Privacy Policy

1. Who we are and how to contact us

Rally is operated by Calum Brendan Feenan, trading as Rally ("Rally", "we", "us" or "our"). We are the controller of the personal data described in this policy.

This policy explains how we collect, use, share and protect personal data when you use the Rally mobile app, our website at www.rallyapp.uk, or contact us (together, the "Services").

2. Scope and important choices

Rally helps people create and take part in accountability pacts. Information you choose to post—such as proof photos, captions, comments, reactions, location and workout activity—may be visible to other signed-in Rally users, not only to members of the relevant pact. Public pacts and community content may have broader visibility within Rally. You should not post information you would not want other signed-in Rally users to see.

Some app features may request access to HealthKit or similar device-health data. We only access this information with your permission and for the health and fitness features you choose to use. We do not use HealthKit data for advertising or marketing, and we do not sell HealthKit data.

Rally is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, please contact us at support@rallyapp.uk.

3. Personal data we collect

• Account and contact information: name, email address, profile details, authentication identifiers and user ID.
• Pact and community content: pacts, check-ins, proof photos or videos, captions, comments, reactions, reports and moderation-related information.
• Health and fitness information: workouts, activity and fitness information you choose to connect or share, including HealthKit data where you grant permission.
• Location information: information your device makes available when you use a location-enabled feature.
• Device and technical information: device model, operating system, app version, IP address, device identifiers, language, time zone, crash reports and diagnostic data.
• Usage information: feature use, interactions, app performance and reliability events.
• Communications: messages sent to support, feedback and correspondence.
• Payment and transaction information: payment status, transaction references and customer identifiers if payment features are enabled. We do not ordinarily receive full card details.

You may choose not to provide certain information. However, account details and content needed to operate a pact are necessary for the relevant features; without them, those features may not work.

4. Why we use personal data

• To create and administer your account and provide pact, check-in, proof and community features.
• To send service messages, reminders and push notifications you choose to receive.
• To maintain safety, investigate reports, enforce Community Rules, prevent abuse and protect users and our Services.
• To improve features, understand use, troubleshoot errors and maintain service reliability.
• To provide health and fitness features that you choose to connect.
• To process payments if payment features are enabled, and to meet legal obligations.

Where UK data-protection law applies, we rely on performance of our contract with you, our legitimate interests in operating a safe, reliable and improving service, legal obligations, and consent where required. For HealthKit or other health data, we use the permission and consent required for the feature you choose to use.

5. Who can see your proof and community content

• Under the current app security rules, signed-in Rally users may be able to read pact commits, comments, reactions, location information and commit images, including content outside their own pact.
• Public profiles are readable by signed-in Rally users. Public pacts and community commits may also be visible to signed-in Rally users.
• Other users may report content or conduct that they believe breaches our Community Rules.
• Authorised Rally personnel and service providers may access relevant content when reasonably necessary to provide support, investigate reports, maintain security or comply with law.

We do not use proof content or HealthKit data for targeted advertising.

6. How we share personal data

We may share personal data with other users as described above and with service providers that process data for us:

• Google Firebase: Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Messaging and Crashlytics.
• PostHog: product analytics, using its EU endpoint. The app identifies users with Firebase user ID and authentication provider, and records platform, app version, build number and lifecycle events.
• Stripe: payment setup, charges, disputes and payment/customer identifiers where payment features are used.
• UserOrient: feature-request and feedback boards. When you open UserOrient, we provide your user ID, full name and email address.

We may also share data with professional advisers or authorities where reasonably necessary to meet legal obligations, protect users, prevent fraud, enforce our rights or respond to a valid legal request. We do not sell personal data.

7. International transfers

Our providers may process personal data in the United Kingdom, European Economic Area, United States and other countries where they or their sub-processors operate. When a transfer is restricted under applicable data-protection law, we will use a lawful transfer mechanism and appropriate safeguards, such as an adequacy regulation or approved contractual safeguards. You can request further information by contacting support@rallyapp.uk.

8. Retention and account deletion

We keep personal data only for as long as reasonably necessary to provide the Services, resolve disputes, maintain security and comply with legal obligations.

When you delete your account through the app, the deletion request is processed synchronously. The current process deletes your Firebase Authentication account, your main users record and its subcollections (including device records, notification tokens and preferences), your public profile and your pact membership. If you are the only member of a pact, that pact is deleted; if you own a pact with remaining members, ownership is transferred to another member.

The current process retains a minimal Firestore deletion record containing your user ID, account-creation and deletion timestamps, authentication provider, joined-pact IDs and deletion-version information. This is retained for an account-deletion audit trail and for security, fraud-prevention and legal purposes.

Important: account deletion does not currently delete all data connected with you. It does not currently delete media in Firebase Cloud Storage (including profile and commit images), Stripe customer/payment/tax/dispute records, or every root-level comment, reaction, notification, report, community-commit or payment-charge record associated with an account where the relevant pact remains active. It also does not automatically remove data held by PostHog, UserOrient, Crashlytics, service logs or backups. We are working to improve this process.

We retain provider-held logs, analytics, support data and backups only for as long as reasonably necessary for these purposes and under the applicable provider configuration, then delete or anonymise them where reasonably practicable.

9. Security

We use reasonable technical and organisational measures designed to protect personal data, including access controls, authentication, encryption in transit and provider security controls. No system is completely secure; keep your account credentials confidential and promptly report suspected unauthorised access to support@rallyapp.uk.

10. Your rights

Depending on applicable law, you may have rights to access, correct, erase, restrict or object to our processing of your personal data, receive a portable copy of data you provided to us, and withdraw consent where we rely on it. To exercise a right, email support@rallyapp.uk. We may need to verify your identity before responding.

If you are in the UK, you may complain to the Information Commissioner's Office or call 0303 123 1113. We would appreciate the opportunity to address your concern first.

11. Cookies and website analytics

Our website may use essential cookies or similar technologies needed for it to function. We will ask for consent before using non-essential cookies or similar technologies where required by law.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version at www.rallyapp.uk/privacy, revise the “Last updated” date, and provide additional notice in the app or by email when required by law or when changes are material.

13. Governing law

This policy and any dispute or claim arising from it are governed by the laws of England and Wales. The courts of England and Wales will have exclusive jurisdiction, except where applicable law requires otherwise.

14. Contact

Questions, requests and complaints about this policy or our handling of personal data can be sent to: