• Selected motivational style: Gentle, Encouraging, Energetic, or Roasting.

• Note: Selection of the Roasting style requires explicit opt‑in and acknowledgment as described in our Terms & Conditions (Section 5). Roasting‑style messages may contain sarcastic, blunt, or humorous language.

2.4 Subscription and Payment Information

• Subscription plan type (monthly or annual or founders club a one time fee)

• Start date, renewal status, and cancellation history

• Payment details: All payment processing (e.g., credit/debit card, digital wallet) is handled by our third‑party payment processor (e.g., Stripe, Apple Pay, Google Pay). We do not store full payment card numbers, CVV codes, or expiration dates. We may retain the last four digits of your card, card type, and billing zip code for fraud prevention and customer support.

2.5 Merchandise Delivery Information

• Physical mailing address (street address, city, state, ZIP code) – collected only from eligible active paying subscribers entitled to periodic merchandise rewards. Merchandise may be provided to active subscribers approximately every three months of consistent, non-paused usage. For Founders Club members, rewards are limited to the first 12 months of membership (up to four rewards total). This information is used solely for shipping purposes and is retained no longer than necessary to fulfill the reward and comply with record-keeping obligations.

2.6 Technical and Usage Data

• IP address (collected automatically)

• Device identifiers (e.g., IDFA, Android ID, or advertising ID – subject to your device permissions)

• Operating system and version

• App version and language settings

• App usage data: screens visited, features used, session duration, crash logs, and performance data

• Push notification preferences and interaction data (e.g., whether you opened a reminder)

• Workout reminders schedule and acknowledgement

2.7 Information Collected Automatically via Cookies and Similar Technologies

• We may use local storage, in‑app tracking, and similar technologies to remember your preferences, enable authentication, and analyze usage patterns. We do not use third‑party advertising cookies or trackers for cross‑site behavioral advertising.

2.8 Children’s Information

• The Services are intended for individuals aged 18 years or older. We do not knowingly collect personal information from children under 18. If we learn that a child under 18 has provided us with personal information, we will delete it immediately. Parents or guardians who believe we may have collected such information should contact us at the address in Section 10.

3. How We Use Your Information

We use your personal information only for legitimate business purposes as described below. If we intend to use your information for a materially different purpose, we will obtain your consent.

3.1 Account and Service Delivery

• Create, authenticate, and manage your account

• Communicate with you regarding account status, service updates, or support inquiries

• Provide customer support and respond to your requests

3.2 AI‑Driven Workout Personalization

• Generate and deliver personalized workout plans using AI based on your goals, experience level, equipment, disclosed injuries or pain, exercise response data, and female reproductive state (where provided).

• Adjust exercise recommendations in an effort to avoid movements that may be contraindicated during pregnancy, postpartum recovery, or with specific injuries.

Important: AI-generated workouts and all related fitness content are provided for general informational and wellness purposes only. They do not constitute medical advice, diagnosis, treatment, or a substitute for professional medical or healthcare guidance. The Company is not a healthcare provider. All workouts are used at your own risk. You are strongly encouraged to consult a qualified healthcare professional before beginning any new exercise program, particularly if you are pregnant, breastfeeding, postpartum, perimenopausal/menopausal, or have any pain, injury, or pre-existing medical condition. We do not guarantee the suitability, safety, or effectiveness of any workout for your individual circumstances, and you assume all risks of injury, illness, or other harm associated with their use. AI-generated outputs may contain errors or omissions.

