Privacy Policy

Effective date: 2026-05-26
Last updated: 2026-08-05

---

1. Who we are

Rally ("we", "us", "our") is a padel matchmaking app for players across Pakistan. Rally lets you post a padel match you've already booked, find other players to fill the open spots, coordinate via in-app chat, and record the score afterwards. Rally also lets coaches approved by us list padel lessons, which other players can browse and book — Rally connects coaches and players but is not itself the coach and does not deliver the lesson (see Section 4 and our Terms of Service).

If you have any questions about this Privacy Policy or how we handle your data, contact us at privacy@rally.pk.

2. What this policy covers

This policy covers personal data we collect when you use the Rally mobile app (iOS and Android), including data we collect automatically when you interact with the app and data you provide to us directly.

It does not cover:

• Third-party services you sign in with (Apple, Google) — those have their own privacy policies and you agree to them when you authenticate.
• Anything that happens off-platform after you coordinate a match or a lesson (in-person conduct at the venue, payments between players, or payments between a player and a coach, etc.).
• Third-party venues you book courts with — Rally does not book courts on your behalf in this version of the app.

3. What data we collect

3.1 Data you provide when you sign up

• Authentication identifier — when you sign in with Apple or Google, we receive a user ID and email address from that provider. We use the email to identify your account and contact you about service matters.
• Full name — provided by Apple/Google at sign-in, or entered by you during onboarding. Displayed to other players in matches you join.
• Gender — collected during onboarding because Rally supports gender-segregated match types (Men's, Women's, Mixed). Gender determines which match types you can post and join. Gender is used as a server-side filter only and is not displayed on your public profile to other players. You can update your gender once via Settings; after that, changes require contacting support.
• Padel attributes — your skill level (0.1-step scale), dominant hand (left / right / both), and preferred court side (forehand / backhand / both). Used for match-fit display and your public profile.
• Profile photo (optional) — if you upload one, it is stored in Supabase Storage and displayed on your profile and in matches. If a match you are part of is shared using its link, your photo may also appear on that match's public preview page — see Section 3.5.
• Phone number (tournaments only) — if you register for a Tournament, we ask for a phone number at that moment. It is used for one purpose: we pass it to that Tournament's Organiser so they can contact you about that event, including collecting the entry fee, which is settled directly between you and the Organiser. We do not collect a phone number anywhere else in Rally, it is never shown to other players, and it is not part of your profile. We delete it after the event. You give it per Tournament; registering for a second Tournament asks again.

3.2 Data we generate as you use the app

• Matches you post and join — the venue, date, time, cost-per-player, privacy setting (Public / Private), level range, and gender preference for each match. Your roster membership in matches posted by others.
• In-app chat messages — text messages you send in match chat threads (max 1,000 characters, text-only). Stored for the lifetime of the chat retention window described in Section 7.
• Score records — the final score you submit for completed matches, plus any score disputes.
• No-show reports — if other players report you as a no-show, or you report another player.
• Reliability metrics — we maintain an internal reliability indicator on your account based on cancellation, no-show, and dispute history. This indicator is not displayed to other players in this version of the app. We use it internally for moderation and to enforce suspension rules.
• Suspension status — if your reliability metrics trigger an automatic suspension, that status is recorded on your account.
• Coaching and lessons — if you are approved by Rally as a coach, we store your coach status, the short coach bio you write, and the lessons you list (title, venue, date, time, price-per-player, capacity, and the roster of players who have booked). If you book a lesson as a player, we store your place on that lesson's roster. Rally does not collect, hold, route, or process any payment for a lesson — lesson payment is settled directly between you and the coach, off-platform.

3.3 Data we collect automatically

• Device push token — when you grant push-notification permission, your device's push token is stored so we can send notifications about your matches. Issued by Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM), routed via Expo Push.
• App and device version — for debugging and crash logs. We do not collect a persistent device fingerprint.
• Authentication logs — sign-in events, IP address at sign-in time, and refresh-token activity. Stored by our auth provider (Supabase) for security and audit purposes.
• Venue search queries — when you use the venue picker, your typed query is sent to Google Places API to retrieve matching venues. See Section 5 for what Google receives.
• Approximate location → your city — when you grant location permission, Rally reads your device's approximate location once, the first time you open the match feed, and converts it into a city name (for example, "Lahore") so your match feed can default to matches in your city. We request "while using the app" (foreground) access at coarse accuracy only — never background, "always-on," or precise location. We store only the resulting city name on your account; we do not store your GPS coordinates or build any location history. If you decline, the app works normally and your feed defaults to "All cities." You can change or revoke this permission at any time in your device Settings.

3.4 Data we do not collect

• We do not collect your precise location, track your location in the background, or keep any location history. Rally requests only one-time, foreground, city-level location — see Section 3.3.
• We do not access your contacts, photos library (other than a single photo you actively pick for your profile), microphone, or camera (other than a single photo you actively pick for your profile).
• We do not collect health, biometric, or financial data.
• We do not run advertising or marketing trackers.

3.5 Public match share pages

When a match is shared using its link, Rally generates a public preview page (at rally.pk/m/…) so the link displays a readable preview when posted, for example in WhatsApp. This page can be viewed by anyone who has the link, without signing in. It shows the match details (venue, date, time, and level range) and the name, skill level, and profile photo of each player on that match's roster. Only matches shared via their link have such a page. Treat a match link as public: share it only with people you are comfortable seeing that match's roster.

