How Rally handles your information.
Effective:
This Privacy Policy explains what Rally collects, why we use it, when it becomes visible to others, the service providers involved, and the controls available to you.
Rally uses your ZIP code as an approximate starting point. We do not request device GPS or a street-level home address. Shareable games and in-person play still involve information you choose to make visible, as described below.
1. Scope and age limit
This Policy applies to Rally's website, accounts, game-discovery and coordination features, public game pages, emails, and related support, feedback, moderation, and administration. It does not govern a third-party site or service you choose to open from Rally.
Rally is only for adults 18 and older. We do not knowingly collect personal information from children. If you believe a person under 18 has provided information to Rally, contact us so we can investigate and take appropriate action.
2. Information we collect
Account and authentication information
We collect your email address, confirmation and recovery status, account identifiers, account creation and sign-in times, adult confirmation, and authentication/session information. Supabase handles passwords and authentication. Rally does not display your email or password to other players.
Profile, location, and preference information
We collect your display name, initials, five-digit ZIP code, self-rated tennis level, formats and playing styles, maximum travel time, time zone, weekly availability, optional bio, email preferences, general activity time, and account status. Rally converts your ZIP code to an approximate Census ZIP-area point and area name for matching. We do not collect device GPS or your precise home address.
Games, participation, and communications
We collect games you post or join, including descriptions, format, style, date and time, level range, travel preference, privacy setting, selected court, status, join requests, host decisions and explanations, withdrawals, roster information, completion feedback, calendar requests, and messages in accepted-player game threads.
Safety, moderation, feedback, and court information
We collect blocks, reports, report reasons and details, moderation status, and related administrative and security audit records. Session feedback can record whether a game happened and whether another participant's level appeared lower, even, or higher.
When you submit early-access product feedback, Rally stores your message, contact permission, an account and profile snapshot, page URL and referrer, browser and device information, language, time zone, viewport and screen details, network characteristics, submission time, IP address, and user agent. Authorized administrators can review that diagnostic context. We contact you about feedback only when you opt in.
If you suggest a court correction, we collect the correction, proposed court details, review status, and any optional reporter email you provide.
Technical, security, and usage information
Rally and its providers receive information ordinarily sent when you use a web service, such as IP address, browser and device type, operating system or platform, user agent, preferred language, requested pages, referrer, timestamps, session cookies, CAPTCHA results, and server or security logs. Rally also records internal product events, such as creating a game or requesting or accepting a seat, to operate, secure, audit, and improve the service.
Information we derive
We derive approximate area and ZIP-centroid coordinates, distance and travel estimates, fit scores and fit reasons, coarse activity labels such as “Active this week,” court recommendations, short game codes, weather cache keys, and operational or security signals. Fit scores use factors such as level, approximate distance, stated availability, preferred style, host activity, and completed-game history. They are ranking aids, not decisions about eligibility, safety, character, or worth.
3. How we use information
We use information to:
- create, authenticate, recover, secure, and administer accounts;
- build profiles and show compatible public games;
- calculate approximate distance, fit, routes, courts, and weather context;
- support game posting, sharing, join requests, rosters, chat, calendars, and completion feedback;
- send requested verification, recovery, game, message, reminder, cancellation, and digest emails;
- review feedback, court corrections, reports, blocks, safety issues, and rule violations;
- detect abuse, protect accounts, investigate incidents, maintain audit records, and troubleshoot errors;
- understand and improve Rally's reliability, safety, privacy, and product experience; and
- comply with law, enforce our Terms of Service, and protect users, Rally, and others.
5. Service providers and external services
Rally uses providers to operate the service. They process information under their own contracts and privacy terms:
- Supabase provides authentication, database, realtime messaging, scheduled work, and server functions and therefore processes account and service data.
- Vercel hosts the web application and may process requests, IP addresses, user agents, logs, and content sent through Rally.
- Resend delivers authentication and game-related emails and receives recipient email addresses and the content needed for each message, which may include game details or a short chat preview.
- Cloudflare Turnstile provides bot and abuse protection during sign-up, sign-in, and account recovery and receives browser, device, network, and challenge information.
