Privacy Policy

This policy explains how nxt (“we”, “us”) handles your personal information when you use the app. For privacy questions, or to exercise any of the rights below, write to hi@nxt-level.me.

We collect only what we need to coach you:

• Account info — your email address, and a name if you give one. Sign-in is handled via email codes or Google.
• What you tell Charly — your goals, daily actions, check-ins, to-dos, reflections, and the messages you exchange with the coach.
• Health-adjacent details you choose to share — e.g. weight, sleep, age, or notes about your wellbeing, if you enter them. You decide what to share.
• Strava activity — only if you connect Strava, in which case we sync the activities you authorise.
• Technical & usage data — basic logs needed to run the service securely and diagnose problems.

We use your information to:

• Run your coaching — generate Charly's replies, briefings, and check-ins.
• Keep track of your goals, actions, and progress across sessions.
• Send you account and coaching messages (e.g. the morning brief on Telegram).
• Keep the service secure, reliable, and working as intended.

We do notsell your personal information, and we don't use your private coaching content to advertise to you.

Where GDPR or UK GDPR applies, we rely on: performance of our contract with you (to provide the service); your consent (which you can withdraw at any time — including for any health-related information you choose to share); and our legitimate interests in keeping the service secure and improving it.

We use a small set of trusted providers to run nxt. They process your data on our behalf, under contract, only as needed to provide their part of the service:

• Anthropic— powers Charly. Your messages and relevant context are sent to Anthropic's API to generate replies.
• Supabase — database and authentication (where your account and content are stored).
• Vercel — hosting and serverless compute for the app.
• Telegram — delivers the chat channel, if you connect it.
• Google — if you choose Google sign-in.
• Strava — if you connect activity sync.
• Resend — sends transactional email such as sign-in codes.
• Stripe — payment processing, if you subscribe to a paid plan. Stripe receives your email and payment details; your card number never touches our servers. We store only your subscription status and a Stripe customer reference.

We may also disclose information if required by law, or to protect the rights and safety of users and the service.

Some of these providers operate outside your country (including the United States). Where we transfer personal data internationally, we rely on appropriate safeguards such as the providers' Standard Contractual Clauses.

We keep your information for as long as your account is active. When you delete your account, we delete the personal data associated with it, except where we're required to keep something for legal reasons. Short-lived operational records (such as security logs) are pruned automatically on a rolling basis.

Depending on where you live, you have rights over your data — including to access, correct, delete, or export it, and to withdraw consent or object to certain processing.

We use reasonable technical and organisational measures to protect your data, including encryption in transit and access controls. No system is perfectly secure, but we work to keep your information safe.

nxt uses only cookies and on-device storage that are strictly necessary to sign you in and run features you ask for. We do notuse analytics, advertising, or third-party tracking cookies — so there's nothing here that needs your consent, only this disclosure. What we store:

• Authentication cookies (via Supabase) — keep you securely signed in between visits. Clearing them, or signing out, ends your session.
• Strava connection cookies — a short-lived security token used only while you connect Strava, to protect the authorisation step. Set only if you start that flow.
• Functional local storage— small values kept in your browser to make the app behave, e.g. an unsent draft of a landing-page message, whether you've dismissed a prompt, and that you've seen this cookie notice. These never leave your device.

You can clear any of this at any time through your browser settings. If we ever add optional analytics, we'll ask for your consent first and keep it off by default until you opt in.

nxt is for adults (18+). We don't knowingly collect data from anyone under 18. If you believe a minor has used nxt, contact us and we'll remove the account.

We may update this policy as the product evolves. If we make material changes we'll update the date above and, where appropriate, notify you in the app.