Rally Privacy Policy

Last updated: July 30, 2026

1. Who we are

Rally ("Rally", "we", "us", or "our") is a mobile application that helps people organize and join local sport meetups ("rallies"). This Privacy Policy explains what personal data we collect, why we process it, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and applicable Romanian law.

For privacy questions, data-subject requests, or complaints, contact: support@rallyapp.ro.

2. Scope

This policy applies to the Rally iOS and Android apps, related backend services, and support communications. It does not cover third-party websites, maps providers, or identity providers except as described where we share data with them to operate the service.

3. Data we collect

• Account & profile: name, email address, optional bio, city, and profile photo; account role (e.g. user/admin); privacy and terms acceptance timestamps
• Authentication: sign-in via Apple, Google, or email magic link. We store provider subject identifiers and short-lived auth/refresh tokens needed to keep you signed in. We do not receive or store your Apple/Google password
• Rally content: titles, descriptions, sport type, meeting-point name and map coordinates, start time, distance/pace settings (when relevant), max participants, organizer identity, and participant join status
• Check-in & attendance: when you tap Check In near a rally, we process your approximate location at that moment to verify proximity to the meeting point, and we store a check-in timestamp and distance-from-pin. We do not continuously track your location in the background
• Device & notifications: push notification tokens and notification preference settings you choose in the app
• Safety & moderation: reports you submit (reason/details), blocks, and related moderation actions taken by Rally staff
• Technical logs: limited server logs (e.g. IP address, timestamps, error diagnostics) used for security, abuse prevention, and reliability

4. How we use location

Location is used only for features you initiate:

• Discovering nearby rallies (when you allow location for map/list distance)
• Choosing a meeting point while creating a rally
• Check-in proximity verification when you tap Check In

We do not sell location data. We do not run continuous background location tracking for advertising or profiling.

5. Why we process data (legal bases)

• Contract (Art. 6(1)(b) GDPR): creating your account, showing and joining rallies, and providing core app functionality
• Consent (Art. 6(1)(a)): optional profile fields, push notifications (where required), and photo library access for avatars. You can withdraw consent in device settings or in-app preferences without affecting unrelated processing
• Legitimate interests (Art. 6(1)(f)): keeping users safe at real-world meetups, preventing fraud/spam, moderating reports, securing the service, and improving reliability — balanced against your rights and expectations
• Legal obligation (Art. 6(1)(c)): where we must retain or disclose information to comply with applicable law or lawful requests

6. Sharing and processors

We share personal data only as needed to run Rally:

• Other Rally users: your public profile details (name, avatar, bio/city if provided) and rally participation visible in the product; organizers see participant lists for their events
• Identity providers: Apple and Google for Sign in with Apple / Google
• Email delivery: transactional email (e.g. magic links) via our email provider
• Push delivery: device push services (APNs / FCM) via our notification infrastructure
• Maps / places: map display and place search providers when you search or pick meeting points
• Hosting / storage: servers and object storage used to host the API and uploaded images (e.g. avatars)

We do not sell your personal data. Processors act under instructions and appropriate contracts. Some providers may process data outside the EU/EEA with appropriate safeguards (e.g. Standard Contractual Clauses) where required.

7. Retention

• Account data: kept while your account is active. If you delete your account, we anonymize or delete personal identifiers as described in the app
• Check-in coordinates: may be purged after approximately 90 days; attendance timestamps may be retained longer for safety and dispute handling
• Reports and moderation: retained as needed to investigate abuse and protect the community, then minimized or anonymized
• Auth tokens: short-lived; refresh tokens are revoked on logout or security events
• Server logs: retained for a limited operational period unless needed for security investigations

8. Your rights

If you are in the EU/EEA (including Romania), you may have the right to access, rectify, erase, restrict, port, and object to certain processing, and to withdraw consent where processing is consent-based.

• In the app: Settings → Download my data (export) and Settings → Delete account
• By email: support@rallyapp.ro (include the email on your Rally account)

You may also lodge a complaint with your local supervisory authority. In Romania, that is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).

9. Security

We use industry-standard measures appropriate to the risk, including encrypted transport (HTTPS), access controls on servers, and authenticated API access. No method of transmission or storage is 100% secure; please use a unique account email you control and report suspected account issues to support@rallyapp.ro.

10. Children

Rally is intended for adults. You must be at least 18 years old (or the age of majority in your country, if higher) to create an account and participate in rallies. We do not knowingly collect personal data from children. If you believe a minor has created an account, contact support@rallyapp.ro and we will take appropriate steps.

11. Changes

We may update this Privacy Policy from time to time. We will change the “Last updated” date and, where appropriate, notify you in the app or by email. Continued use after an update means you acknowledge the revised policy, except where consent is required for a new purpose.

12. Contact

Privacy & support: support@rallyapp.ro
Web: https://rallyapp.ro/support