● Rally

Privacy Policy

Last updated: 2026-09-12 · Effective: 2026-09-12

1. Introduction

Rally ("we", "us", or "our") provides a group scheduling service that helps you find times that work for everyone in your circle. This Privacy Policy explains what information we collect, how we use it, and what choices you have.

By using Rally, you agree to the practices described in this policy.

2. Information We Collect

2.1 Information you give us

Account info: email address and display name when you sign up (via Clerk).
Circle invitations: an owner may give us a recipient email to send and match a pending invitation. The recipient is not added automatically and chooses whether to accept or decline. Pending invitations expire after 30 days and may be cancelled by the owner.
User content: the circles you create, the events you schedule (titles, descriptions, organizer-entered locations, time slots), the availability responses you submit (your name, optional email or note, including an authenticated organizer response), an optional short-lived on-my-way status and one-time coarse ETA pin, your optional self-confirmation that your display name may appear in a Rally recap, and optional push-notification preferences/device token when you explicitly enable push.
Optional foreground location: only after you choose Share rough ETA, Rally accesses the current location once and geocodes the saved event place on-device. The API receives only a pin rounded to roughly 1 km plus a broad distance-based ETA band; raw precise coordinates and destination coordinates are not uploaded or stored by Rally, and there are no background or continuous location updates.

2.2 Information we collect automatically

App activity: anonymous events about which screens you view and which buttons you tap. They use a random analytics identifier, are not linked to your Rally account, and rotate after sign-out.
Diagnostics: logs and PostHog receive only bounded error classes, fixed operation/route labels, status, and random request IDs; they exclude raw dynamic URLs, error messages, stacks, provider payloads, and event/response content. Sentry receives exception messages and stack traces for API and mobile error debugging, but Rally does not deliberately attach account identity, request, response, server, or breadcrumb context and uses only fixed or templated route/navigation labels. Exception text emitted by a dependency may contain unexpected values.
Abuse prevention: for anonymous response requests, the API keeps a transient apparent network address with a fixed route category in process memory for only the active rate-limit window (up to one hour). It is not written to Rally’s application database, logs, or analytics. Dynamic URLs, event share tokens, response IDs, query strings, and request content are not part of this limiter key.
Device info: device model, operating system version, and app version.

2.3 What we do NOT collect

Your contacts, photos, microphone, background location, continuous location history, or raw precise GPS coordinates on Rally servers.
Advertising identifiers.
Data sold to advertisers or third-party data brokers (we do this for nobody).

3. How We Use Your Information

To provide the service: store your circles, pending recipient-controlled circle invitations, events, responses, optional time-boxed on-my-way status/coarse ETA, optional participant-controlled recap inclusion, and user-controlled push settings; ask the configured email provider to accept invitation and RSVP reminder emails for delivery. Provider acceptance does not confirm inbox delivery.
To authenticate you: via Clerk.
To improve the app: anonymous, non-profiled analytics and crash reports help us find and fix bugs. Rally does not deliberately attach your account ID, email, or name as PostHog or Sentry identity.
To prevent abuse: transiently limit anonymous requests without persisting their apparent network address or dynamic route.
To respond to you: when you contact us.

We do not use your information for advertising. We do not sell your data.

4. Third-Party Services

We share the minimum data necessary with the following service providers. Each named provider publishes its own privacy policy.

Service	Purpose	Data shared
Clerk	Authentication (sign-in, sign-up, account management)	Email, name, authentication tokens
Hosting provider (self-managed servers)	API runtime and database storage	All API traffic (request/response payloads), and all user content (circles, events, responses, optional coarse ETA, optional recap participation)
Resend	Transactional email (event invites, RSVP reminders, account deletion/restoration warnings)	Recipient email and the minimum content for that message; account lifecycle warnings contain only the deadline/state and no circle or event content
Apple / Google device location services	User-initiated foreground positioning and on-device geocoding	Current device location and organizer-entered place query, only after Share rough ETA is chosen
Apple MapKit / Google Maps SDK (in-app map)	Renders the map used to pick an event place while creating an event	Map view coordinates requested for display, and the chosen place coordinates. No background or continuous location.
Expo	Opt-in push notification delivery	Expo push token and privacy-minimized notification content
PostHog	Product analytics and API error monitoring	Anonymous product events with a random analytics identifier; no Rally account ID or profile fields; API error diagnostics
Sentry	API and mobile error monitoring, plus mobile performance monitoring	API and mobile exception messages and stack traces, app/device version, fixed or templated route/navigation context, status, and random request IDs. Rally does not attach account or profile fields; dependency exception text may contain unexpected values.

Rally's hosting infrastructure processes API traffic, including ordinary connection metadata, at the infrastructure boundary; the application-level limits above do not claim that hosting infrastructure receives no network metadata.

