● Rally

Privacy Policy

Last updated: 2026-10-21 · Effective: 2026-10-21

1. Introduction

Rally ("we", "us", or "our") provides a group scheduling service that helps you find times that work for everyone in your group. This Privacy Policy explains what information we collect, how we use it, and what choices you have.

By using Rally, you agree to the practices described in this policy.

2. Information We Collect

2.1 Information you give us

Account info: email address and display name when you sign up (via Clerk).
Gender (optional): only if you choose it in your profile. It decides whether an announcement meant for women or for men reaches you, is never shown to other people, and can be cleared at any time. Without it you receive every announcement.
Group invitations: an owner may give us a recipient email to send and match a pending invitation. The recipient is not added automatically and chooses whether to accept or decline. Pending invitations expire after 30 days and may be cancelled by the owner.
User content: the groups you create, the plans you schedule (titles, descriptions, organizer-entered locations, time slots), the availability responses you submit (your name, optional email or note, including an authenticated organizer response), an optional short-lived on-my-way status and one-time coarse ETA pin, your optional self-confirmation that your display name may appear in a Rally recap, and optional push-notification preferences/device token when you explicitly enable push.
Group chat: the messages you send to a group or plan chat, with their author and time, and your reactions. Only that group's members can read them. When the chat filter masks words or contact details, the original text, its author and the reason are kept in a moderation record that only the Rally owner can see. A report you file keeps you as reporter, your reason and the message. Typing status is relayed live and never stored. Messages, and their moderation and report records, are deleted when the group or plan is deleted, when the author's account is purged, or when a message is removed in moderation.
Optional foreground location: only after you choose Share rough ETA, Rally accesses the current location once and geocodes the saved plan place on-device. The API receives only a pin rounded to roughly 1 km plus a broad distance-based ETA band; this one-shot action does not start background or continuous location updates.
Optional live plan sharing: only after you tap I’m on my way, Rally updates your location, ETA, and arrival for that plan’s members. With your background permission it continues while your phone is locked or you use another app. ETA-only sends no position, Approximate rounds it to roughly 1 km, and Exact sends the current precise position. Only the latest position is kept, with optional battery/charging information and a place label no finer than your choice; no location history is stored. To draw road routes and road ETAs, positions shown on the live map are sent to Rally’s own routing service on Rally’s servers; routes are not stored. Stop, arrival, or plan expiry ends updates. Force-quitting or OS restrictions can interrupt delivery.
Optional circle location sharing: outside any meetup, you can share where you are with one circle for 1 hour, 4 hours, or until you stop; "until I stop" still ends after 24 hours. Your phone posts your latest position while Rally is in the foreground: Exact location sends your precise position, and Approximate area rounds it to roughly 1 km. Only the circle's current members see it. A member you have blocked is hidden from you, and blocking them does not hide your position from them. Rally keeps only the latest position, with optional battery/charging information and a place label; there is no location history. Stopping the share, or leaving or being removed from the circle, deletes it at once. When the window ends, the position stops being visible to the circle at once and the stored point is removed by a later cleanup pass.

2.2 Information we collect automatically

App activity: anonymous events about which screens you view and which buttons you tap. They use a random analytics identifier, are not linked to your Rally account, and rotate after sign-out.
Diagnostics: logs and PostHog receive only bounded error classes, fixed operation/route labels, status, and random request IDs; they exclude raw dynamic URLs, error messages, stacks, provider payloads, and plan/response content. Sentry receives exception messages and stack traces for API and mobile error debugging, but Rally does not deliberately attach account identity, request, response, server, or breadcrumb context and uses only fixed or templated route/navigation labels. Exception text emitted by a dependency may contain unexpected values.
Abuse prevention: for anonymous response requests, the API keeps a transient apparent network address with a fixed route category in process memory for only the active rate-limit window (up to one hour). It is not written to Rally’s application database, logs, or analytics. Dynamic URLs, plan share tokens, response IDs, query strings, and request content are not part of this limiter key.
Device info: device model, operating system version, and app version.

2.3 What we do NOT collect

Your contacts, photos, microphone, or continuous location history. Background location is accessed only for a plan share you explicitly start with permission.
Advertising identifiers.
Data sold to advertisers or third-party data brokers (we do this for nobody).

