Privacy Policy

Information we collect

We collect information you give us, information we collect automatically, and information we receive from third parties.

• Waitlist and contact details. When you join our access list or contact us, we collect your email address and any information you include in your message.
• Account information. To use certain features, we collect your phone number (for one-time-passcode verification by SMS) and may collect a name, email, and profile details you add.
• Purchase and billing information. When you buy a Ticket, our payment processor collects your payment card or payment-method details and billing information. We do not store full payment card numbers; we receive limited information such as a confirmation, the last four digits, and transaction details.
• Gameplay submissions and User Content. During an experience you may submit photos, videos, text, answers, and other content — including content submitted for verification of challenges. We describe how this is reviewed in Section 3.
• Event participation information. Depending on the experience, we may collect details you provide for logistics, eligibility, accessibility, dietary needs, or an emergency contact. If you voluntarily share health-related information (for example, to request an accommodation), we use it only for that purpose.
• Communications. Records of your correspondence and support requests with us.

• Usage and device data. Log data such as IP address, device and browser type, operating system, pages and screens viewed, referring URLs, and dates and times of access.
• Approximate location. We may infer general location from your IP address. Some experiences may use more precise location only with your permission and only as needed to run the game.
• Cookies and similar technologies. We and our providers use cookies, local storage, pixels, and similar technologies to operate the Services, remember preferences, measure performance, and — where applicable — support marketing. See Section 6.

• Payment processor. Confirmation and limited transaction data from Stripe.
• Social and advertising platforms. If you interact with our content or ads on platforms such as YouTube, TikTok, Instagram, or Facebook, we may receive limited analytics or engagement data from them.
• Travel advisor. If you choose to coordinate travel through an independent travel advisor we make available (for example, a Fora advisor), that advisor and its suppliers handle your travel booking information under their own privacy practices; we may receive limited confirmation that you are attending.

How we use information

We use personal information to:

• provide, operate, and improve the Services and run our events;
• create and secure your account and verify your identity by SMS one-time passcode;
• process Tickets, payments, refunds, and prizes, and prevent fraud;
• verify gameplay submissions and administer scoring and results;
• communicate with you about your account, purchases, and experiences, and respond to your requests;
• send marketing and updates where permitted, which you can opt out of (Section 7);
• personalize content and measure and improve performance and marketing;
• ensure safety and enforce our Terms, rules, and policies; and
• comply with law and protect our legal rights.

Where required by law, we rely on a lawful basis for processing, such as performing our contract with you, your consent, our legitimate interests in operating and securing the Services, or compliance with legal obligations.

Automated review of submissions

Some experiences use automated tools to help verify gameplay submissions — for example, checking whether a submitted photo or answer satisfies a challenge. To do this, submissions may be processed by third-party AI services (including Anthropic's Claude models) acting as our service provider under terms that restrict their use of the content to providing the service. Automated checks may be reviewed or overridden by our staff, and decisions about scoring, verification, and disqualification are made under our Event Rules (see the Terms of Use). We do not use these tools to make legally or similarly significant decisions about you outside of gameplay.

How we share information

We share personal information as follows:

• Service providers. With vendors that perform services for us under contract, including payment processing (Stripe), SMS and communications (Twilio), data storage and backend infrastructure (Supabase), hosting and deployment (Vercel or Hostinger), forms and productivity tools (Google), and AI verification (Anthropic). They may use the information only to provide services to us.
• Travel coordination. If you engage an independent travel advisor or book travel, your dealings with that advisor and travel suppliers are governed by their own privacy practices; theRushX is not responsible for them.
• Other participants and the public. Gameplay is social by nature; other participants may see your presence, team, and in-game activity. Experiences may be photographed, filmed, or streamed, and, as described in the Terms, content capturing your name, image, likeness, and statements may be used for documentary, promotional, and marketing purposes.
• Legal and safety. When we believe disclosure is necessary to comply with law or legal process, enforce our Terms, protect the rights, property, or safety of theRushX, our participants, or others, or in an emergency.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, information may be transferred subject to this Policy.
• With your consent. For any other purpose disclosed to you at the time.

We do not sell your personal information for money. If we use advertising or analytics technologies that share identifiers with platforms for cross-context behavioral advertising, some U.S. state laws may treat that as a "sale" or "sharing"; where they do, you can opt out as described in Section 11.

Third-party links and services

The Services may link to or rely on third-party websites and services. We do not control and are not responsible for the privacy practices of third parties. Review their policies before providing information to them.

Cookies and tracking technologies

We use cookies and similar technologies that are strictly necessary to run the Services, plus optional ones for preferences, analytics, and marketing. You can control cookies through your browser settings, though disabling some may affect functionality. Where required, we present a cookie banner or preference control, and we honor recognized opt-out signals (such as Global Privacy Control) where applicable.

Marketing and SMS communications

You can opt out of marketing emails at any time using the unsubscribe link in the email or by contacting us. We will still send you transactional messages about your account, purchases, and experiences.

By providing your phone number, you consent to receive service messages needed to operate the Services, such as verification codes; standard message and data rates may apply. We send marketing texts only with the consent required by law (including the Telephone Consumer Protection Act), and you can opt out of marketing texts by replying STOP or as described in the message. Opting out of marketing texts does not stop transactional messages such as verification codes.

Data retention

We keep personal information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements, after which we delete or de-identify it. Retention periods vary by the type of data and the purpose for which it was collected — for example, we keep transaction records as required by tax and accounting rules, and we may retain gameplay content used in marketing for longer where you have granted a license under the Terms.

Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials and your verifying phone number secure.

International data transfers

theRushX is based in the United States, and we and our providers store and process information in the United States and other countries. If you participate in an experience outside the United States or access the Services from another country, your information may be transferred to, stored in, and processed in the United States and other jurisdictions whose data-protection laws may differ from those where you live. Where required, we use appropriate safeguards for such transfers.

Your privacy rights

Depending on where you live, you may have rights regarding your personal information, and we honor these rights as required by applicable law.

You may ask us to access, correct, update, or delete your personal information, or to opt out of marketing, by contacting us at hello@therushx.com. We may need to verify your identity before acting on a request.

Subject to the law's requirements, you may have the right to: know and access the categories and specific pieces of personal information we collect, use, and disclose; correct inaccurate information; delete personal information; and opt out of any "sale" or "sharing" of personal information for cross-context behavioral advertising. You may also limit the use of sensitive personal information where applicable. We do not sell personal information for money. To opt out of any "sharing" for advertising, use the controls described in Section 6 or contact us. We will not discriminate against you for exercising your rights. You may use an authorized agent to submit a request. California's "Shine the Light" law also lets California residents request information about disclosures to third parties for their direct marketing.

Residents of states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, and others) may have similar rights to access, correct, delete, and obtain a copy of their information, and to opt out of targeted advertising, certain profiling, and the sale of personal information. You may also appeal a denied request as those laws allow.

Email hello@therushx.com with your request. We respond within the timeframes required by law.

Children's privacy

The Services are intended for adults. You must be at least 18 to use the Services, and we do not knowingly collect personal information from anyone under 18 (and never from children under 13 in violation of the Children's Online Privacy Protection Act). If you believe a minor has provided us personal information, contact us and we will delete it.

Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice. Your continued use of the Services after the changes take effect means you accept the updated Policy.