5. Data Safety Summary

The following table summarizes the data we collect. This is the same information you'll see in the Google Play "Data Safety" section.

Data type	Collected	Shared	Optional	User can delete?
Email address	Yes	Yes	No	Yes
Circle invitation recipient email	Yes	Yes	Yes	Yes
Display name	Yes	Yes	No	Yes
Circle names and colors	Yes	Yes	No	Yes
Circle membership	Yes	Yes	Yes	Yes
Event titles, descriptions, locations, time slots	Yes	Yes	No	Yes
Availability responses (name, optional email/note, authenticated organizer response)	Yes	Yes	No	Yes
Optional on-my-way status	Yes	Yes	Yes	Yes
One-time approximate ETA location	Yes	Yes	Yes	Yes
Event place coordinates chosen by the organizer	Yes	Yes	Yes	Yes
Optional self-confirmed recap attendance	Yes	Yes	Yes	Yes
Push notification preferences	Yes	No	Yes	Yes
Expo push token	Yes	Yes	Yes	Yes
Anonymous pages viewed and buttons tapped, not linked to your Rally account	Yes	No	No	No
Exception messages and stack traces; app/device version; fixed or templated operation/route labels; status and request IDs	Yes	No	No	No
Transient apparent network address	Yes	Yes	No	No
Device model, OS version, app version	Yes	No	Yes	No

6. Your Rights and Choices

Access: you can see all the data you've entered in the app.
Delete your account: go to Profile → Delete Account. Rally first confirms that every sign-in session is revoked, then schedules permanent deletion for exactly 30 days later. During that window your profile, reserved username, memberships, authenticated responses, recap participation, and derived milestones are hidden and can be restored only after a fresh sign-in plus a one-time recovery code sent to the reserved account email. Push tokens/preferences, invitations, notification delivery state, and day-of status/ETA are removed immediately and are not restored. A circle with other members transfers permanently to its longest-standing remaining member; a circle where you are the only member stays private during the window. Rally sends best-effort warning emails when deletion is scheduled and when an account is restored, without circle or event content; email failure does not block either transition.
Delete content: you can delete individual circles and events from the circle or event detail screen. Non-owner members can leave a circle; this removes their membership, current day-of status/ETA, and self-confirmed recap entries in that circle while circle-owned events and anonymous public-link responses remain. Owners can add or update their own authenticated availability while voting is open and remove it later as an explicit revocation. Clearing your on-my-way status immediately removes its rough ETA from member views. You can remove your own name from an ended Rally recap at any time; future recap views and shares update immediately, but copies people already shared cannot be recalled.
Manage push: Profile → Notifications controls all Rally push delivery and categories. Disabling push stops server delivery and removes every registered token for the account; system settings control OS permission.
Export: contact us at support@kazman.uk to request a copy of your data.

7. Data Retention

We keep active-account data for as long as the account is active. A deletion request has one stored deadline exactly 30 days later. The recovery deadline does not move if the scheduler runs late: restoration is refused at or after that exact time, and the bounded scheduler retries physical purge until both the Clerk identity and Rally account are gone. Anonymized analytics may be retained longer in aggregate form.

Pending circle invitations are removed when accepted, declined, cancelled, expired after 30 days, or immediately when the matching account requests deletion. A non-owner membership, authenticated response, and self-confirmed recap participation move out of live product views during the recovery window; surviving related circles/events restore those durable rows if the account is restored. On-my-way status and shared coarse ETA, push tokens/preferences, notification jobs/history, and invitations are removed immediately and never restored. Outside deletion requests, push tokens are removed when the current device is removed, on successful sign-out, when Expo reports the device unregistered, or when account-wide push is disabled. A sole-member circle is hidden from public links during recovery; a circle transferred to another member stays with its new owner even if the account returns. Anonymous rate-limit state exists only in API process memory for the active window (at most one hour); a deployment restart can remove it earlier.

8. Security

We take reasonable measures to protect your data:

Traffic between the Rally app and our API is encrypted with HTTPS.
Authentication is handled by Clerk, which meets industry security standards.
Database access requires credentials held only by Rally's own services.

No system is perfectly secure. If you discover a security issue, please email support@kazman.uk.

9. Eligibility and Children's Privacy

Rally is intended for adults aged 18 and over. Because Rally can share a live location and ETA with a meetup's members, we set the minimum age at 18 as the lowest legal surface for location sharing. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has provided us data, contact us at support@kazman.uk and we will delete it.

10. Changes to This Policy

We may update this policy from time to time. We will post the updated policy here and update the "Last updated" date. Material changes will be communicated through the app.

11. Contact

If you have any questions about this policy, contact us at support@kazman.uk.