3. How We Use Your Information

To provide the service: store your groups, pending recipient-controlled group invitations, plans, responses, optional time-boxed on-my-way status/coarse ETA, joined live plan sharing, and optional time-boxed circle location sharing, optional participant-controlled recap inclusion, and user-controlled push settings; ask the configured email provider to accept invitation and RSVP reminder emails for delivery. Provider acceptance does not confirm inbox delivery.
To authenticate you: via Clerk.
To improve the app: anonymous, non-profiled analytics and crash reports help us find and fix bugs. Rally does not deliberately attach your account ID, email, or name as PostHog or Sentry identity.
To prevent abuse: transiently limit anonymous requests without persisting their apparent network address or dynamic route.
To respond to you: when you contact us.

We do not use your information for advertising. We do not sell your data.

4. Third-Party Services

We share the minimum data necessary with the following service providers. Each named provider publishes its own privacy policy.

Service	Purpose	Data shared
Clerk	Authentication (sign-in, sign-up, account management)	Email, name, authentication tokens
Hosting provider (self-managed servers)	API runtime and database storage	All API traffic (request/response payloads), and all user content (groups, plans, responses, optional coarse ETA, optional circle location shares, optional recap participation)
Resend	Transactional email (plan invites, RSVP reminders, account deletion/restoration warnings)	Recipient email and the minimum content for that message; account lifecycle warnings contain only the deadline/state and no group or plan content
Apple / Google device location services	User-initiated positioning and on-device geocoding; background updates only during an active joined plan share with permission	Current device location for the chosen sharing precision or place picker, and organizer-entered place queries
Apple MapKit / Google Maps SDK (in-app map)	Renders plan place selection, live sharing maps, and circle sharing maps	Map view coordinates, the chosen plan destination, and positions displayed at the sharer’s chosen precision
Expo	Opt-in push notification delivery	Expo push token and privacy-minimized notification content
PostHog	Product analytics and API error monitoring	Anonymous product events with a random analytics identifier; no Rally account ID or profile fields; API error diagnostics
Sentry	API and mobile error monitoring, plus mobile performance monitoring	API and mobile exception messages and stack traces, app/device version, fixed or templated route/navigation context, status, and random request IDs. Rally does not attach account or profile fields; dependency exception text may contain unexpected values.

Rally's hosting infrastructure processes API traffic, including ordinary connection metadata, at the infrastructure boundary; the application-level limits above do not claim that hosting infrastructure receives no network metadata.

5. Data Safety Summary

The following table summarizes the data we collect. This is the same information you'll see in the Google Play "Data Safety" section.

Data type	Collected	Shared	Optional	User can delete?
Email address	Yes	Yes	No	Yes
Group invitation recipient email	Yes	Yes	Yes	Yes
Display name	Yes	Yes	No	Yes
Gender, if you choose to give it	Yes	No	Yes	Yes
Group names and colors	Yes	Yes	No	Yes
Group membership	Yes	Yes	Yes	Yes
Plan titles, descriptions, locations, time slots	Yes	Yes	No	Yes
Availability responses (name, optional email/note, authenticated organizer response)	Yes	Yes	No	Yes
Optional on-my-way status	Yes	Yes	Yes	Yes
One-time approximate ETA location	Yes	Yes	Yes	Yes
Optional live plan location and ETA	Yes	Yes	Yes	Yes
Plan place coordinates chosen by the organizer	Yes	Yes	Yes	Yes
Circle location share (precise or approximate position)	Yes	Yes	Yes	Yes
Optional self-confirmed recap attendance	Yes	Yes	Yes	Yes
Push notification preferences	Yes	No	Yes	Yes
Which activity items you opened, and when you last marked them all read	Yes	No	No	Yes
Expo push token	Yes	Yes	Yes	Yes
Group chat messages, reactions and reports; the unmasked original of a message the chat filter masked	Yes	No	Yes	Yes
Anonymous pages viewed and buttons tapped, not linked to your Rally account	Yes	No	No	No
Exception messages and stack traces; app/device version; fixed or templated operation/route labels; status and request IDs	Yes	No	No	No
Transient apparent network address	Yes	Yes	No	No
Device model, OS version, app version	Yes	No	Yes	No