3.3 Motivational Messaging

• Deliver motivational push notifications and in‑app messages consistent with your selected style (including Roasting style, if opted in)

3.4 Subscription and Rewards Management

• Process subscription payments and manage renewals/cancellations

• Administer Founders Club membership and fulfill merchandise rewards (up to four rewards during the first 12 months of consistent, non‑paused subscription usage)

• Send shipping confirmations and tracking information

3.5 Push Notifications and Reminders

• Send scheduled workout reminders, motivational messages, and service announcements

• You may opt out of push notifications at any time through your device settings or the App’s settings menu

3.6 Service Improvement and Analytics

• Aggregate and anonymize data to analyze user behavior, feature popularity, and performance

• Identify and fix bugs, crashes, or technical issues

• Improve AI workout algorithms and motivational messaging effectiveness

3.7 Legal Compliance and Security

• Comply with applicable laws, regulations, legal processes, or government requests

• Detect, investigate, and prevent fraud, unauthorized access, or other unlawful activity

• Enforce our Terms & Conditions and protect the rights, property, or safety of the Company, our users, or others

3.8 No Sale of Personal Information

• We do not sell your personal information as defined by the CCPA/CPRA or any other applicable law. We do not share your information with third parties for their own direct marketing purposes without your explicit consent.

4. Sharing and Disclosure of Information

We share your personal information only in the following limited circumstances.

4.1 Service Providers (Data Processors)

We engage trusted third‑party companies to perform services on our behalf. These providers have access to your information only as necessary to perform their functions and are contractually bound to maintain confidentiality and security. Categories of service providers include:

• Payment processor (e.g., Stripe) – receives payment information but not health data.

• Cloud hosting and database provider (e.g., AWS, Google Cloud) – hosts all user data.

• AI workout engine – processes user health/fitness data to generate workout plans.

• Push notification service – receives device tokens to send messages.

• Shipping carrier (e.g., USPS, UPS, FedEx) – receives mailing address only for merchandise delivery.

• Customer support platform – may access account information to resolve tickets.

4.2 Legal Compliance and Safety

We may disclose your information if we believe in good faith that such disclosure is necessary to:

• Comply with a subpoena, court order, or other legal process

• Respond to lawful requests from government or law enforcement authorities

• Protect the rights, property, or personal safety of the Company, our users, or the public

• Enforce our Terms & Conditions or investigate potential violations

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, sale of all or substantially all of our assets, bankruptcy, or similar transaction, your personal information may be transferred as part of that transaction. We will notify you via the App or email before your information becomes subject to a different privacy policy.

4.4 With Your Explicit Consent

We will share your information with any third party outside the scope of this Policy only after obtaining your explicit affirmative consent.

4.5 Aggregated or De‑Identified Data

We may share aggregated, anonymized, or de‑identified data (which cannot reasonably identify you) for research, marketing, or other business purposes without restriction.

5. Data Security

5.1 We implement reasonable and appropriate administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of your personal information, including:

• Encryption of sensitive health data in transit (TLS 1.2+) and at rest (AES‑256)

• Access controls limiting employee and contractor access to personal information on a need‑to‑know basis

• Regular security assessments and vulnerability scans

• Secure authentication mechanisms (e.g., hashed passwords with salt)

5.2 No security system is infallible. While we strive to protect your information, we cannot guarantee absolute security against all threats, including advanced persistent attacks or zero‑day vulnerabilities.

5.3 In the event of a data breach involving your personal health records (as defined under the FTC Health Breach Notification Rule), we will:

• Conduct a thorough investigation

• Notify affected users without unreasonable delay, and in any event within 60 days of discovery, unless law enforcement requests a delay

• Provide notice via email and/or a prominent in‑app notification, including a description of the breach, the types of information involved, and steps you can take to protect yourself

5.4 You are responsible for maintaining the confidentiality of your account credentials. Please notify us immediately of any unauthorized use of your account.

6. Data Retention

6.1 We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting obligations.

6.2 Specific retention periods:

• Account information: Retained for the duration of your active account, plus a reasonable period (up to 12 months) after account deletion to handle post‑termination support or legal claims, unless you request earlier deletion.

• Workout and health data: Retained while your account is active to provide personalized recommendations and track progress. You may delete this data at any time via the App. After account deletion, health data is permanently removed within 90 days, except where aggregated or anonymized.

• Payment and transaction records: Retained for 7 years to comply with tax and accounting laws.

• Merchandise delivery addresses: Deleted within 90 days after the final reward is shipped.

• Push notification tokens: Retained until you opt out or uninstall the App.

6.3 Even after account deletion, we may retain de‑identified or aggregated data for research, analytics, or service improvement purposes.

7. Your Rights and Choices

Depending on your state of residence (particularly California), you may have certain rights regarding your personal information. We do not discriminate against you for exercising any of these rights.

7.1 Rights for All Users (Regardless of Location)

• Access and Portability: You may request a copy of the personal information we hold about you.

• Correction: You may update or correct inaccurate information through the App settings or by contacting us.

• Deletion: You may delete your account and most associated data via the App. For other deletion requests, contact us.

• Opt‑out of Push Notifications: You may disable push notifications in your device settings or App settings.

• Account Deletion: You may permanently delete your account at any time from within the App (Settings → Delete Account). Deletion is irreversible.

7.2 Additional Rights for California Residents (Under CCPA/CPRA)

If you are a California resident, you have the following rights, subject to certain exceptions:

• Right to Know: You may request, up to twice per 12‑month period:

  • The categories and specific pieces of personal information we have collected about you

  • The categories of sources from which we collected the information

  • The business or commercial purpose for collecting or sharing the information

  • The categories of third parties with whom we share the information

• Right to Delete: You may request deletion of your personal information, subject to exceptions (e.g., to complete a transaction or comply with legal obligation).

• Right to Correct: You may request correction of inaccurate personal information.

• Right to Limit Use of Sensitive Personal Information: You may request that we limit our use of your sensitive personal information (e.g., health data) to only what is necessary to provide the Services. We already limit such use as described in Section 3.

• Right to Opt‑Out of Sale/Sharing: We do not sell your personal information or share it for cross‑context behavioral advertising, so no opt‑out is required. If this changes, we will update this Policy and provide a “Do Not Sell or Share My Personal Information” link.

• Right to Non‑Discrimination: We will not deny services, charge different prices, or provide a different level of service for exercising your rights.

How to Exercise California Rights: See Section 9 (Contact Us). We will verify your identity using information you provide (e.g., email address, account details) before responding. You may also designate an authorized agent to make a request on your behalf; the agent must provide written permission and we may require you to verify your identity directly.

Response Timeline: We will respond to verifiable requests within 45 days, extendable by an additional 45 days if reasonably necessary, with notice.

7.3 Rights for Residents of Other States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy laws may have similar rights. We will honor requests from all users to the extent required by applicable law. Please contact us as described below.

7.4 How to Exercise Your Rights

• Email: support@nykaapp.com with the subject line “Privacy Request”

• Mail: 100 Willow Ln, B214, Willow Springs, IL, 60480 Attn: Privacy Officer

• Through the App: Certain rights (access, correction, deletion) can be exercised directly via account settings.

We may ask for additional information to verify your identity before processing your request. We will not use verification information for any other purpose.

8. Third‑Party Links and Services

8.1 The App may contain links to third‑party websites, plugins, or services (e.g., social media sharing, payment gateways). Clicking those links or enabling those connections may allow third parties to collect or share data about you.

8.2 We do not control these third parties and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website or service you visit.

9. Changes to This Privacy Policy

9.1 We reserve the right to update or modify this Policy at any time. If we make material changes (e.g., to the categories of information we collect, how we use it, or your rights), we will provide prominent notice:

• Via email to the address associated with your account; and/or

• Via an in‑app notification or banner the next time you open the App.

9.2 The “Last Updated” date at the top of this Policy will reflect the most recent changes. Your continued use of the Services after any modification constitutes your acceptance of the revised Policy. If you do not agree to the changes, you should delete your account and stop using the Services.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

ICXC NYKA LLC
Attn: Privacy Officer
100 Willow Ln, B214, Willow Springs, IL, 60480
Email: support@nykaapp.com

For data breach or urgent security matters, please mark your email “URGENT – SECURITY” and use the same email address.

ACKNOWLEDGMENT
BY USING THE NYKA FITNESS APPLICATION AND SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THIS PRIVACY POLICY AND AGREE TO ITS TERMS.