Privacy Policy

Effective date: 2026-05-26
Last updated: 2026-06-15

---

1. Who we are

Rally ("we", "us", "our") is a padel matchmaking app for players across Pakistan. Rally lets you post a padel match you've already booked, find other players to fill the open spots, coordinate via in-app chat, and record the score afterwards.

If you have any questions about this Privacy Policy or how we handle your data, contact us at privacy@rally.pk.

2. What this policy covers

This policy covers personal data we collect when you use the Rally mobile app (iOS and Android), including data we collect automatically when you interact with the app and data you provide to us directly.

It does not cover:

• Third-party services you sign in with (Apple, Google) — those have their own privacy policies and you agree to them when you authenticate.
• Anything that happens off-platform after you coordinate a match (in-person conduct at the venue, payments between players, etc.).
• Third-party venues you book courts with — Rally does not book courts on your behalf in this version of the app.

3. What data we collect

3.1 Data you provide when you sign up

• Authentication identifier — when you sign in with Apple or Google, we receive a user ID and email address from that provider. We use the email to identify your account and contact you about service matters.
• Full name — provided by Apple/Google at sign-in, or entered by you during onboarding. Displayed to other players in matches you join.
• Gender — collected during onboarding because Rally supports gender-segregated match types (Men's, Women's, Mixed). Gender determines which match types you can post and join. Gender is used as a server-side filter only and is not displayed on your public profile to other players. You can update your gender once via Settings; after that, changes require contacting support.
• Padel attributes — your skill level (0.1-step scale), dominant hand (left / right / both), and preferred court side (forehand / backhand / both). Used for match-fit display and your public profile.
• Profile photo (optional) — if you upload one, it is stored in Supabase Storage and displayed on your profile and in matches. If a match you are part of is shared using its link, your photo may also appear on that match's public preview page — see Section 3.5.

3.2 Data we generate as you use the app

• Matches you post and join — the venue, date, time, cost-per-player, privacy setting (Public / Private), level range, and gender preference for each match. Your roster membership in matches posted by others.
• In-app chat messages — text messages you send in match chat threads (max 1,000 characters, text-only). Stored for the lifetime of the chat retention window described in Section 7.
• Score records — the final score you submit for completed matches, plus any score disputes.
• No-show reports — if other players report you as a no-show, or you report another player.
• Reliability metrics — we maintain an internal reliability indicator on your account based on cancellation, no-show, and dispute history. This indicator is not displayed to other players in this version of the app. We use it internally for moderation and to enforce suspension rules.
• Suspension status — if your reliability metrics trigger an automatic suspension, that status is recorded on your account.

3.3 Data we collect automatically

• Device push token — when you grant push-notification permission, your device's push token is stored so we can send notifications about your matches. Issued by Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM), routed via Expo Push.
• App and device version — for debugging and crash logs. We do not collect a persistent device fingerprint.
• Authentication logs — sign-in events, IP address at sign-in time, and refresh-token activity. Stored by our auth provider (Supabase) for security and audit purposes.
• Venue search queries — when you use the venue picker, your typed query is sent to Google Places API to retrieve matching venues. See Section 5 for what Google receives.
• Approximate location → your city — when you grant location permission, Rally reads your device's approximate location once, the first time you open the match feed, and converts it into a city name (for example, "Lahore") so your match feed can default to matches in your city. We request "while using the app" (foreground) access at coarse accuracy only — never background, "always-on," or precise location. We store only the resulting city name on your account; we do not store your GPS coordinates or build any location history. If you decline, the app works normally and your feed defaults to "All cities." You can change or revoke this permission at any time in your device Settings.

3.4 Data we do not collect

• We do not collect your precise location, track your location in the background, or keep any location history. Rally requests only one-time, foreground, city-level location — see Section 3.3.
• We do not access your contacts, photos library (other than a single photo you actively pick for your profile), microphone, or camera (other than a single photo you actively pick for your profile).
• We do not collect health, biometric, or financial data.
• We do not run advertising or marketing trackers.

3.5 Public match share pages

When a match is shared using its link, Rally generates a public preview page (at rally.pk/m/…) so the link displays a readable preview when posted, for example in WhatsApp. This page can be viewed by anyone who has the link, without signing in. It shows the match details (venue, date, time, and level range) and the name, skill level, and profile photo of each player on that match's roster. Only matches shared via their link have such a page. Treat a match link as public: share it only with people you are comfortable seeing that match's roster.

