RallyUp Privacy Policy

Information you provide

• Account details: username, email address, and a password (stored only as a salted hash). If you sign in with Google, we receive your email address and basic profile information from Google instead of a password. If you sign in with Apple, we receive the name and email address you choose to share; if you use Apple’s “Hide My Email”, we only see the private relay address Apple gives us.
• Profile information: the details you choose to add: display name, photo, bio, gender, birthday, skill level (NTRP), playing style, preferences (court type, match type, languages), and your general location (a city or area you type in — not GPS coordinates).
• Content you create: chat messages, photos you send in chats, groups you create or join, events and activities, invitations you send or answer, sign-ups, check-ins, your friends and friend requests, and the home courts you save.
• Reports: if you report another user or a message, we keep the report, the reason you select, any note you add, and a snapshot of the reported content so we can review it even if the content is later deleted.

Information collected automatically

• Device location (optional): if you grant location permission, the app uses your device’s location to center the court map near you. Your GPS location is used on your device for this purpose; we do not build a history of your movements. The map requests courts for the area you are viewing, which necessarily tells our server what area of the map you looked at.
• Push notification token (optional): if you allow notifications in the iOS app, Apple gives the app a device token and we store it with your account so we can deliver alerts for new messages, friend requests, and event reminders. The token identifies the app on your device, not you personally, and we delete it when you sign out, turn notifications off, or delete your account.
• Technical basics: like nearly every internet service, our servers keep standard request logs (IP address, timestamp, endpoint) for security and debugging. These are retained for a limited period.

What we do NOT collect

• No cross-app tracking.
• No third-party analytics (no Google Analytics, Firebase, Facebook SDK, or similar).
• No contacts, no continuous background location, no health data.

• To run the Service: create your account, show your profile to other players, deliver messages, manage groups and events, and show courts near you.
• Partner matching: your profile attributes (skill level, preferences, location area, favorite courts) are used to suggest compatible players inside the app.
• Email and notifications: we send transactional email only: verification codes, password resets, reminders for events you signed up for, and notices when an organizer changes one of them. Event reminder emails can be turned off in Settings. Push notifications are sent only if you allow them on your device, and only for messages, friend requests, and event reminders. We do not send marketing email or marketing notifications.
• Safety and moderation: to review reports, enforce our Terms of Service, and keep the community safe.
• Advertising: the Service may show advertising to support free features. Any advertising is contextual (based on what screen you’re viewing, e.g. courts or events); we do not sell or rent your personal information to advertisers, and we do not let advertisers track you across other apps or websites. If we ever introduce personalized advertising, we will update this policy and ask for any consent required by law first.
• Legal compliance: to comply with applicable law or valid legal process.

We do not sell or rent personal information to anyone.

RallyUp is a social app. Your username, display name, photo, bio, and tennis-related profile details are visible to other signed-in users. That’s how players find each other. Your email address and birthday are not shown to other users (age may be shown as derived from your profile if you add it). Messages, and whether you have read them, are visible to the members of that conversation. Event sign-ups may be visible to other participants depending on the event’s settings. When you invite someone to play, they see the plan and your response to it, and you see theirs.

Home courts. When you save a court as a home court, your profile can appear beside that court on the map so players who play there can find you. You choose who sees this (everyone, friends only, or no one) under Settings → Home courts. Your friend list is visible only to you.

We share data only with:

• Infrastructure providers: our servers and email delivery provider, solely to operate the Service.
• Google: only if you choose “Continue with Google”, per Google’s own privacy policy.
• Apple: only if you choose “Continue with Apple” (sign-in), and to deliver push notifications through Apple’s notification service if you allow them, per Apple’s privacy policy.
• Authorities: if required by law, or where necessary to protect the safety of users or the public.

That’s the whole list. No data brokers, and no sharing of your personal information with advertisers.

• Your data is kept while your account is active.
• You can delete your account at any time in the app (Profile → Settings → Delete account, or Settings on the web) or by emailing us. Deletion is immediate and permanent: your profile, photos, messages, chats, events, invitations, sign-ups, check-ins, friends, home courts, and push notification tokens are removed from our production systems. If you signed in with Apple, we also revoke RallyUp’s sign-in grant with Apple. Routine encrypted backups age out on a rolling basis within 30 days.
• We retain moderation reports (including snapshots of reported content and the reporter/reported usernames) and records of moderation actions (such as account deactivations) after account deletion, because abuse records must survive the abuser deleting their account. We also retain records we are legally required to keep.

Traffic between the app and our servers is encrypted with TLS (HTTPS). Passwords are stored as salted hashes, never in plain text. Access to production systems is restricted. No internet service can promise perfect security, but we follow standard industry practices and keep our software patched.

RallyUp is not directed at children under 13, and you must be at least 13 to create an account (16 where the GDPR applies without parental consent). If we learn that an account belongs to a child under the minimum age, we will delete it. If you believe a child is using RallyUp, email us.

Where the GDPR applies, we process your information to perform our contract with you (running the Service), for our legitimate interests (keeping the community safe, preventing abuse, securing our systems), to comply with legal obligations, and with your consent where we ask for it (for example, device location and push notifications), which you can withdraw at any time in your device settings.

Depending on where you live (e.g., California CCPA, EU/UK GDPR), you may have rights to access, correct, export, or delete your personal information, and to object to certain processing. Most of these you can do directly in the app (edit profile, delete account). For anything else, email us and we’ll respond within 30 days. We do not discriminate against you for exercising your rights. We do not “sell” or “share” personal information as defined by the CCPA.

The Service is operated from the United States. By using RallyUp you understand that your information is processed and stored on servers in the United States (and our hosting provider’s locations), which may have different data-protection laws than your country.

If we make material changes, we’ll update the effective date above and notify you in the app or by email before the changes take effect. Continued use of the Service after that means you accept the updated policy.

Questions, requests, or complaints:
Email: rallyup.fit@gmail.com
Website: https://rallyup.fit