6. Your Rights and Choices

Access: you can see all the data you've entered in the app.
Delete your account: go to Me → Delete account, or, without the app, request a one-time code for your account email on the account deletion page and enter it there. Rally first confirms that every sign-in session is revoked, then schedules permanent deletion for exactly 30 days later. During that window your profile, reserved username, memberships, authenticated responses, recap participation, and derived milestones are hidden and can be restored only after a fresh sign-in plus a one-time recovery code sent to the reserved account email. Push tokens/preferences, invitations, notification delivery state, and day-of status/ETA are removed immediately and are not restored. A group with other members transfers permanently to its longest-standing remaining member; a group where you are the only member stays private during the window. Rally sends best-effort warning emails when deletion is scheduled and when an account is restored, without group or plan content; email failure does not block either transition.
Delete content: you can delete individual groups and plans from the group or plan detail screen. Non-owner members can leave a group; this removes their membership, current day-of status/ETA, and self-confirmed recap entries in that group while group-owned plans and anonymous public-link responses remain. Owners can add or update their own authenticated availability while voting is open and remove it later as an explicit revocation. Clearing your on-my-way status immediately removes its rough ETA from member views. Stopping a circle location share removes your position from that circle's members at once. You can remove your own name from an ended Rally recap at any time; future recap views and shares update immediately, but copies people already shared cannot be recalled.
Manage push: Profile → Notifications controls all Rally push delivery and categories. Disabling push stops server delivery for the account; the device you disabled it on also asks to be unregistered, and that request needs a working connection to reach Rally — your other devices stay registered but receive nothing while the preference is off; system settings control OS permission.
Export: contact us at support@kazman.uk to request a copy of your data.

7. Data Retention

We keep active-account data for as long as the account is active. A deletion request has one stored deadline exactly 30 days later. The recovery deadline does not move if the scheduler runs late: restoration is refused at or after that exact time, and the bounded scheduler retries physical purge until both the Clerk identity and Rally account are gone. Anonymized analytics may be retained longer in aggregate form.

Pending group invitations are removed when accepted, declined, cancelled, expired after 30 days, or immediately when the matching account requests deletion. A non-owner membership, authenticated response, and self-confirmed recap participation move out of live product views during the recovery window; surviving related groups/plans restore those durable rows if the account is restored. On-my-way status and shared coarse ETA, push tokens/preferences, notification jobs/history, and invitations are removed immediately and never restored. Outside deletion requests, push tokens are removed when the current device is removed, on successful sign-out, or when Expo reports the device unregistered. Disabling push on the device that holds the token asks for it to be unregistered, which needs a working connection; a request that cannot reach Rally leaves the registration in place, and the device then receives nothing because the account's preference is off. Disabling push for the account does not remove your other devices' tokens; they stay registered and receive nothing while the preference is off. A sole-member group is hidden from public links during recovery; a group transferred to another member stays with its new owner even if the account returns. Anonymous request-rate state for the public, unauthenticated endpoints exists only in API process memory for the active window (at most one hour); a deployment restart can remove it earlier. The owner sign-in budget is different: it is stored in the database as a one-way hash of the email address the code was sent to, so the address itself is never written. That counter stops counting when its window ends, and the expired rows are removed by a cleanup that runs as the API handles other rate-limited work.

8. Security

We take reasonable measures to protect your data:

Traffic between the Rally app and our API is encrypted with HTTPS.
Authentication is handled by Clerk, which meets industry security standards.
Database access requires credentials held only by Rally's own services.

No system is perfectly secure. If you discover a security issue, please email support@kazman.uk.

9. Eligibility and Children's Privacy

Rally is intended for adults aged 18 and over. Because Rally can share a live location and ETA with a plan's members, or a location outside any meetup with a circle's members, we set the minimum age at 18 as the lowest legal surface for location sharing. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has provided us data, contact us at support@kazman.uk and we will delete it.

10. Changes to This Policy

We may update this policy from time to time. We will post the updated policy here and update the "Last updated" date. Material changes will be communicated through the app.

11. Contact

If you have any questions about this policy, contact us at support@kazman.uk.