4. How we use your data

We use your data to:

• Provide the service — show you matches, let you join and post them, deliver messages in match chats, send push notifications about match activity, record scores.
• Enforce match rules — filter matches by gender, skill level, and privacy settings so the right players see the right matches.
• Protect the community — track no-shows, cancellations, and disputes, and suspend accounts that exceed our reliability thresholds.
• Communicate with you — send service notifications (match activity, account changes) and respond to your support requests.
• Comply with law — respond to lawful requests from government authorities in Pakistan and meet our legal obligations.

We do not sell your personal data. We do not share your personal data for advertising or marketing.

5. Who we share your data with

Rally uses the following third-party service providers ("processors") to operate the app. Each processor only receives the data necessary for the function it performs.

Each processor has its own privacy policy. By using Rally, you also become subject to those policies for the parts of the service they provide.

Beyond these processors, we share your data only when:

• We are legally required to (court order, valid government request under Pakistan law).
• It is necessary to protect the safety of users or the public (for example, responding to a credible threat).
• You have explicitly asked us to (for example, by linking your account to a third-party service in a future version of the app).

We do not share your data with advertisers, data brokers, or marketing networks.

6. Where your data is stored

Rally uses Supabase to host its database, authentication system, file storage, and server functions. Rally's data is hosted by Supabase on Amazon Web Services in a South Asia region.

By using Rally, you consent to your data being transferred to and processed in the country where Rally's Supabase project is hosted, which may be outside Pakistan. Pakistan does not currently have a comprehensive cross-border data transfer regime; the Personal Data Protection Bill (when enacted) may change this, in which case we will update this policy and provide notice.

7. How long we keep your data

When you delete your account (Section 9), all of the above is removed except where we are required by law to retain a record (for example, evidence of a fraud or safety investigation that has not concluded).

8. How we protect your data

• All communication between the Rally app and our server is encrypted in transit (TLS / HTTPS).
• Data at rest in our database is protected by row-level security policies that restrict every table to the users authorized to read or modify it.
• We use industry-standard authentication via Apple Sign In and Google Sign In. We do not store your Apple or Google passwords.

No system is perfectly secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security. If a data breach occurs that meaningfully affects your data, we will notify you and the relevant authorities as required by Pakistan law.

9. Your rights

You can:

• Access your data. Most of your data is visible in the app. For anything you can't see directly, email us at privacy@rally.pk and we will send you an export.
• Correct your data. Edit your name, photo, hand, side, and (with the one-time change allowance) gender in Settings. For other corrections, email us.
• Delete your account. Settings → Delete Account triggers a server-side delete that removes your account, your profile, your match memberships, your chat messages, and your notifications. The delete is permanent. Anonymized aggregate data (for example, "a match was completed on this date") may persist where it does not identify you.
• Withdraw consent. You can revoke push-notification permission in your device Settings at any time. You can sign out at any time. Deleting your account fully withdraws consent for processing.
• Complain. If you are not satisfied with how we have handled a request, you can complain to the relevant Pakistan data protection authority once the Personal Data Protection Bill is enacted and an authority is established. In the meantime, you can complain to the Federal Investigation Agency's cybercrime wing under PECA 2016 if you believe your data has been mishandled.

10. Minimum age

Rally is intended only for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has provided us with personal data, contact us at privacy@rally.pk and we will delete the account.

Because matches arranged through Rally involve meeting other players in person, the app is restricted to adults. Both app stores list Rally with an 18+ age rating.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you in the app or by email before the changes take effect. The "Last updated" date at the top reflects the most recent revision.

12. Disclaimers specific to data handling

To the maximum extent permitted by Pakistan law:

• Rally is provided on an "as-is" basis. We do not warrant that the app is uninterrupted, error-free, or free from security vulnerabilities.
• Rally is not responsible for the privacy practices of any third-party service provider listed in Section 5 beyond ensuring the processing relationship itself is documented.
• Rally is not responsible for the conduct of other users of the app, including any unauthorized use, disclosure, or misuse of information visible to them within the app (for example, your name, photo, level, hand, side, or chat messages you have sent in a match thread). Information you share in a match chat or on your profile is visible to the other players in those contexts; assume that anything you put in those fields may be seen by other players.
• Broader limitations on liability for the use of the app (including liability arising from in-person meetings, off-platform conduct, payment disputes, or any other matter outside data handling) are addressed in Rally's Terms of Service.

13. Governing law and jurisdiction

This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan. Any dispute arising out of or in connection with this policy will be subject to the exclusive jurisdiction of the courts of Islamabad.

14. Contact us

Email: privacy@rally.pk

For account deletion, you can also use Settings → Delete Account inside the app.