- CARTO supplies map tiles and receives tile requests, IP addresses, user agents, and the map area requested by your browser. Court map data is derived in part from OpenStreetMap.
- openrouteservice may receive approximate ZIP-area and court coordinates from Rally's server to estimate travel times. Rally does not send it player names or emails for this purpose.
- Open-Meteo receives rounded court or ZIP-area coordinates and game times needed to retrieve a forecast. Rally does not send it player names or emails for this purpose.
When you choose Google Maps or a calendar provider such as Google Calendar, Outlook, Microsoft 365, Apple Calendar, or Yahoo Calendar, Rally gives that provider the court or game details needed for your request. That handoff occurs at your direction, and the provider's privacy policy applies. Other external links, including court reservation sites and USTA resources, are also governed by the destination's terms and privacy practices.
No sale or targeted advertising
Rally does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. Rally does not use third-party advertising analytics. If those practices change, we will update this Policy and provide any notice or choices required by law before the change applies.
Cookies and similar technology
Rally and Supabase use essential cookies or equivalent browser storage to maintain authentication, security, password recovery, and session state. Cloudflare Turnstile may use cookies or similar signals for security checks. Rally does not currently use advertising cookies.
6. Your choices and privacy requests
- Profile: View and edit your name, ZIP, level, preferences, availability, and email settings from Profile.
- Email: Turn game and message alerts or the weekly digest on or off. Essential account verification, recovery, security, and service messages may still be sent when needed.
- Games and content: Edit or cancel games where the product allows it, withdraw from games, delete eligible open or cancelled games, and use report or block controls.
- Account deletion: Permanently delete your account from Profile. Review the retention details below before doing so.
- Privacy requests: Contact us to ask about access, correction, deletion, or another privacy right that applies where you live. We may need to verify your identity and may retain information where an exception applies.
Rally is designed for the United States and information is processed in the United States. If you use Rally from elsewhere, your information may be transferred to the United States, where privacy protections may differ.
7. Retention and account deletion
We keep information for as long as reasonably needed to provide and secure Rally, maintain accurate records, resolve disputes, enforce agreements, meet legal obligations, and support the purposes described in this Policy. Current product records do not all have an automatic expiration date.
Deleting your account removes the Supabase authentication account and cascades through the active Rally profile, availability, hosted games, game participation, game messages, blocks, notifications, and session feedback. Reports directly tied to the deleted profile are removed from the active reports table. Deleting a hosted game also removes its participation and messages.
Some information is handled separately and can remain after account deletion:
- Product feedback is retained indefinitely under the current system. Its submitted account/profile snapshot, diagnostics, IP address, user agent, and message remain even when the author link is removed.
- Internal product events can remain after the profile link is removed and may be used in de-identified or aggregated form.
- Moderation, security, and administrative audit records may retain incident details or snapshots where needed for safety, integrity, legal compliance, or accountability.
- Waitlist entries are separate from an account and contain the submitted email and ZIP code. Account deletion does not remove them automatically.
- Court corrections, including an optional reporter email, may remain as part of the court review and provenance record.
- Provider records, such as delivery, security, request, or backup records, may remain for the provider's normal retention cycle or as legally required.
To request removal of a waitlist entry, court-correction email, retained feedback, or other information not covered by account deletion, contact us. We will evaluate the request under applicable law and operational, safety, and recordkeeping needs.
8. Security, changes, and contact
Rally uses administrative, technical, and organizational safeguards designed to be reasonable for the nature of the service and information, including access controls, protected administrative tools, row-level database restrictions, secure transport, abuse protection, secret separation, auditing, backups, and periodic security and privacy review. We also work to select providers capable of protecting the information they process.
No system, transmission, storage method, provider, or security process is perfectly secure. We cannot guarantee that information will never be lost, misused, altered, or accessed without authorization. Protect your credentials, use a unique password, sign out of shared devices, and notify us if you suspect unauthorized account activity.
We may revise this Policy as Rally or applicable requirements change. The updated Policy will show a new effective date. When reasonably practicable, we will provide additional notice before a material change applies. Review this page periodically for the current version.
Contact
Questions or privacy requests may be sent to support@down2rally.com.