← Rally
Privacy Policy
Last updated: 25 September 2026
This document describes, factually, what Rally collects today. It has not been
reviewed by a lawyer — before public launch, have it checked against Apple/Google
store requirements and applicable privacy law (e.g. Australian Privacy Act) for
your jurisdiction.
What we collect
- Account info: email address (used for sign-in), display name, username.
- Profile info: sports and interests you select, per-sport proficiency level, gender, avatar photo.
- Location: used to centre the map and detect your home suburb/city. We do not store
continuous or background location — only what's needed when you open the app or set your home area.
- Content you create: rallies, squads, chat messages (direct and squad), photos/media shared in chat.
- Usage & device info: device push-notification token (to deliver notifications), basic
app diagnostics if crash reporting is enabled.
- Usage analytics: information about how you use Rally — for example which screens you visit,
which buttons you tap, which sports filters you select, which parks you view, when you create or join a
rally, and whether the app was online or offline at the time. This is event data only: we never collect the
content of your messages as part of analytics, and we never collect your precise location as part of
analytics (only the city your account already uses for maps). Events are linked to your account ID.
How we use it
To run the core features of Rally: showing you nearby parks and games, letting you create and join rallies,
connecting you with squads and friends, and delivering chat messages and notifications. We also use usage
analytics (see above) to understand which features work, fix problems, and decide what to improve —
aggregated, non-identifying activity (such as how many people viewed a park in a given week) may be stored on
our servers indefinitely. The underlying raw events we store ourselves are deleted after 90 days. Our
analytics service provider (PostHog, see below) separately retains a copy of raw event data for up to 12
months, or deletes it immediately if you delete your account.
Third parties we share data with
- Supabase — our database and authentication provider. All app data is stored here.
- Google Maps — powers the map and location display.
- Firebase Cloud Messaging — delivers push notifications only (device push token). We do not
use Firebase Analytics or Firestore.
- Cloudflare Turnstile — verifies you're human during sign-up, without tracking you across
other sites. See Cloudflare's Turnstile Privacy Addendum:
[insert exact link copied from the Turnstile widget setup screen in the Cloudflare dashboard].
- Resend — sends transactional emails (e.g. account confirmation).
- PostHog — product/usage analytics, acting as our service provider. PostHog does not use
your data for its own purposes or for advertising. Data is hosted in the United States.
- Sentry — crash and performance error reporting, acting as our service provider.
What we don't do
- We never sell your data.
- We do not read or store the content of your chat messages for any purpose beyond delivering them.
- Location precision is never increased or sold beyond what's needed for map/hub features described above.
Your controls
You can set your profile to private, control what's visible to non-friends, mute or block other users, and
delete your account at any time from Settings — see Delete Your Account for the
exact steps, what gets deleted, and what to do if you no longer have the app installed. Deleting your account
removes your profile and associated data, subject to any rallies you're actively hosting being handed off or
cancelled first. Usage analytics and crash reports cannot be disabled — they're on for every account and are
required to keep the app working and to help us understand which features to improve, subject to the limits
described above (never message content, never precise location).
Contact
Questions about this policy: support@rally-up.app