4. How we use your data

We use your data to:

• Provide the service — show you matches, let you join and post them, deliver messages in match chats, send push notifications about match activity, record scores.
• Enforce match rules — filter matches by gender, skill level, and privacy settings so the right players see the right matches.
• Protect the community — track no-shows, cancellations, and disputes, and suspend accounts that exceed our reliability thresholds.
• Communicate with you — send service notifications (match activity, account changes) and respond to your support requests.
• Comply with law — respond to lawful requests from government authorities in Pakistan and meet our legal obligations.

We do not sell your personal data. We do not share your personal data for advertising or marketing.

5. Who we share your data with

Rally uses the following third-party service providers ("processors") to operate the app. Each processor only receives the data necessary for the function it performs.

Each processor has its own privacy policy. By using Rally, you also become subject to those policies for the parts of the service they provide.

Tournament Organisers

If you register for a Tournament, we pass your name and the phone number you gave at registration to that Tournament's Organiser. Organisers are independent — they are not Rally staff and not our processors — and they use your contact details to run their own event, including collecting the entry fee. We share this only for a Tournament you actively registered for, only with that Tournament's Organiser, and we tell you at the moment we ask for the number. We delete the number after the event. We do not pass your email, your level, your match history or any other data to an Organiser.

Beyond these processors and the Tournament Organiser case above, we share your data only when:

• We are legally required to (court order, valid government request under Pakistan law).
• It is necessary to protect the safety of users or the public (for example, responding to a credible threat).
• You have explicitly asked us to (for example, by linking your account to a third-party service in a future version of the app).

We do not share your data with advertisers, data brokers, or marketing networks.

6. Where your data is stored

Rally uses Supabase to host its database, authentication system, file storage, and server functions. Rally's data is hosted by Supabase on Amazon Web Services in the South Asia region.

By using Rally, you consent to your data being transferred to and processed in the country where Rally's Supabase project is hosted, which may be outside Pakistan. Pakistan does not currently have a comprehensive cross-border data transfer regime; the Personal Data Protection Bill (when enacted) may change this, in which case we will update this policy and provide notice.

7. How long we keep your data

When you delete your account (Section 9), all of the above is removed except where we are required by law to retain a record (for example, evidence of a fraud or safety investigation that has not concluded).

8. How we protect your data

• All communication between the Rally app and our server is encrypted in transit (TLS / HTTPS).
• Data at rest in our database is protected by row-level security policies that restrict every table to the users authorized to read or modify it.
• We use industry-standard authentication via Apple Sign In and Google Sign In. We do not store your Apple or Google passwords.

No system is perfectly secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security. If a data breach occurs that meaningfully affects your data, we will notify you and the relevant authorities as required by Pakistan law.

9. Your rights

You can:

• Access your data. Most of your data is visible in the app. For anything you can't see directly, email us at privacy@rally.pk and we will send you an export.
• Correct your data. Edit your name, photo, hand, side, and (with the one-time change allowance) gender in Settings. For other corrections, email us.
• Delete your account. Settings → Delete Account triggers a server-side delete that removes your account, your profile, your match memberships, your chat messages, and your notifications. The delete is permanent. Anonymized aggregate data (for example, "a match was completed on this date") may persist where it does not identify you.
• Withdraw consent. You can revoke push-notification permission in your device Settings at any time. You can sign out at any time. Deleting your account fully withdraws consent for processing.
• Complain. If you are not satisfied with how we have handled a request, you can complain to the relevant Pakistan data protection authority once the Personal Data Protection Bill is enacted and an authority is established. In the meantime, you can complain to the Federal Investigation Agency's cybercrime wing under PECA 2016 if you believe your data has been mishandled.

10. Minimum age

Rally is intended for users aged 13 and over. We do not knowingly collect personal data from anyone under 13. If you are under 18, you should use Rally only with the consent and involvement of a parent or legal guardian. If you believe someone under 13 has provided us with personal data, contact us at privacy@rally.pk and we will delete the account.

Because matches and coaching sessions arranged through Rally involve meeting other players in person, minors should participate only with a parent or guardian's knowledge and supervision. Both app stores list Rally with a 13+ age rating.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you in the app or by email before the changes take effect. The "Last updated" date at the top reflects the most recent revision.

12. Disclaimers specific to data handling

To the maximum extent permitted by Pakistan law:

• Rally is provided on an "as-is" basis. We do not warrant that the app is uninterrupted, error-free, or free from security vulnerabilities.
• Rally is not responsible for the privacy practices of any third-party service provider listed in Section 5 beyond ensuring the processing relationship itself is documented.
• Rally is not responsible for the conduct of other users of the app, including any unauthorized use, disclosure, or misuse of information visible to them within the app (for example, your name, photo, level, hand, side, or chat messages you have sent in a match thread). Information you share in a match chat or on your profile is visible to the other players in those contexts; assume that anything you put in those fields may be seen by other players.
• Broader limitations on liability for the use of the app (including liability arising from in-person meetings, off-platform conduct, payment disputes, or any other matter outside data handling) are addressed in Rally's Terms of Service.

13. Governing law and jurisdiction

This Privacy Policy is governed by the laws of the Islamic Republic of Pakistan. Any dispute arising out of or in connection with this policy will be subject to the exclusive jurisdiction of the courts of Islamabad.

14. Contact us

Email: privacy@rally.pk

For account deletion, you can also use Settings → Delete Account inside the app.